kspearrin/otp.net

A .NET implementation of TOTP and HOTP for things like two-factor authentication codes.

Otp.NET

An implementation TOTP RFC 6238 and HOTP RFC 4226 in C#.

Get it on NuGet

https://www.nuget.org/packages/Otp.NET

Install-Package Otp.NET 

or

dotnet add package Otp.NET

Documentation

• TOTP (Timed One Time Password)
• HOTP (HMAC-based One Time Password)
• OTP Uri
• Base32 Encoding

TOTP (Timed One Time Password)

TOTP is an algorithm that uses a rolling window of time to calculate single use passwords. It is often used for two factor authentication. The Google Authenticator app uses TOTP to calculate one time passwords. This library implements TOTP code calculation in C#. This could be embedded in a mobile app using Mono, or used server side to simply validate codes that are provided.

Creation of a TOTP object

Use of the library is fairly straightforward. There is a class called Totp. Simply create a new instance of it and pass in the shared secret key in plaintext as a byte array.

using OtpNet;

var totp = new Totp(secretKey);

There are several options that can be used to change how the code is calculated. These are all mentioned in the RFC. These options are specified when the TOTP object is created.

Different hash algorithms can be used to calculate the code. The default is Sha1, but Sha256, and Sha512 may be used instead.

To change that behavior from the default of Sha1 simply pass in the OtpHashMode enum with the desired value into the constructor.

var totp = new Totp(secretKey, mode: OtpHashMode.Sha512);

The time step window can also be specified. The RFC recommends a window of thirty seconds. That means that a new code will be generated every thirty seconds. The step window can be changed however if required. There are not tests around this as the RFC test tables all use a 30 second window so use this feature at your own risk. Like the hash mode, pass this value into the constructor. It is an int that represents seconds.

var totp = new Totp(secretKey, step: 15); // a new code will be generated every 15 seconds

Finally the truncation level can be specified. Basically this is how many digits do you want your TOTP code to be. The tests in the RFC specify 8, but 6 has become a de-facto standard if not an actual one. For this reason the default is 6 but you can set it to something else. There aren't a lot of tests around this either so use at your own risk (other than the fact that the RFC test table uses TOTP values that are 8 digits).

var totp = new Totp(secretKey, totpSize: 8);

Code Calculation

Once you have an instance of the Totp class, you can easily calculate a code by Calling the ComputeTotp method. You need to provide the timestamp to use in the code calculation. DateTime.UtcNow is the recommended value. There is an overload that doesn't take a parameter that just uses UtcNow.

var totpCode = totp.ComputeTotp(DateTime.UtcNow);
// or use the overload that uses UtcNow
var totpCode = totp.ComputeTotp();

Remaining Time

There is a method that will tell you how much time remains in the current time step window in seconds.

var remainingTime = totp.RemainingSeconds();
// there is also an overload that lets you specify the time
var remainingSeconds = totp.RemainingSeconds(DateTime.UtcNow);

Verification

The TOTP implementation provides a mechanism for verifying TOTP codes that are passed in. There is a method called VerifyTotp with an overload that takes a specific timestamp.

public bool VerifyTotp(string totp, out long timeWindowUsed, VerificationWindow window = null);
public bool VerifyTotp(DateTime timestamp, string totp, out long timeWindowUsed, VerificationWindow window = null)

If the overload that doesn't take a timestamp is called, DateTime.UtcNow will be used as the comperand.

One Time Use

There is an output long called timeWindowUsed. This is provided so that the caller of the function can persist/check that the code has only been validated once. RFC 6238 Section 5.2 states that a code must only be accepted once. The output parameter reports the specific time window where the match occured for persistance comparison in future verification attempts.

It is up to the consumer of this library to ensure that only one match for a given time step window is actually accepted. This library will only go so far as to determine that there was a valid code provided given the current time and the key, not that it was truly used one time as this library has no persistence.

Expanded time Window

RFC 6238 Section 5.2 defines the recommended conditions for accepting a TOTP validation code. The exact text in the RFC is "We RECOMMEND that at most one time step is allowed as the network delay."

The VerifyTotp method takes an optional VerificationWindow parameter. This parameter allows you to define the window of steps that are considered acceptable. The actual step where the match was found will be reported in the aforementioned output parameter.

