hotp | Go implementation of RFC 4226 OATH-HOTP authentication | Authentication library

by gokyle Go Version: Current License: ISC

X-Ray Key Features Code Snippets Community Discussions(10)Vulnerabilities Install Support

kandi X-RAY | hotp Summary

hotp is a Go library typically used in Security, Authentication applications. hotp has no bugs, it has no vulnerabilities, it has a Permissive License and it has low support. You can download it from GitHub.

This package implements the RFC 4226 OATH-HOTP algorithm; these passwords derived from the HMAC-SHA1 of an internal counter. They are presented as (typically) 6 or 8-digit numeric passphrases. This package was designed to be interoperable with the Google Authenticator app and YubiKeys programmed in OATH-HOTP mode. Also provided is the hotpgen command-line program. This generates a QR code suitable for use with the Google Authenticator application alongside a text file containing the URL for the QR code. For more information, see the README in the file. See also the godocs for this package. The hotpweb package provides a simple webapp demonstrating the use of the Google Authenticator interaction.

Support

Quality

Security

License

Reuse

Support

hotp has a low active ecosystem.

It has 126 star(s) with 15 fork(s). There are 6 watchers for this library.

It had no major release in the last 6 months.

hotp has no issues reported. There are no pull requests.

It has a neutral sentiment in the developer community.

The latest version of hotp is current.

Quality

hotp has 0 bugs and 0 code smells.

Security

hotp has no vulnerabilities reported, and its dependent libraries have no vulnerabilities reported.

hotp code analysis shows 0 unresolved vulnerabilities.

There are 0 security hotspots that need review.

License

hotp is licensed under the ISC License. This license is Permissive.

Permissive licenses have the least restrictions, and you can use them in most projects.

Reuse

hotp releases are not available. You will need to build from source code and install.

Installation instructions are not available. Examples and code snippets are available.

Top functions reviewed by kandi - BETA

kandi's functional review helps you automatically verify the functionalities of the libraries and avoid rework.
Currently covering the most popular Java, JavaScript and Python libraries. See a Sample of hotp

Get all kandi verified functions for this library.

hotp Key Features

No Key Features are available at this moment for hotp.

hotp Examples and Code Snippets

No Code Snippets are available at this moment for hotp.

Community Discussions

Trending Discussions on hotp

Issue installing cryptography on Raspberry Pi 2B (armv7h Arch Linux ARM) (python 3.9.8)

Can't install python cryptography on Cygwin

State and Scroll position restore Flutter

Can't install keyrings.google-artifactregistry-auth, requires Rust?

openconnect with gp does not prompt for SAML authentication in command line

What are the dependencies for django-allauth python:3.8.3-alpine Dockerfile

How to fix libssl.lib not found error on Windows 10?

TypeScript doesn't seem to check types on a class instance property

HOTP - counter value security

CentOS 7 configured for 2FA SSH access via pam_oath - allows any string 6 characters or less for one-time password

QUESTION

Issue installing cryptography on Raspberry Pi 2B (armv7h Arch Linux ARM) (python 3.9.8)

Asked 2022-Feb-05 at 19:41

I'm having some trouble installing the python cryptography package on my raspberry pi, specifically with python version 3.9.8 (installed with pyenv). The cryptography package is installed on my system using pacman (python-cryptography package), and thus works using the main python interpreter (3.10.1). However, I need some version of python 3.9 specifically for another package I am using in this project. Any time I try to install cryptography through the python 3.9.8 environment, I get the following error:

...

ANSWER

Answered 2022-Jan-14 at 19:59

@jakub's solution ended up solving the problem for me. I uninstalled the version of rust that was installed through pacman. To replace it, I installed rustup and then using rustup, installed the latest nightly version of rust (1.60). Once I did that, installing the cryptography package worked just fine.

If you are using rustup, just make sure that you add ~/.cargo/bin to your PATH before installation. Also, the command I used to install rust through rustup was rustup toolchain install nightly.

Source https://stackoverflow.com/questions/70690519

QUESTION

Can't install python cryptography on Cygwin

Asked 2021-Dec-22 at 23:06

I have installed python38-cryptogrpahy package v.3.3.2-1 thru cygwin but when I try to install fabric via pip - it tries to build it and fails with next error:

...

