NAME
Trog::TOTP - Fork of Authen::TOTP
VERSION
version 1.003
DESCRIPTION
Trog::TOTP is a fork of Authen::TOTP.
While patches were initially merged upstream, no CPAN releases happened, so here we are.
NAME
Trog::TOTP - Interface to RFC6238 two factor authentication (2FA)
USAGE
my $gen = Trog::TOTP->new(
# not needed when setting up TOTP for the first time;
# we generate a secret automatically which you should grab and store.
secret => "some_random_stuff",
# ACHTUNG! lots of TOTP apps on various devices ignore this field
# and hardcode 30s periods. Probably best to never touch this.
period => 30,
# callback used when emitting messages;
# use me for integrating into your own logging framework
logger => sub { my $msg = shift; ... },
);
# Be sure to store this as binary data
my $secret = $gen->secret();
# This is what you will want to show users for input into their TOTP apps when their camera is failing
my $b32secret = $gen->base32secret();
# will generate a TOTP URI, suitable to use in a QR Code
my $uri = $gen->generate_otp(user => 'user\@example.com', issuer => "example.com");
# use Imager::QRCode to plot the secret for the user
use Imager::QRCode;
my $qrcode = Imager::QRCode->new(
size => 4,
margin => 3,
level => 'L',
casesensitive => 1,
lightcolor => Imager::Color->new(255, 255, 255),
darkcolor => Imager::Color->new(0, 0, 0),
);
my $img = $qrcode->plot($uri);
$img->write(file => "totp.png", type => "png");
# compare user's OTP with computed one
if ($gen->validate_otp(otp => <user_input>, secret => <stored_secret>, tolerance => 1)) {
#2FA success
}
else {
#no match
}
# Just print out the dang code
print $gen->expected_totp_code(time);CONSTRUCTOR
new
my $gen = Trog::TOTP->new(
digits => [6|8],
period => [30|60],
algorithm => "SHA1", #SHA256 and SHA512 are equally valid
secret => "some_random_stuff",
when => <some_epoch>,
tolerance => 0,
logger => sub { my $msg=shift; ... },
);Parameters/Properties (defaults listed)
- digits
-
6=> How many digits to produce/compare - period
-
30=> OTP is valid for this many seconds - algorithm
-
SHA1=> supported values are SHA1, SHA256 and SHA512, although most clients only support SHA1 AFAIK - secret
-
random_20byte_string=> Secret used as seed for the OTP - base32secret
-
base32_encoded_random_12byte_string=> Alternative way to set secret (base32 encoded) - when
-
epoch=> Time used for comparison of OTPs - tolerance
-
1=> Due to time sync issues, you may want to tune this and compare this many OTPs before and after - logger
-
Log callback subroutine. Use to integrate various messages from this modules into your logging framework.
- DEBUG
-
Turn on extended log messaging.
METHODS
secret
Return the current secret used by this object.
base32secret
Return the base32encoded secret used by this object.
algorithm([STRING $algo])
Returns, and optionally sets the algorithm if passed.
expected_totp_code( TIME_T $when )
Returns what a code "ought" to be at any given unix timestamp. Useful for integrating into command line tooling to fix things when people have "tecmological differences" with their telephone.
generate_otp
Create a TOTP URI using the parameters specified or the defaults from the new() method above
Usage:
$gen->generate_otp(
digits => [6|8],
period => [30|60],
algorithm => "SHA1", #SHA256 and SHA512 are equally valid
secret => "some_random_stuff",
issuer => "example.com",
user => "some_identifier",
);
Google Authenticator displays <issuer> (<user>) for a TOTP generated like thisvalidate_otp
Compare a user-supplied TOTP using the parameters specified. Obviously the secret MUST be the same secret you used in generate_otp() above/ Returns 1 on success, undef if OTP doesn't match
Usage:
$gen->validate_otp(
digits => [6|8],
period => [30|60],
algorithm => "SHA1", #SHA256 and SHA512 are equally valid
secret => "the_same_random_stuff_you_used_to_generate_the_TOTP",
when => <epoch_to_use_as_reference>,
tolerance => <try this many iterations before/after when>
otp => <OTP to compare to>
);BUGS
Please report any bugs or feature requests on the bugtracker website https://github.com/teodesian/Trog-TOTP/issues
When submitting a bug or request, please include a test-file or a patch to an existing test-file that illustrates the bug or desired feature.