The default is that no delay will be accepted and the code must match the current code in order to be considered a match. Simply omitting the optional parameter will cause this default behavior.

If a time delay is required, a VerificationWindow object can be provided that describes the acceptable range of values to check.

To allow a delay as per the recommendation of the RFC (one time step delay) create a verification window object as follows

var window = new VerificationWindow(previous:1, future:1);

This means that the current step, and 1 step prior to the current will be allowed in the match. If you wanted to accept 5 steps backward (not recommended in the RFC) then you would change the previous parameter to 5.

There is also a parameter called future that allows you to match future codes. This might be useful if the client is ahead of the server by just enough that the code provided in slightly ahead.

Ideally the times should match and every effort should be taken to ensure that the client and server times are in sync.

It is not recommended to provide any value other than the default (current frame only) or the RFC recommendation of this and one frame prior as well as one frame ahead (see below)

var window = new VerificationWindow(previous:1, future:1);

In order to make using the RFC recommendation easier, there is a constant that contains a verification window object that complies with the RFC recommendation.

VerificationWindow.RfcSpecifiedNetworkDelay

This can be used as follows

totp.VerifyTotp(totpCode, out timeWindowUsed, VerificationWindow.RfcSpecifiedNetworkDelay);

Time compensation

In an ideal world both the client and the server's system time are correct to the second with NIST or other authoritative time standards. This would ensure that the generated code is always correct. If at all possible, sync the system time as closely as with NIST.

There are cases where this simply isn't possible. Perhaps you are writing an app to generate codes for use with a server who's time is significantly off. You can't control the erroneous time of the server. You could set your system clock to match but then your time would be off significantly which isn't the desired result. There is a class called TimeCorrection that helps with these cases.

A time correction object creates an offset that can be used to correct (at least for the purposes of this calculation) the time relative to the incorrect system time.

It is created as follows

var correction = new TimeCorrection(correctTime);

Where the correct time parameter is a DateTime object that represents the current correct (at least for the purposes of verification) UTC time. For this to work there needs to be some way to get an instance of the current acceptable time. This could be done with an NTP (NTP with NIST is coming soon in this library) or looking for a Date response header from an HTTP request or some other way.

Once this instance is created it can be used for a long time as it always will use the current system time as a base to apply the correction factor. The object is threadsafe and thus can be used by multiple threads or web requests simultaneously.

There is an overload that takes both the correct time and the reference time to use as well. This can be used in cases where UTC time isn't used.

The Totp class constructor can take a TimeCorrection object that will be applied to all time calculations and verifications.

var totp = new Totp(secretKey, timeCorrection: correction);

HOTP (HMAC-based One Time Password)

In addition to TOTP, this library implements HOTP (counter based) code calculation in C#.

Creation of an HOTP object

using OtpNet;

var hotp = new Hotp(secretKey);

There are several options that can be used to change how the code is calculated. These are all mentioned in the RFC. These options are specified when the HOTP object is created.

Different hash algorithms can be used to calculate the code. The default is Sha1, but Sha256, and Sha512 may be used instead.

To change that behavior from the default of Sha1 simply pass in the OtpHashMode enum with the desired value into the constructor.

var hotp = new Hotp(secretKey, mode: OtpHashMode.Sha512);

Finally the truncation level can be specified. Basically this is how many digits do you want your HOTP code to be. The tests in the RFC specify 8, but 6 has become a de-facto standard if not an actual one. For this reason the default is 6 but you can set it to something else. There aren't a lot of tests around this either so use at your own risk (other than the fact that the RFC test table uses HOTP values that are 8 digits).

var hotp = new Hotp(secretKey, hotpSize: 8);

Verification

The HOTP implementation provides a mechanism for verifying HOTP codes that are passed in. There is a method called VerifyHotp with an overload that takes a counter value.

public bool VerifyHotp(string totp, long counter);

OTP Uri

You can use the OtpUri class to generate OTP style uris in the "Key Uri Format" as defined here: https://github.com/google/google-authenticator/wiki/Key-Uri-Format

var uriString = new OtpUri(OtpType.Totp, "JBSWY3DPEHPK3PXP", "[email protected]", "ACME Co").ToString();
// uriString is otpauth://totp/ACME%20Co:alice%40google.com?secret=JBSWY3DPEHPK3PXP&issuer=ACME%20Co&algorithm=SHA1&digits=6&period=30

