otp

#!/usr/bin/env bash
#
# One Time Password generation with bash
# (c) Bruno Reis <bfreis@gmail.com>
#
# License: MIT

function d() {
  local msg= data=
  if [ "$#" = "1" ]; then
    msg="d"
    data="$1"
  else
    msg="$1"
    data="$2"
  fi
  printf "%-10s[\e[32m%s\e[0m]\n" "$msg" "$data" >&2
}

# parse_datetime <datetime>
# - datetime: unix epoch or iso-8601 formatted string
function parse_datetime() {
  local dt_str="$1"
  local dt

  # try to parse epoch
  dt=$(date +%s --date="@$dt_str" 2>/dev/null)
  if [[ $? == 0 ]]; then
    printf "$dt"
    return 0
  fi

  # try to parse iso
  dt=$(date +%s --date="$dt_str" 2>/dev/null)
  if [[ $? == 0 ]]; then
    printf "$dt"
    return 0
  fi

  return 1
}


# parse_secret <secret>
# - secret: base32 encoded;
#           may contain spaces;
#           may use lowercase letters
function parse_secret() {
  local secret="$@"
  echo -n "${secret}" \
    | tr a-z A-Z \
    | sed -e 's/ //g' \
    | base32 -d \
    | hexdump -ve '/1 "%02X"'
  }

# hmac <key> <msg> [alg]
# - key: hex encoded key
# - msg: must be hex encoded 
#        -> on bash, it's not possible to save
#           strings that have \0 on variables,
#           but it passes them through pipes;
#           so, in order to pass to openssl a
#           msg that has the \0 character, the
#           conversion must be done here
# - alg: defaults to sha1
function hmac() {
  local key="$1"
  local msg="$2"
  local alg="${3:-sha1}"

  # initial sed transforms the hex encoded message into a series of \x??\x??...
  # the outer printf transforms that in the actual byte sequence
  # final sed removes '(stdin)= ' from the output
  printf "$(printf "$msg" | sed -e 's/\(..\)/\\x\1/g')" \
    | openssl dgst \
    -${alg} \
    -mac HMAC \
    -macopt "hexkey:$key" \
    | sed -e 's/^.* //'
  }

# dynamic_truncate <hex_str> <digits>
# truncates the hex string as per RFC4225, DynamicTruncate
function dynamic_truncate() {
  local hex_str="$1"
  local digits="$2"

  local offset=$((2 * 0x${hex_str: -1}))
  echo $(( ( (0x${hex_str:$offset:8}) & 0x7FFFFFFF) % (10**$digits) ))
}

# hotp <key> <counter> [digits:6] [alg:sha1]
# - key: hex encoded key
# - counter: number
function hotp() {
  local key=$1
  local counter=$2
  local digits=${3:-6}
  local alg=${4:-sha1}

  local cnt_hex_string=$(printf "%016X" "$counter")
  local digest=$(hmac "$key" "$cnt_hex_string" "$alg")
  local number=$(dynamic_truncate "$digest" "$digits")
  printf "%0${digits}d" "$number"
}

# totp <key> [datetime:now] [period:30] [digits:6] [alg:sha1]
# - key: hex encoded key
# - datetime: unix epoch (seconds)
function totp() {
  local key=$1
  local datetime="$2"
  local period=${3:-30}
  local digits=${4:-6}
  local alg=${5:-sha1}

  if [[ "$datetime" == "" ]]; then
    datetime=$(date +%s)
  fi

  local counter=$(($datetime / $period))

  hotp "$key" "$counter" "$digits" "$alg"
}

# epoch_now
function epoch_now() {
  date +%s
}

function run_test_hotp() {
  local secret=$(printf '12345678901234567890' | base32)
  local -a test_cases
  test_cases=(0:755224 1:287082 2:359152 3:969429 4:338314 5:254676 6:287922 7:162583 8:399871 9:520489)

  local cnt expected actual
  local key=$(parse_secret "$secret")

  local errors=0

  for test_case in ${test_cases[@]}; do
    cnt=$(echo $test_case      | cut -d \: -f 1)
    expected=$(echo $test_case | cut -d \: -f 2)

    actual=$(hotp "$key" "$cnt")