ANSWER

Answered 2021-Dec-19 at 11:47

Try to upgrade pip: python -m pip install --upgrade pip

Source https://stackoverflow.com/questions/70411027

QUESTION

State and Scroll position restore Flutter

Asked 2021-Aug-01 at 09:29

I have an app which fetches posts from a site using a API and then displays it. There are three navigation options, which are basically filters.

The problem is, whenever I switch to another navigation tab (I'm using bottom navigation bar), it ends up rebuilding the whole page, meaning it will fetch all that data again and it might potentially contain new data.

What I want to do is to keep restore this data in a way that is fast and my initState() doesn't get called(because that is what fetches the data). I did try using all the different kind of keys but I cant get it to work.

Main page:

...

ANSWER

Answered 2021-Aug-01 at 09:29

So I kept searching and eventually a post on Medium led me to the IndexedStack Widget.

Its a widget that is made from the Stack widget and basically loads and stores the state of all its childrens. Unlike Stack, it shows its children one at a time and thus is perfect to use with BottomNavigationBar.

Here's the Blog post for anyone looking out.

Source https://stackoverflow.com/questions/68607970

QUESTION

Can't install keyrings.google-artifactregistry-auth, requires Rust?

Asked 2021-May-24 at 18:59

I tried to install the https://pypi.org/project/keyrings.google-artifactregistry-auth/ package, but installation failed because it claims that Rust is required to install:

This package requires Rust >=1.41.0.

How can I install this? Do I need to install Rust?

Full output is here:

...

ANSWER

Answered 2021-May-24 at 18:59

The issue is that your pip version is too old to install one of this project's subdependencies, cryptography, which is using newer features.

Upgrading pip with the following will make it possible to install this package:

Source https://stackoverflow.com/questions/67677569

QUESTION

openconnect with gp does not prompt for SAML authentication in command line

Asked 2021-May-09 at 01:15

I am using openconnect --protocol=gp vpn.mysite.com and it says its connecting, but it is waiting for the SAML authentication. The command and authentication works on my debian machine it prompts for a username and password, but trying on my other linux machine it does not seem to want to prompt for authentication. This is the output:

...

ANSWER

Answered 2021-May-09 at 01:15

solved by adding --usergroup=gateway to the command

so the total command that works is

Source https://stackoverflow.com/questions/67450353

QUESTION

What are the dependencies for django-allauth python:3.8.3-alpine Dockerfile

Asked 2021-Apr-20 at 16:11

I have a Dockerfile, docker-compose.yml, requirements.txt defined below for a django project. The Dockerfile uses python:3.8.3-alpine and the docker-compose.yml have a db service that uses postgres:12.0-alpine image. I made sure that the dependencies are defined in the Dockerfile as required. However, it seems to me that django-allauth require extra dependencies. I have tried for days to fix this issue but get an error that says
This package requires Rust >=1.41.0. ERROR: Failed building wheel for cryptography. I haved pasted the whole error for reference sake. Any help will be much appreciated. Thanks in advance.

...

ANSWER

Answered 2021-Apr-02 at 11:31

django-allauth requires cryptography which now requires Rust to compile. You could try updating your Dockerfile with the newer python release, i.e. FROM python:3.8.8-alpine, which might let it fetch the prebuilt binary for cryptography.

If that doesn't work you need to add the Rust dependencies so it can compile the package.

Source https://stackoverflow.com/questions/66917975

QUESTION

How to fix libssl.lib not found error on Windows 10?

Asked 2020-Dec-04 at 17:05

I'm trying to install a python package which is not publicly available. However, the problem here is not with the package but with ms build tools not finding libssl.lib. Here's the error I get while it tries to install cryptography. Please note that I had cryptography installed using pip separately, but the package still tries to build and install it.

...

ANSWER

Answered 2020-Dec-04 at 17:05

It seems like the libpath MS build tools is using doesn't have OpenSSL lib path, so it can't find libssl.lib. One possible solution would be to copy .lib files from openssl directory you showed in the environment variables to Python lib c:\users\admin\appdata\local\programs\python\python38-32\libs. It should work.

Source https://stackoverflow.com/questions/65147001

QUESTION

TypeScript doesn't seem to check types on a class instance property

Asked 2020-May-18 at 17:57

I have a Provider class, and I create an instance of it with some functions, but when I try to access any of those functions, TypeScript doesn't check the parameters of those functions, I believe I may have done something wrong, or some change could be made so TypeScript does check the types.