Base32 Encoding

Also included is a Base32 helper.

var key = KeyGeneration.GenerateRandomKey(20);

var base32String = Base32Encoding.ToString(key);
var base32Bytes = Base32Encoding.ToBytes(base32String);

var otp = new Totp(base32Bytes);

Credits

This project is originally based on the OtpSharp library. OtpSharp was written by Devin Martin.

otp.net's Issues

`question:` can you give an example on how to use `timeWindowUsed`

[question]

Hello everyone.
@kspearrin thank you for your contribution to the community. Can you (or anyone else) give me an example of how to use timeWindowUsed to check if the code has already been used? I know that there is a section about that, but there is no code example.

VerifyTotp is returning false randomly even Step time is not expired

HI , VerifyTotp is returning false randomly even Step time is not expired. Please suggest us what should we have to do now.

TOTP window start

We have Totp.RemainingSecods() which however does not indicate when the current time window started. There is no way to find out the steps that the Totp was created with (#45) so developers cannot even calculate it manually given an instance of Totp.

How about adding Totp.ElapsedSeconds()?

Totp code in server not match with auth app

Hi , First thanks a lot for this grate work and amazing pkg ..
I have a trouble with matching syncing code between API in server and auth app in client side ..
I tried using time correction and also using compute from specific time but is the same ..
My API timezone is Iraq, Baghdad (+3 GMT) and all my clients in the same time zone ..
Below are my custom class that i used ..

using Infrastructure.Static;
using Microsoft.AspNetCore.Identity;
using OtpNet;
using QRCoder;

namespace Infrastructure.OTP;

public static class Totp
{
    private static int _size = 6;
    private static int _step = 30;
    private static string _issuer = "Paradise";
    private static OtpHashMode _hashMode = OtpHashMode.Sha256;

    public static string SecretKey() => Base32Encoding.ToString(KeyGeneration.GenerateRandomKey(_hashMode));

    public static string GenCode(string key) => new OtpNet.Totp(Base32Encoding.ToBytes(key), 
        _step, _hashMode, _size).ComputeTotp(DateTime.UtcNow.AddHours(+3));

    public static bool Verified(string key, string code) => new OtpNet.Totp(Base32Encoding.ToBytes(key), 
        _step, _hashMode, _size).VerifyTotp(DateTime.UtcNow.AddHours(+3), code, out _, new(1, 1));

    public static string Uri(string key, string identity) => new OtpUri(OtpType.Totp, 
        key, identity, _issuer, _hashMode, _size, _step).ToString();

    public static string QRCodeAsBase64(string key, string identity) => Convert.ToBase64String(new PngByteQRCode
        (new QRCodeGenerator().CreateQrCode(Uri(key, identity), QRCodeGenerator.ECCLevel.Q)).GetGraphic(20));
}

System.ArgumentException on base32 encoding string input

When attempting to base32 encode the string "3FC6145A2155E732" the Base32Encoding.ToBytes() method throws the exception below:

Character is not a Base32 character. Parameter name: c

I have since used sample code from MS which, despite the awful formatting, works and is able to encode the value. The same can be said for online services.

Code invalid (not matching Google Auth)

Hi!
I have a little problem. The code generated by ComputeTotp is different from the one shown in Google Authenticator.

I generate a base32 key like this (code in VB)

Dim secretKey As Byte() = KeyGeneration.GenerateRandomKey()

Dim base32String As String = Base32Encoding.ToString(secretKey )

I pass this base32String as secret to the QR I generate (I also tried entering the key manually, both generates the same random codes)

Then, when I try to validate the code, the generated code is different from the one in Google. Heres my code:

Dim secretKeyData As Byte() = Base32Encoding.ToBytes(secretKey)
Dim totp As New Totp(secretKeyData)
Dim validCode As String = totp.ComputeTotp()
'validCode is different from the one that appears on Google Authenticator

This is one of the keys that was randomly generated: 4FY2PLSR6WZ5V72YQS5SAE3VRPQRGWLQ

Any clue in what im doing wrong?

Thanks!

Vulnerable to a Timing attack / Side channel

The comparison here makes your implementation vulnerable to a Timing attack. You should use a comparison method like this one for example.

