lfkeitel / phptotp
TOTP/HOTP library for PHP
Installs: 227 127
Dependents: 1
Suggesters: 0
Security: 0
Stars: 73
Watchers: 3
Forks: 12
Open Issues: 1
Requires
- php: ^5.6 || ^7.0 || ^8.0
This package is auto-updated.
Last update: 2024-10-08 02:02:44 UTC
README
This is a simple PHP library and script that will generate HOTP and TOTP tokens. The library fully conforms to RFCs 4226 and 6238. All hashing algorithms are supported as well as the length of a token and the start time for TOTP.
Installation
Add the following to your composer.json:
{
"require": {
"lfkeitel/phptotp": "^1.0"
}
}
And run composer install
.
Usage
<?php use lfkeitel\phptotp\{Base32,Totp}; # Generate a new secret key # Note: GenerateSecret returns a string of random bytes. It must be base32 encoded before displaying to the user. You should store the unencoded string for later use. $secret = Totp::GenerateSecret(16); # Display new key to user so they can enter it in Google Authenticator or Authy echo Base32::encode($secret); # Generate the current TOTP key # Note: GenerateToken takes a base32 decoded string of bytes. $key = (new Totp())->GenerateToken($secret); # Check if user submitted correct key if ($user_submitted_key !== $key) { exit(); }
Documentation
lfkeitel\phptotp\Totp extends Hotp
__construct($algo = 'sha1', $start = 0, $ti = 30): Totp
$algo
: Algorithm to use when generating token$start
: The beginning of time$ti
: Time interval between tokens
GenerateToken($key, $time = null, $length = 6): string
$key
: Secret key as bytes, base32 decoded$time
: Time to use for the token, defaults to now$length
: Length of token
lfkeitel\phptotp\Hotp
__construct($algo = 'sha1'): Hotp
$algo
: Algorithm to use when generating token
GenerateToken($key, $count = 0, $length = 6): string
$key
: Secret key as bytes, base32 decoded$count
: HOTP counter$length
: Length of token
GenerateSecret($length = 16): string
$length
: Length of string in bytesReturn
: This method returns a string of random bytes, use Base32::encode when displaying to the user.
lfkeitel\phptotp\Base32
static encode($data): string
$data
: Data to base32 encode
static decode($data): string
$data
: Data to base32 decode
generate.php
generate.php is a script that acts exactly like Google Authenticator. It takes a secret key, either as an argument or can be entered when prompted on standard input, and generates a token assuming SHA1, Unix timestamp for start, and 30 second time intervals. The secret key should be base32 encoded.
$ ./generate.php Enter secret key: turtles Token: 338914 $
License
This software is released under the MIT license which can be found in LICENSE.