    if [[ "$expected" == "$actual" ]]; then
      printf '[\e[1;32mPASS\e[0m]'
    else
      printf '[\e[1;31mFAIL\e[0m]'
      ((errors++))
    fi

    printf ' hotp(%s, %s) = \e[1m%s\e[0m == \e[1m%s\e[0m\n' "$key" "$cnt" "$actual" "$expected"
  done

  return $errors
}


function run_test_totp() {
  local secret_1=$(printf '12345678901234567890' | base32)
  local secret_256=$(printf '12345678901234567890123456789012' | base32)
  local secret_512=$(printf '1234567890123456789012345678901234567890123456789012345678901234' | base32)
  local -a test_cases
  test_cases=(
  "1970-01-01T00:00:59Z;sha1;94287082"
  "1970-01-01T00:00:59Z;sha256;46119246"
  "1970-01-01T00:00:59Z;sha512;90693936"
  "2005-03-18T01:58:29Z;sha1;07081804"
  "2005-03-18T01:58:29Z;sha256;68084774"
  "2005-03-18T01:58:29Z;sha512;25091201"
  "2005-03-18T01:58:31Z;sha1;14050471"
  "2005-03-18T01:58:31Z;sha256;67062674"
  "2005-03-18T01:58:31Z;sha512;99943326"
  "2009-02-13T23:31:30Z;sha1;89005924"
  "2009-02-13T23:31:30Z;sha256;91819424"
  "2009-02-13T23:31:30Z;sha512;93441116"
  "2033-05-18T03:33:20Z;sha1;69279037"
  "2033-05-18T03:33:20Z;sha256;90698825"
  "2033-05-18T03:33:20Z;sha512;38618901"
  "2603-10-11T11:33:20Z;sha1;65353130"
  "2603-10-11T11:33:20Z;sha256;77737706"
  "2603-10-11T11:33:20Z;sha512;47863826"
  )

  local key dt dt_str expected actual
  local key_1=$(parse_secret "$secret_1")
  local key_256=$(parse_secret "$secret_256")
  local key_512=$(parse_secret "$secret_512")
  local errors=0

  for test_case in ${test_cases[@]}; do
    dt_str=$(echo $test_case   | cut -d \; -f 1)
    alg=$(echo $test_case      | cut -d \; -f 2)
    expected=$(echo $test_case | cut -d \; -f 3)

    dt=$(date --date="$dt_str" +%s)
    case "$alg" in
      sha1) key=$key_1 ;;
      sha256) key=$key_256 ;;
      sha512) key=$key_512 ;;
    esac
    actual=$(totp "$key" "$dt" "30" "8" "$alg")

    if [[ "$expected" == "$actual" ]]; then
      printf '[\e[1;32mPASS\e[0m]'
    else
      printf '[\e[1;31mFAIL\e[0m]'
      ((errors++))
    fi
    printf ' totp(%s, %s) = \e[1m%s\e[0m == \e[1m%s\e[0m\n' "$key" "$dt" "$actual" "$expected"
  done

  return $errors
}


function run_all_tests() {
  failed_tests=0

  run_test_hotp
  failed_tests=$(($failed_tests + $?))
  run_test_totp
  failed_tests=$(($failed_tests + $?))

  if [[ $failed_tests == 0 ]]; then
    printf '\n\e[1;32mAll tests successful!\e[0m\n\n'
  else
    printf '\n\e[1;31mFailed tests: %d.\nPlease open an issue at: https://github.com/bfreis/otp\e[0m\n\n' "$failed_tests"
  fi