Generated codes do not match Google Authenticator results

I am using this code:

string secret = "KREQPD7NXSGO3T3B";
while (true)
{
    byte[] secretBytes = new Base32Encoder().Decode(secret);
    OtpNet.Totp totp = new OtpNet.Totp(secretBytes);
    string twoFactorCode = totp.ComputeTotp();

    Console.WriteLine("Two factor code: " + twoFactorCode);

    System.Threading.Thread.Sleep(2000);
}

Now if you take that same string (for secret) and put it in to Google Authenticator manually, you will notice that this code generates different keys. On the otherhand, if I use a different value for secret (eg "uhj34qsyuwftzji4qq6k3c3wnstdb57m") then both the values generated by OtpNet and Google Authenticator will match.

What am I doing wrong?

Strong Name Key

Hi kspearrin! Your OTP solution is excellent, but I do have a small request. Would you sign it with a strong name key so that it will work natively with other strongly named assemblies? For now I can re-compile the source with a key on my own, but I think this would be a nice feature for your other users via NuGet.

VerifyTotp

Hello,
I really don't understand why I should pass timeWindowUsed for the VerifyTotp method. It is required param? What it is the number, I should save it?
Please, provide case where is it used. :(

Regards.

How to match the code with a flutter library?

Hello everyone,
I am using the library dart-otp in a flutter app that generate the code and i need to validate this code in c# but i couldn't validate this code nor generate the same code from the two libraries.
The code in flutter/dart is

var now = DateTime.now();
      now = DateTime(2023, 04, 26, 10, 10, 10);

      var code = OTP.generateTOTPCodeString(
          'DDXFM42476476545', now.millisecondsSinceEpoch,
          algorithm: Algorithm.SHA256, isGoogle: false);

      print(code);  // Out 667099

In C# the code is

string skey = "DDXFM42476476545";

            var  now = new DateTime(2023, 04, 26, 10, 10, 10);
            var totp = new Totp(Base32Encoding.ToBytes(skey),30,OtpHashMode.Sha256);
            var code = totp.ComputeTotp(now);
 //code = 734057

Can anyone help to figure this difference?

I need my code's validity must be 15 seconds

var step = 15; //Code must be valid for 15 seconds.
var secretKey = Base32Encoding.ToBytes("test");
var totp = new Totp(secretKey, step);
var totpCode = totp.ComputeTotp(); //Let's say this line is running at 08:54:10 (hh:mm:ss) o'clock.
var verified = totp.VerifyTotp(totpCode, out long timeWindowUsed); //Let's say this line is running at 08:54:20 (hh:mm:ss): It returns FALSE probably because another step window is reached!

Unfortunately, verified variable is false, so the totpCode is no longer valid 5 seconds before my required expiration (08:54:25).

When using timestamp to verify the code, it isn't converted to UTC

Hi,
Maybe I'm missing something, but is there a reason when using the timestamp parameter it isn't converted to UTC as when we do not use it?

Regards

ValidateTotp Issue

Can some please help with this as i am stuck really.
If i create the QRcode and set it up with an authnticator the validate all works fine.
However if i generate the secret and store this, then use it to create a TOTP and try to validate this, it always fails?
I want to use email validation as well as an authenticator app.
So i am generating an email with the totp created using the stored secret, but it fails validation.

Can some please help or point me in the right direction with this?

public class TotpManager : ITotpManager
{
private readonly string _qrCodeImagePrefix = "data:image/png;base64,";
private readonly string _totpAuthPrefix = "otpauth://totp/";

public string GenerateBase32Secret()
{
    var bytes = KeyGeneration.GenerateRandomKey(20);
    return Base32Encoding.ToString(bytes);
}

public string GenerateTotp(string base32Secret)
{
    var secretBytes = Base32Encoding.ToBytes(base32Secret);
    var totp = new Totp(secretBytes);
    return totp.ComputeTotp();
}
public string GenerateTotp(string base32Secret, int step)
{
    var secretBytes = Base32Encoding.ToBytes(base32Secret);
    var totp = new Totp(secretBytes, step);
    return totp.ComputeTotp();
}

public bool ValidateTotp(string base32Secret, string totp)
{
    var secretBytes = Base32Encoding.ToBytes(base32Secret);
    var totpValidator = new Totp(secretBytes);
    return totpValidator.VerifyTotp(totp, out _);
}

