From 896dd1a61bb813fb7affcdb73ec6365dd20ea222 Mon Sep 17 00:00:00 2001 From: "David M. Syzdek" Date: Wed, 11 Jan 2023 22:56:13 -0900 Subject: libotputil: adding otputil_otp_code() --- Makefile.am | 2 + include/otputil.h | 13 +++++ lib/libotputil/libotputil.sym | 1 + lib/libotputil/lrfc2289-otp.c | 127 ++++++++++++++++++++++++++++++++++++++++++ lib/libotputil/lrfc2289-otp.h | 47 ++++++++++++++++ 5 files changed, 190 insertions(+) create mode 100644 lib/libotputil/lrfc2289-otp.c create mode 100644 lib/libotputil/lrfc2289-otp.h diff --git a/Makefile.am b/Makefile.am index b5c7da9..ed10090 100644 --- a/Makefile.am +++ b/Makefile.am @@ -187,6 +187,8 @@ lib_libotputil_a_SOURCES = $(noinst_HEADERS) \ lib/libotputil/lrfc1760-skey.h \ lib/libotputil/lrfc1760-skey-dict.c \ lib/libotputil/lrfc1760-skey-dict.h \ + lib/libotputil/lrfc2289-otp.c \ + lib/libotputil/lrfc2289-otp.h \ lib/libotputil/lrfc2289-otp-dict.c \ lib/libotputil/lrfc2289-otp-dict.h \ lib/libotputil/lrfc4226-hotp.c \ diff --git a/include/otputil.h b/include/otputil.h index 18ac0df..cb690d4 100644 --- a/include/otputil.h +++ b/include/otputil.h @@ -168,6 +168,11 @@ #define OTPUTIL_MAX_DECODE_SIZE 128 #define OTPUTIL_MAX_WORD_SIZE 8 +#define OTPUTIL_OTP_PASS_MIN_LEN 10 +#define OTPUTIL_OTP_PASS_MAX_LEN 127 +#define OTPUTIL_OTP_SEED_MIN_LEN 1 +#define OTPUTIL_OTP_SEED_MAX_LEN 16 + ///////////////// // // @@ -343,6 +348,14 @@ otputil_hotp_str( //---------------// #pragma mark OTP functions (RFC 2289) +_OTPUTIL_F uint64_t +otputil_otp_code( + const char * otp_pass, + const char * otp_seed, + int otp_seq, + int otp_hash ); + + _OTPUTIL_F otputil_bv_t * otputil_otp_decode( const char * src, diff --git a/lib/libotputil/libotputil.sym b/lib/libotputil/libotputil.sym index 647def9..cd4b5a6 100644 --- a/lib/libotputil/libotputil.sym +++ b/lib/libotputil/libotputil.sym @@ -85,6 +85,7 @@ otputil_hotp_code otputil_hotp_str # # OTP functions (RFC 2289) +otputil_otp_code otputil_otp_decode otputil_otp_decode_len otputil_otp_encode diff --git a/lib/libotputil/lrfc2289-otp.c b/lib/libotputil/lrfc2289-otp.c new file mode 100644 index 0000000..e037f83 --- /dev/null +++ b/lib/libotputil/lrfc2289-otp.c @@ -0,0 +1,127 @@ +/* + * OTP Utilities + * Copyright (C) 2022 David M. Syzdek . + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are + * met: + * + * * Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * * Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * * Neither the name of David M. Syzdek nor the + * names of its contributors may be used to endorse or promote products + * derived from this software without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS + * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, + * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR + * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL DAVID M SYZDEK BE LIABLE FOR + * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR + * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER + * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + */ +/* + * @file lib/libotputil/lrfc2289-otp.c + */ +#define _LIB_LIBOTPUTIL_LRFC2289_OTP_H 1 +#include "lrfc2289-otp.h" + +/////////////// +// // +// Headers // +// // +/////////////// +#pragma mark - Headers + +#include +#include +#include +#include +#include +#include +#include +#include + +#include "lmisc.h" + + +////////////////// +// // +// Prototypes // +// // +////////////////// +#pragma mark - Prototypes + + +///////////////// +// // +// Functions // +// // +///////////////// +#pragma mark - Functions + +uint64_t +otputil_otp_code( + const char * otp_pass, + const char * otp_seed, + int otp_seq, + int otp_hash ) +{ + char secret[OTPUTIL_OTP_PASS_MAX_LEN+OTPUTIL_OTP_SEED_MAX_LEN+1]; + size_t len; + const EVP_MD * evp_md; + unsigned char md[EVP_MAX_MD_SIZE]; + unsigned md_len; + unsigned secret_len; + unsigned u; + int pos; + + assert(otp_pass != NULL); + assert(otp_seed != NULL); + + // check input parameters + if (otp_seq == 0) + return(0); + if ((len = strlen(otp_pass)) > OTPUTIL_OTP_PASS_MAX_LEN) + return(0); + if (len < OTPUTIL_OTP_PASS_MIN_LEN) + return(0); + if ((len = strlen(otp_seed)) > OTPUTIL_OTP_SEED_MAX_LEN) + return(0); + if (len < OTPUTIL_OTP_SEED_MIN_LEN) + return(0); + if ((evp_md = otputil_evp_md(otp_hash)) == NULL) + return(0); + + // generate secret + strncpy(secret, otp_pass, sizeof(secret)); + strncat(secret, otp_seed, sizeof(secret)-1); + secret_len = (unsigned)strlen(secret); + + // generate hashes + for(pos = 0; (pos < otp_seq); pos++) + { + md_len = sizeof(md); + if (!(EVP_Digest(secret, secret_len, md, &md_len, evp_md, NULL))) + return(0); + for(u = 8; (u < md_len); u += 8) + md[u%8] ^= md[u]; + memcpy(secret, md, 8); + secret_len = 8; + }; + + return( ((uint64_t)md[0] << 56) | ((uint64_t)md[1] << 48) + | ((uint64_t)md[2] << 40) | ((uint64_t)md[3] << 32) + | ((uint64_t)md[4] << 24) | ((uint64_t)md[5] << 16) + | ((uint64_t)md[6] << 8) | ((uint64_t)md[7] << 0) ); +} + + +/* end of source file */ diff --git a/lib/libotputil/lrfc2289-otp.h b/lib/libotputil/lrfc2289-otp.h new file mode 100644 index 0000000..7f8124a --- /dev/null +++ b/lib/libotputil/lrfc2289-otp.h @@ -0,0 +1,47 @@ +/* + * OTP Utilities + * Copyright (C) 2022 David M. Syzdek . + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are + * met: + * + * * Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * * Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * * Neither the name of David M. Syzdek nor the + * names of its contributors may be used to endorse or promote products + * derived from this software without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS + * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, + * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR + * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL DAVID M SYZDEK BE LIABLE FOR + * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR + * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER + * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + */ +/* + * @file lib/libotputil/lrfc2289-otp.h + */ +#ifndef _LIB_LIBOTPUTIL_LRFC2289_OTP_H +#define _LIB_LIBOTPUTIL_LRFC2289_OTP_H 1 + + +/////////////// +// // +// Headers // +// // +/////////////// +#pragma mark - Headers + +#include "libotputil.h" + + +#endif /* end of header file */ -- cgit v1.2.3