mirror of
https://github.com/RobThree/TwoFactorAuth.git
synced 2026-08-20 20:52:54 +00:00
Compare commits
8 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Rob Janssen
|
52cbcf7579 | ||
|
Rob Janssen
|
1f9008c217 | ||
|
RobThree
|
955e9b0b03 | ||
|
Rob Janssen
|
1d0a9432e6 | ||
|
RobThree
|
3b3e723bea | ||
|
RobThree
|
f1a729c9ed | ||
|
Rob Janssen
|
98d3f2a21b | ||
|
Rob Janssen
|
8976cf138e |
+1
-1
@@ -8,4 +8,4 @@ php:
|
||||
- 7
|
||||
- hhvm
|
||||
|
||||
script: phpunit tests
|
||||
script: phpunit --coverage-text tests
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
#  TwoFactorAuth class for PHP
|
||||
|
||||
[](https://travis-ci.org/RobThree/TwoFactorAuth/) [](https://packagist.org/packages/robthree/twofactorauth) [](LICENSE) [](https://packagist.org/packages/robthree/twofactorauth) [](http://hhvm.h4cc.de/package/robthree/twofactorauth) [](https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=6MB5M2SQLP636 "Keep me off the streets")
|
||||
[](https://travis-ci.org/RobThree/TwoFactorAuth/) [](https://packagist.org/packages/robthree/twofactorauth) [](LICENSE) [](https://packagist.org/packages/robthree/twofactorauth) [](http://hhvm.h4cc.de/package/robthree/twofactorauth) [](https://codeclimate.com/github/RobThree/TwoFactorAuth) [](https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=6MB5M2SQLP636 "Keep me off the streets")
|
||||
|
||||
PHP class for [two-factor (or multi-factor) authentication](http://en.wikipedia.org/wiki/Multi-factor_authentication) using [TOTP](http://en.wikipedia.org/wiki/Time-based_One-time_Password_Algorithm) and [QR-codes](http://en.wikipedia.org/wiki/QR_code). Inspired by, based on but most importantly an *improvement* on '[PHPGangsta/GoogleAuthenticator](https://github.com/PHPGangsta/GoogleAuthenticator)'.
|
||||
|
||||
@@ -16,12 +16,9 @@ PHP class for [two-factor (or multi-factor) authentication](http://en.wikipedia.
|
||||
|
||||
## Installation
|
||||
|
||||
````json
|
||||
"require": {
|
||||
"robthree/twofactorauth": "1.0"
|
||||
}
|
||||
````
|
||||
And run `php composer update`
|
||||
Run the following command:
|
||||
|
||||
`php composer.phar require robthree/twofactorauth`
|
||||
|
||||
## Quick start
|
||||
|
||||
|
||||
+1
-1
@@ -1,7 +1,7 @@
|
||||
{
|
||||
"name": "robthree/twofactorauth",
|
||||
"description": "Two Factor Authentication",
|
||||
"version": "1.0",
|
||||
"version": "1.1",
|
||||
"type": "library",
|
||||
"keywords": [ "Authentication", "Two Factor Authentication", "Multi Factor Authentication", "TFA", "MFA", "PHP", "Authenticator", "Authy" ],
|
||||
"homepage": "https://github.com/RobThree/TwoFactorAuth",
|
||||
|
||||
@@ -6,7 +6,6 @@
|
||||
<body>
|
||||
<ol>
|
||||
<?php
|
||||
error_reporting(-1);
|
||||
require_once 'loader.php';
|
||||
Loader::register('../lib','RobThree\\Auth');
|
||||
|
||||
|
||||
@@ -8,9 +8,9 @@ abstract class BaseHTTPQRCodeProvider implements IQRCodeProvider
|
||||
|
||||
protected function getContent($url)
|
||||
{
|
||||
$ch = curl_init();
|
||||
$curlhandle = curl_init();
|
||||
|
||||
curl_setopt_array($ch, array(
|
||||
curl_setopt_array($curlhandle, array(
|
||||
CURLOPT_URL => $url,
|
||||
CURLOPT_FOLLOWLOCATION => true,
|
||||
CURLOPT_MAXREDIRS => 3,
|
||||
@@ -21,9 +21,9 @@ abstract class BaseHTTPQRCodeProvider implements IQRCodeProvider
|
||||
CURLOPT_SSL_VERIFYPEER => $this->verifyssl,
|
||||
CURLOPT_USERAGENT => 'TwoFactorAuth'
|
||||
));
|
||||
$data = curl_exec($ch);
|
||||
$data = curl_exec($curlhandle);
|
||||
|
||||
curl_close($ch);
|
||||
curl_close($curlhandle);
|
||||
return $data;
|
||||
}
|
||||
}
|
||||
+40
-21
@@ -87,11 +87,11 @@ class TwoFactorAuth
|
||||
{
|
||||
$secretkey = $this->base32Decode($secret);
|
||||
|
||||