public string GenerateQrCodeUrl(string issuer, string accountName, string base32Secret)
{
    string totpUrl =
        $"{_totpAuthPrefix}{Uri.EscapeDataString(issuer)}:{Uri.EscapeDataString(accountName)}?secret={base32Secret}&issuer={Uri.EscapeDataString(issuer)}&algorithm=SHA1&digits=6&period=30";

    var qrGenerator = new QRCodeGenerator();
    var qrCodeData = qrGenerator.CreateQrCode(totpUrl, QRCodeGenerator.ECCLevel.Q);
    var qrCode = new QRCode(qrCodeData);

    using MemoryStream ms = new MemoryStream();
    using Bitmap qrCodeImage = qrCode.GetGraphic(20);
    qrCodeImage.Save(ms, ImageFormat.Png);
    byte[] qrCodeBytes = ms.ToArray();

    return $"{_qrCodeImagePrefix}{Convert.ToBase64String(qrCodeBytes)}";
}

}

Please add .netstandard2.0 target support

accounting to microsoft dotnet open source library guide here

✔️ DO start with including a netstandard2.0 target.

Most general-purpose libraries should not need APIs outside of .NET Standard 2.0. .NET Standard 2.0 is > supported by all modern platforms and is the recommended way to support multiple platforms with > one target.

Typo in exception message in Base32Encoding.ValueToChar() in Base32Encoding.cs

Otp.NET/src/Otp.NET/Base32Encoding.cs

Line 129 in 90c1114

throw new ArgumentException("Byte is not a value Base32 value.", "b");

should probably not have two instances of the word "value." I noticed this because this exception was thrown when I passed a string with the "@" symbol in it.

Support HOTP

Hi,
Thanks for making this!
Is there any chance of adding HOTP support in addition to TOTP?

Cheers

OtpUri's counter parameter is not `long`, while Hotp's ComputeHOTP is.

When the class Hotp expects a counter in ComputeHOTP as a long, it makes perfect sense to expect the parameter OtpUri accepts for counter to be long as well.

Can this be used with .net core ?

Can this be used with .net core ?

TOTP One Time Use

Hello,
how to use TOTP for One Time Use (Only to be able to verify only one time )
Thank you

Application name is not displaying in the Microsoft Authenticator mobile App?

When I scan the QR code in the Microsoft Authenticator mobile app, it does not show the application name instead of showing the email. but the same code is working fine with the Google Authentication (showing the application name).

Any thought about the issue?

Unable to match TOTP codes with Google authenticator output

Hello and thanks for writing this library!

I am trying to leverage the Totp class to match the 6-digit codes generated by the Google Authenticator app when the two are initialized with the same shared secret.

I initialized my google auth app as follows:

// using QRCoder NuGet package
var qrCodeGenerator = new QRCoder.QRCodeGenerator();
var qrCode = new QRCode(qrCodeGenerator.CreateQrCode("otpauth://totp/Test:[email protected]?secret=JBSWY3DPEHPK3PXP&issuer=Test", QRCoder.QRCodeGenerator.ECCLevel.Q));
qrCode.GetGraphic(10).Dump(); // in LinqPad makes a QRCode which you can scan in

I then tried to verify / match with this library as follows

foreach (var mode in CoreUtilities.GetValues<OtpHashMode>())
{
	var totp = new Totp(Convert.FromBase64String("JBSWY3DPEHPK3PXP"), mode: mode, totpSize: 6, step: 30);
	totp.ComputeTotp().Dump();
	totp.VerifyTotp("code my google auth shows", out var matched, window: new VerificationWindow(10, 10)).Dump();
}

Am I doing something obviously wrong? Would you expect this to work? Thanks in advance for your help!

Add signature

In order to ensure security, you need to add a signature using the SHA-256 algorithm.

Token expired when scanning a Totp generated Uri on "Authy Authenticator App"

Google, Microsoft, Duo can successfully scan TOTP QrCodes and work flawlessly with this library. However Authy does not seem to recognize the token format at all, when it clearly states that this type of QR Code should be supported? Can you verify this ?

Unable to get MD5 checksum for the key file "vs-signing-key.pfx". Could not find file 'C:\path\vs-signing-key.pfx'. Otp.NET

Hello, I am experiencing this error. Do you have any clue on how I may fix it?

RemainingSeconds is the same for all codes in same time step.