AUTHORS
Current Maintainers:
George S. Baugh <teodesian@gmail.com>
CONTRIBUTOR
Thanos Chatziathanassiou <tchatzi@arx.net>
COPYRIGHT AND LICENSE
Copyright (c) 2023 Troglodyne LLC
The "Artistic License" Preamble The intent of this document is to state the conditions under which a Package may be copied, such that the Copyright Holder maintains some semblance of artistic control over the development of the package, while giving the users of the package the right to use and distribute the Package in a more-or-less customary fashion, plus the right to make reasonable modifications. Definitions: "Package" refers to the collection of files distributed by the Copyright Holder, and derivatives of that collection of files created through textual modification. "Standard Version" refers to such a Package if it has not been modified, or has been modified in accordance with the wishes of the Copyright Holder as specified below. "Copyright Holder" is whoever is named in the copyright or copyrights for the package. "You" is you, if you're thinking about copying or distributing this Package. "Reasonable copying fee" is whatever you can justify on the basis of media cost, duplication charges, time of people involved, and so on. (You will not be required to justify it to the Copyright Holder, but only to the computing community at large as a market that must bear the fee.) "Freely Available" means that no fee is charged for the item itself, though there may be fees involved in handling the item. It also means that recipients of the item may redistribute it under the same conditions they received it. 1. You may make and give away verbatim copies of the source form of the Standard Version of this Package without restriction, provided that you duplicate all of the original copyright notices and associated disclaimers. 2. You may apply bug fixes, portability fixes and other modifications derived from the Public Domain or from the Copyright Holder. A Package modified in such a way shall still be considered the Standard Version. 3. You may otherwise modify your copy of this Package in any way, provided that you insert a prominent notice in each changed file stating how and when you changed that file, and provided that you do at least ONE of the following: a) place your modifications in the Public Domain or otherwise make them Freely Available, such as by posting said modifications to Usenet or an equivalent medium, or placing the modifications on a major archive site such as uunet.uu.net, or by allowing the Copyright Holder to include your modifications in the Standard Version of the Package. b) use the modified Package only within your corporation or organization. c) rename any non-standard executables so the names do not conflict with standard executables, which must also be provided, and provide a separate manual page for each non-standard executable that clearly documents how it differs from the Standard Version. d) make other distribution arrangements with the Copyright Holder. 4. You may distribute the programs of this Package in object code or executable form, provided that you do at least ONE of the following: a) distribute a Standard Version of the executables and library files, together with instructions (in the manual page or equivalent) on where to get the Standard Version. b) accompany the distribution with the machine-readable source of the Package with your modifications. c) give non-standard executables non-standard names, and clearly document the differences in manual pages (or equivalent), together with instructions on where to get the Standard Version. d) make other distribution arrangements with the Copyright Holder. 5. You may charge a reasonable copying fee for any distribution of this Package. You may charge any fee you choose for support of this Package. You may not charge a fee for this Package itself. However, you may distribute this Package in aggregate with other (possibly commercial) programs as part of a larger (possibly commercial) software distribution provided that you do not advertise this Package as a product of your own. You may embed this Package's interpreter within an executable of yours (by linking); this shall be construed as a mere form of aggregation, provided that the complete Standard Version of the interpreter is so embedded. 6. The scripts and library files supplied as input to or produced as output from the programs of this Package do not automatically fall under the copyright of this Package, but belong to whoever generated them, and may be sold commercially, and may be aggregated with this Package. If such scripts or library files are aggregated with this Package via the so-called "undump" or "unexec" methods of producing a binary executable image, then distribution of such an image shall neither be construed as a distribution of this Package nor shall it fall under the restrictions of Paragraphs 3 and 4, provided that you do not represent such an executable image as a Standard Version of this Package. 7. C subroutines (or comparably compiled subroutines in other languages) supplied by you and linked into this Package in order to emulate subroutines and variables of the language defined by this Package shall not be considered part of this Package, but are the equivalent of input as in Paragraph 6, provided these subroutines do not change the language in any way that would cause it to fail the regression tests for the language. 8. Aggregation of this Package with a commercial distribution is always permitted provided that the use of this Package is embedded; that is, when no overt attempt is made to make this Package's interfaces visible to the end user of the commercial distribution. Such use shall not be construed as a distribution of this Package. 9. The name of the Copyright Holder may not be used to endorse or promote products derived from this software without specific prior written permission. 10. THIS PACKAGE IS PROVIDED "AS IS" AND WITHOUT ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE. The End[-Transformer]