https://github.com/amdzy/go-otp
Go One-Time Password Library
https://github.com/amdzy/go-otp
2fa go hotp mfa totp
Last synced: 2 months ago
JSON representation
Go One-Time Password Library
- Host: GitHub
- URL: https://github.com/amdzy/go-otp
- Owner: amdzy
- Created: 2024-10-28T10:44:43.000Z (7 months ago)
- Default Branch: main
- Last Pushed: 2024-10-29T12:34:12.000Z (7 months ago)
- Last Synced: 2025-02-09T09:29:16.619Z (4 months ago)
- Topics: 2fa, go, hotp, mfa, totp
- Language: Go
- Homepage:
- Size: 9.77 KB
- Stars: 0
- Watchers: 1
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
README
Gotp
============================================
Gotp is a Python library for generating and verifying one-time passwords. It can be used to implement two-factor (2FA)
or multi-factor (MFA) authentication methods in web applications and in other systems that require users to log in.
Open MFA standards are defined in `RFC 4226 `_ (HOTP: An HMAC-Based One-Time
Password Algorithm) and in `RFC 6238 `_ (TOTP: Time-Based One-Time Password
Algorithm). Gotp implements server-side support for both of these standards. Client-side support can be enabled by
sending authentication codes to users over SMS or email (HOTP) or, for TOTP, by instructing users to use `Google
Authenticator `_, `Authy `_, or another
compatible app. Users can set up auth tokens in their apps easily by using their phone camera to scan `otpauth://
`_ QR codes provided by Gotp.
Implementers should read and follow the `HOTP security requirements `_
and `TOTP security considerations `_ sections of the relevant RFCs. At
minimum, application implementers should follow this checklist:
- Ensure transport confidentiality by using HTTPS
- Ensure HOTP/TOTP secret confidentiality by storing secrets in a controlled access database
- Deny replay attacks by rejecting one-time passwords that have been used by the client (this requires storing the most
recently authenticated timestamp, OTP, or hash of the OTP in your database, and rejecting the OTP when a match is
seen)
- Throttle (rate limit) brute-force attacks against your application's login functionality (see RFC 4226, section 7.3)
We also recommend that implementers read the
`OWASP Authentication Cheat Sheet
`_ and
`NIST SP 800-63-3: Digital Authentication Guideline `_ for a high level overview of
authentication best practices.
[GOTP](https://github.com/amdzy/go-otp) was inspired by PyOTP.
Quick overview of using One Time Passwords on your phone
--------------------------------------------------------
* OTPs involve a shared secret, stored both on the phone and the server
* OTPs can be generated on a phone without internet connectivity
* OTPs should always be used as a second factor of authentication (if your phone is lost, you account is still secured
with a password)
* Google Authenticator and other OTP client apps allow you to store multiple OTP secrets and provision those using a QR
Code