Why does generating a new code within the same time step but with a different key not have a new RemainingSeconds?

If I call GetTotp two times with a step of 9 minutes, the second call has a RemainingSeconds of the first call.

GetTotp takes a byte[] and count, 1, 2, 3, etc. the byte[] key is a hashed salt and count which generates a new code. I found that I had to make the key more unique than the previous call to GetTotp because calling GetTotp again (like when user wants a new key) within the 9 minute step just returned the same code.

Example. time step is 540 seconds.

GetTotp(salt, 1);
"309960"
RemainingSeconds 539

wait some seconds and call again...

GetTotp(salt, 2);
"718933"
RemainingSeconds 460

I expected RemainingSeconds to be closer to 539

        internal string GetTotp(byte[] salt, int count)
        {
            string saltedKey = HashSomeStringWithSalt(salt, count.ToString());
            byte[] key = Convert.FromBase64String(saltedKey);

            var totp = new Totp(key, step: 540, mode: OtpHashMode.Sha256, totpSize: 6);

            var dateTimeNow = DateTime.UtcNow;
            var totpCode = totp.ComputeTotp(dateTimeNow);
            return totpCode;
        }


        internal int GetOTPRemainingSeconds(byte[] salt, int count)
        {
            string saltedKey = HashSomeStringWithSalt(salt, count.ToString());
            byte[] key = Convert.FromBase64String(key);
            var totp = new Totp(key, step: 540, mode: OtpHashMode.Sha256, totpSize: 6);

            return totp.RemainingSeconds();
        }

When mode = OtpHashMode.Sha512 Microsoft Authenticator gen wrong code

I'm not sure if it's an error in this lib or the app. But when the mode is set to OtpHashMode.Sha512, the codes generated by Microsoft Authenticator do not work, while those from Google Authenticator work.
Putting it in Sha1 both work.

How to use Verification in a Web Application and persistent data?

How to use Verification in a Web Application and persistent data?

This line is kind of strange

Otp.NET/src/Otp.NET/Otp.cs

Line 108 in 14a0a1c

| (hmacComputedHash[offset + 3] & 0xff) % 1000000;

Hallo,
I just want to tell you that this line is strange (Otp.cs, 108). First, because it does not work (and this is good) and second, the module operation is implemented later anyway, when the Otp string is truncated with the size specified in "otp-size" setting.

The modulo 1000000 there which should in principle keep only the last 6 digits must be something from older times when the OTP was probably hardcoded to 6 digits long. But due to the fact that the compiler is running "last byte modulo 100000" the result is always the "last byte" because an "unsigned byte" is maximal 255 big. And this is OK, because otherwise we would have had a problem if we would expected OTPs with more than 6 digits.

Regards

incompatible version

[Notification][Install] Install failed (project: GoogleAuth, package: Otp.NET v1.2.2)

Could not install package 'Otp.NET 1.2.2'. You are trying to install this package into a project that targets '.NETFramework,Version=v4.0,Profile=Client', but the package does not contain any assembly references or content files that are compatible with that framework. For more information, contact the package author.

Any workaround for "top of the minute" & "bottom of the minute" boundaries?

Previously I added this question as a comment in #43 but I believe this merits a new post of its own because it is a different question.

The following problem assume a default expiry duration of 30 seconds is used.

If I create a new token at 10:15:00 current time, it gets expired at 10:15:30 current time, which is as expected, but when I create a new token at let's say 10:15:28 current time, it is expired after 2 seconds at 10:15:30 time mark, instead of expiring after 30 seconds.

I want my tokens to expire after exact 30 (or N) seconds, no matter I generate them at "top of the minute" or "bottom of the minute" boundaries. Is it possible?

Instagram TOTP Codes are Invalid

Good afternoon,

I'm trying to make Otp.NET work with Instagram. When enabling 2FA Instagram gives you a Base32 string of characters. Using this string here, I would expect the codes Otp.NET would generate accurate 6 digit TOTP responses:

Dim TFA As New OtpNet.Totp(OtpNet.Base32Encoding.ToBytes("xxxxx"))
Dim TFACode As String = TFA.ComputeTotp(DateTime.UtcNow)

Even after iterating through each timezone when trying to generate codes the Otp.NET codes are invalid. The codes are also different than what Google Authenticator when generating codes at the same time for the same Base32 string, and those codes work. I have a .Net solution and an exemplar account I would be happy to give you access to privately in support of any troubleshooting you might be able to help me with.