$ts = "\0\0\0\0" . pack('N*', $this->getTimeSlice($this->getTime($time))); // Pack time into binary string
|
||||
$hm = hash_hmac($this->algorithm, $ts, $secretkey, true); // Hash it with users secret key
|
||||
$hashpart = substr($hm, ord(substr($hm, -1)) & 0x0F, 4); // Use last nibble of result as index/offset and grab 4 bytes of the result
|
||||
$value = unpack('N', $hashpart); // Unpack binary value
|
||||
$value = $value[1] & 0x7FFFFFFF; // Drop MSB, keep only 31 bits
|
||||
$timestamp = "\0\0\0\0" . pack('N*', $this->getTimeSlice($this->getTime($time))); // Pack time into binary string
|
||||
$hashhmac = hash_hmac($this->algorithm, $timestamp, $secretkey, true); // Hash it with users secret key
|
||||
$hashpart = substr($hashhmac, ord(substr($hashhmac, -1)) & 0x0F, 4); // Use last nibble of result as index/offset and grab 4 bytes of the result
|
||||
$value = unpack('N', $hashpart); // Unpack binary value
|
||||
$value = $value[1] & 0x7FFFFFFF; // Drop MSB, keep only 31 bits
|
||||
|
||||
return str_pad($value % pow(10, $this->digits), $this->digits, '0', STR_PAD_LEFT);
|
||||
}
|
||||
@@ -101,13 +101,32 @@ class TwoFactorAuth
|
||||
*/
|
||||
public function verifyCode($secret, $code, $discrepancy = 1, $time = null)
|
||||
{
|
||||
$t = $this->getTime($time);
|
||||
for ($i = -$discrepancy; $i <= $discrepancy; $i++)
|
||||
{
|
||||
if (strcmp($this->getCode($secret, $t + ($i * $this->period)), $code) === 0)
|
||||
return true;
|
||||
}
|
||||
$result = false;
|
||||
$timetamp = $this->getTime($time);
|
||||
|
||||
// To keep safe from timing-attachs we iterate *all* possible codes even though we already may have verified a code is correct
|
||||
for ($i = -$discrepancy; $i <= $discrepancy; $i++)
|
||||
$result |= $this->codeEquals($this->getCode($secret, $timetamp + ($i * $this->period)), $code);
|
||||
|
||||
return $result;
|
||||
}
|
||||
|
||||
/**
|
||||
* Timing-attack safe comparison of 2 codes (see http://blog.ircmaxell.com/2014/11/its-all-about-time.html)
|
||||
*/
|
||||
private function codeEquals($safe, $user) {
|
||||
if (function_exists('hash_equals')) {
|
||||
return hash_equals($safe, $user);
|
||||
} else {
|
||||
// In general, it's not possible to prevent length leaks. So it's OK to leak the length. The important part is that
|
||||
// we don't leak information about the difference of the two strings.
|
||||
if (strlen($safe)===strlen($user)) {
|
||||
$result = 0;
|
||||
for ($i = 0; $i < strlen($safe); $i++)
|
||||
$result |= (ord($safe[$i]) ^ ord($user[$i]));
|
||||
return $result === 0;
|
||||
}
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
@@ -155,19 +174,19 @@ class TwoFactorAuth
|
||||
if (preg_match('/[^'.preg_quote(self::$_base32dict).']/', $value) !== 0)
|
||||
throw new TwoFactorAuthException('Invalid base32 string');
|
||||
|
||||
$s = '';
|
||||
foreach (str_split($value) as $c)
|
||||
$buffer = '';
|
||||
foreach (str_split($value) as $char)
|
||||
{
|
||||
if ($c !== '=')
|
||||
$s .= str_pad(decbin(self::$_base32lookup[$c]), 5, 0, STR_PAD_LEFT);
|
||||
if ($char !== '=')
|
||||
$buffer .= str_pad(decbin(self::$_base32lookup[$char]), 5, 0, STR_PAD_LEFT);
|
||||
}
|
||||
$l = strlen($s);
|
||||
$r = trim(chunk_split(substr($s, 0, $l - ($l % 8)), 8, ' '));
|
||||
$length = strlen($buffer);
|
||||
$blocks = trim(chunk_split(substr($buffer, 0, $length - ($length % 8)), 8, ' '));
|
||||
|
||||
$o = '';
|
||||
foreach (explode(' ', $r) as $b)
|
||||
$o .= chr(bindec(str_pad($b, 8, 0, STR_PAD_RIGHT)));
|
||||
$output = '';
|
||||
foreach (explode(' ', $blocks) as $block)
|
||||
$output .= chr(bindec(str_pad($block, 8, 0, STR_PAD_RIGHT)));
|
||||
|
||||
return $o;
|
||||
return $output;
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user