  exit $failed_tests
}

function usage() {
  printf "One Time Password generation with Bash\n\n"
  printf "Usage: ${0##*/} [options]\n"
  printf "\n"
  printf "General options:\n"
  printf "  -h, --help                    displays this help screen\n"
  printf "  -t, --time DATETIME           generate a code for the specified instance\n"
  printf "                                  default: the current timestamp\n"
  printf "      --run-tests               runs all the htop and totp specs tests\n"
  printf "\n"
  printf "OTP options:\n"
  printf "  -s, --secret SECRET           (required) secret key\n"
  printf "                                  constraints: the key must be base32 encoded, can contain\n"
  printf "                                  upper- and lower-case letters, numbers, spaces, and\n"
  printf "                                  base32 padding with '=' if necessary\n"
  printf "  -m, --mode MODE               selects operating mode\n"
  printf "                                  possible options: totp, hotp\n"
  printf "                                  default: totp\n"
  printf "  -a, --alg ALG                 selects hashing algorithm\n"
  printf "                                  possible options: sha1, sha256, sha512\n"
  printf "                                  default: sha1\n"
  printf "  -d, --digits DIGITS           selects the number of digits on displayed otp value\n"
  printf "                                  default: 6\n"
  printf "  -p, --period PERIOD           defines the period for TOTP mode\n"
  printf "                                  default: 30\n"
  printf "  -c, --counter COUNTER         counter for HOTP, required if HOTP\n"
  printf "  -u, --uri URI                 OTP uri spec, see below\n"
  printf "\n"
  printf "\n"
  printf "If --uri is specified, no other otp settigns are allowed. If both\n"
  printf "the URI and other otp settings are specified, the behavior is undefined\n"
  printf "and the application might generate invalid codes or crash.\n"
  printf "\n"
  printf "If the --time option is specificed, the format should be a Unix Epoch (seconds) or\n"
  printf "alternatively an ISO-8601 formatted timstamp. Examples:\n"
  printf "  --time 1136239445\n" # what's the significance of this instant?
  printf "  --time \"2006-01-02T15:04:05-07:00\"\n"
  printf "\n"
  printf "If no options are specified, an input URI is read from STDIN.\n"
  printf "\n"
  printf "(c) 2018 Bruno Reis <bfreis@gmail.com>\n"
  printf "Please submit bugs to: https://github.com/bfreis/otp\n"
  exit ${1:-0}
}

function process_stdin() {
  printf "ERROR: stdin processing not yet implemented\n"
  exit 1
}


function help_quit() {
  printf "%s\ntry ${0##*/} --help\n" "$1"
  exit 1
}

function main() {
  local uri secret counter dt_str

  local datetime
  local mode=totp
  local alg=sha1
  local digits=6
  local period=30

  local has_param has_uri

  # if no args, then input is on stdin
  if [[ $# -eq 0 ]]; then
    process_stdin
    exit 0
  fi

  # otherwise, parse args
  while [[ $# -gt 0 ]]; do
    case "$1" in
      -u|--uri)
        uri=$2
        shift 2
        has_uri=1
        ;;
      -s|--secret)
        secret=$2
        shift 2
        has_param=1
        ;;
      -m|--mode)
        mode=$2
        shift 2
        has_param=1
        ;;
      -a|--alg)
        alg=$2
        shift 2
        has_param=1
        ;;
      -d|--digits)
        digits=$2
        shift 2
        has_param=1
        ;;
      -p|--period)
        period=$2
        shift 2
        has_param=1
        ;;
      -t|--time)
        dt_str=$2
        shift 2
        ;;
      -c|--counter)
        counter=$2
        shift 2
        has_param=1
        ;;
      --run-tests)
        run_all_tests
        ;;
      -h|--help)
        usage
        ;;
      *)
        help_quit "unrecognized option: $1"
        ;;
    esac
  done

  # can't specify both URI and any other OTP config parameter
  if [[ $has_param == 1 && $has_uri == 1 ]]; then
    help_quit "cannot specify URI and any other OTP settings"
  fi

  if [[ $dt_str == "" ]]; then
    datetime=$(date +%s)
  else
    datetime=$(parse_datetime "$dt_str")
    if [[ $? != 0 ]]; then
      help_quit "invalid datetime specification: $dt_str"
    fi
  fi
  #printf "parsed: %s\n" "$datetime"

  if [[ "$uri" != "" ]]; then
    # parse uri, generate otp
    printf "ERROR: URI processing not yet implemented\n"
    exit 1
  else
    # use params to generate otp
    local key code
    key=$(parse_secret "$secret")

    case "$mode" in
      hotp)
        code=$(hotp "$key" "$counter" "$digits" "$alg")
        ;;
      totp)
        code=$(totp "$key" "$datetime" "$period" "$digits" "$alg")
        ;;
      *)
        help_quit "unknown mode: $mode"
        ;;
    esac

    printf "%s\n" "$code"
    exit 0
  fi

  help_quit "unknown error"
}

main "$@"

# vim: ft=sh