Microsoft Authenticator problem

Or possibly just a lack of understanding.

I generate a key using a human-readable format as a temporary thing when testing like so:

Encoding.ASCII.GetBytes("hello")

But the TOTPs that are generated with ComputeTotp() do not match the value that the Android Microsoft Authenticator app is showing with the same secret entered manually. The phone and PC clocks are within a few ms of each other, so it's not a skewing issue as far as I can tell.

I even tried using the Base32Encoded version of the secret as a key

The Authenticator app claims to be compatible with the RFC, so I can't think what other variable I can change. I'm fairly certain that it uses the SHA1 hashing algorithm (and I did try all of the SHA2 variants just to be sure, and none of these worked either).

What level of testing coverage is there for Otp.NET?

Thanks for creating this library! I especially appreciate the effort you put into the documentation.

I am looking to leverage this in an application and one question I have is how heavily-tested this is. On perusal of the source code I wasn't able to find any unit tests, but perhaps they live elsewhere?

Properties

Is there a reason why the classes don't have properties reflecting their configuration, e.g. Totp.Steps, Otp.HashMode etc.?

[Questions] - VerifyTotp is incorrect?

Tks for your libs so much

• I'm using "ComputeTotp" method to generate Otp token with step 30s (expired otp). However I'm check "VerifyTotp" method to verify gererated otp token is valid or not but after 30 seconds the generated otp token is still valid and nearly 1 minute expired after that.
  So I'd like to ask you is it correct ? and how to config expired time exactly.

Tks and have a nice day

VerifyTotp does not exist

I need help verifying my TOTP code.

According to the README we can use a method called VerifyTotp, but this doesnt seem to exist in the code base and does not show up in intellisense.

How do we verify TOTP codes?

Create otp.net.dll File

Hi Kyle,

Are you able to create dll File and upload?

thanks a lot

Recent updates released on Nuget?

Hi,

Curious if any of the recent changes will be published to Nuget?

Current version on Nuget is 1.3.0 from 23/12/2022, there looks to have been some nice fixes made since this release that we would like to consume ideally without having to fork a copy of the repo.

Regards Chad

Invalid QR Codes generated

If you use
var uriString = new OtpUri(OtpType.Totp,secretBytes,userName,issuer);
the secretBytes will undergo the transformation
Base32Encoding.ToString(secret)
in the constructor.
It is entirely possible, that the resulting string ends with an equal sign '='.
In that case, should you put the resulting string in a QR Code generator and try to scan it:

• Google Authenticator will inform you that it is not a valid uri.
• Microsoft Authenticator will freeze the camera roll and refuse to work until restarted.
• Tested on iOS 16.3.1

The string needs to be sanitized, if you remove the trailing '=' character(s), both apps will recognize the Code as valid.

Suggested change in the public override string ToString():
Dictionary<string, string> dictionary = new Dictionary<string, string>() { { "secret", this.Secret } };
to
Dictionary<string, string> dictionary = new Dictionary<string, string>() { { "secret", this.Secret.TrimEnd('=') } };
might be enough to fix it.

Implementation Guide

Hi @kspearrin, I'm really interested in using this library in my solution however I'm not sure where to start or add the var topt = new Totp(secretKey);
line, should this go in Startup.cs or somewhere else?

Is there a quick start quide or any thing you can share or direct me to please?

[Feature Request] Steam style TOTP

On Linux, pass + pass-otp are able to generate TOTP codes for Steam in the right format cause Pass-OTP-perl implements an simple logic to change what and how many digits are used to generate the code for Steam based on the &issuer= argument being "Steam" in the otpauth URI, like this:

return totp(
    %options,
    digits => 5,
    chars  => "23456789BCDFGHJKMNPQRTVWXY",
) if defined $options{issuer} and $options{issuer} =~ /^Steam/i;

I know that is possible to change how many digits will be used to generate the TOTP code in Otp.NET, however i dont think it is actually possible to choose the "character set" that will be used to generate the TOTP.

So what i am asking for, is support for Steam style TOTP in Otp.NET, so pass-winmenu can deliver correct Steam TOTP codes.

What is timeStepMatched?

Is there any documentation or example that shows what timeStepMatched is, and how it's used?