My Provider class:

...

ANSWER

Answered 2020-May-18 at 17:57

You need a generic class:

Source https://stackoverflow.com/questions/61875572

QUESTION

HOTP - counter value security

Asked 2020-Apr-18 at 10:35

i have two question about the "(H)OTP algorithm" regarding a security issue.

We all know how "TOTP" works, we scan a qr code and every 30 seconds a new 6-8 digits code gets displayed, almost no magic.

Now back to "HOTP", in addition to the payload from "TOTP" we also get a "counter" value.

Is it safe to display the counter value on the client side? Or does it cause any security issues?

And a general question: Is the "secret" value always 16 digits? (I am asking because i saw mfa-applications accepting less than 16 digits)

Thanks!

...

ANSWER

Answered 2020-Apr-18 at 10:35

Question the First: Is it safe to display the counter value on the client side?

The "counter" is not a secret. While the "secret-key" remains secret, knowing the the current or a recent "counter" value is of no use to an adversary. If the "secret-key" is compromised, then you are in trouble. RFC4226 says a lot about keeping the "secret-key" secret, and nothing at all about keeping the "counter" secret. (And with TOTP, clearly it isn't !)

If an adversary does learn the "secret key" and the "counter", they are in. If they have to guess, and the 8-byte "counter" is randomly seeded, then this starts to look like a brute-force attack. Section 7.1 of the RFC, gives requirements for the authentication protocol P, including:

RP2 - P SHOULD NOT be vulnerable to brute force attacks. This implies that a throttling/lockout scheme is RECOMMENDED on the validation server side.

so there is some additional security in keeping the "counter" securely, but neither the client nor the server is required to do so. And even if the client does, the server might not. And that's not part of the formal security analysis.

The "E.4. A Counter-Based Resynchronization Method" (of the RFC) requires the client to send their "counter", and we have:

RP3 - P SHOULD be implemented over a secure channel in order to protect users’ privacy and avoid replay attacks.

...no mention of securely sending the "counter", except as a side effect.

So, the short answer to your first question is "yes", "yes it is safe to display the counter value on the client side" -- where by "safe" we mean "safe while the secret-key remains secret".

Question the Second: Is the "secret" value always 16 digits?

I'm guessing that this refers to the "secret-key", also known as "shared secret" -- so by digits you mean bytes ?

The RFC section 4, "Algorithm Requirements", includes:

R6 - The algorithm MUST use a strong shared secret. The length of the shared secret MUST be at least 128 bits. This document RECOMMENDs a shared secret length of 160 bits.

So a "secret" of less than 16 bytes is not conformant.

Source https://stackoverflow.com/questions/61282085

QUESTION

CentOS 7 configured for 2FA SSH access via pam_oath - allows any string 6 characters or less for one-time password

Asked 2020-Apr-17 at 10:45

So I've been reading up on configuring a CentOS 7 machine for 2 factor authentication for SSH, using pam_oath and the FreeOTP phone app, plus local usernames/password for the two factors. I've read various online articles, and all seem to follow the basic instructions listed in the following articles:

https://wiki.archlinux.org/index.php/Pam_oath

https://jonarcher.info/2015/07/hardening-ssh-with-otp-for-2-factor-authentication/

https://www.brianlane.com/post/setup-oath-ssh-login-on-fedora/

Before I do this on my main CentOS machine, I spun up a VirtualBox VM for testing, and did a minimum CentOS 7 install. I followed the instructions, and I get prompted for "One-time password (OATH)" credentials, but I noticed that I can input any alphanumeric string that's 6 characters or less for the OATH password, and it will then prompt me for my local username/password. And as long as I enter the local password correctly, I'm granted shell access.

Here are the steps I followed after the initial minimal CentOS 7 install (CentOS Linux release 7.7.1908 (Core)):

Install packages

...

ANSWER

Answered 2020-Apr-15 at 09:54

Change pam module control from sufficient to [success=done new_authtok_reqd=done default=die]

My pam line looks like:

Source https://stackoverflow.com/questions/60806454

Community Discussions, Code Snippets contain sources that include Stack Exchange Network

Vulnerabilities

No vulnerabilities reported

Install hotp

You can download it from GitHub.

Support

For any new features, suggestions and bugs create an issue on GitHub. If you have any questions check and ask questions on community page Stack Overflow .

Find more information at: