#!/usr/bin/env python
 
# Implementation demo of Google Authenticator in Python
# Bill Haofei Gong @ billgong.com
 
# Download Google Authenticator to your mobile:
#  iOS: https://itunes.apple.com/us/app/id388497605?mt=8
#  Android: https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2&hl=en
#  Other mobile please refers to Google Code project: https://code.google.com/p/google-authenticator/
 
# * HOTP(RFC 4226) counter and 16-character secret is stored in file 'oauth.dat'. 
# * TOTP(RFC 6238) need to be synced with time.
# * Secret is case SENSITIVE!
 
# An example of 2-line preference file 'oauth.dat':
#
# MZXW633PN5XW6MZX
# 6
#
# Which will give HOTP token 581333 as it's 6th token of secret 'MZXW633PN5XW6MZX'. TOTP token is dynamic according to time. 
 
# Version History:
#  12 April 2013 Friday: First version
 
# P.S. HOTP integrity check value is... I don't know. I will figure out sometime later...
 
import sys, time, base64, struct, hmac, hashlib
 
# 从配置文件里读取密钥和 counter
try:
    file = open("oauth.dat", "r").readlines()
except (IOError):
    print 'Error: Cant\'t read preference file'
    exit()
 
secret = file[0].rstrip('\n')
 
# HOTP 使用16字符长的密钥，区分大小写
if len(secret) != 16:
    print 'Error: Preference: Illegal secret length!'
    exit()
 
try:
    hotp_counter = int(file[1])
except (ValueError):
    print 'Error: Preference: Illegal counter of HOTP!'
    exit()
 
# 精华在这里
def get_hotp_token(secret, interval):
    basedSecret = base64.b32decode(secret, True)
    structSecret = struct.pack(">Q", interval)
    hmacSecret = hmac.new(basedSecret, structSecret, hashlib.sha1).digest()
    ordSecret = ord(hmacSecret[19]) & 15
    tokenSecret = (struct.unpack(">I", hmacSecret[ordSecret:ordSecret+4])[0] & 0x7fffffff) % 1000000
    return tokenSecret
 
# TOTP 就是使用时间作为 HOTP 的 interval
def get_totp_token(secret):
    return get_hotp_token(secret, int(time.time())//30)
 
# HOTP 每个密码用完后需要在 counter 加 1，并将 counter 写入配置文件
def increase_hotp_counter():
    file[1] = str(hotp_counter + 1)
    try:
        open("oauth.dat", "w").writelines(file)
    except (IOError):
        print 'Error: Cant\'t write preference file'
        exit()
 
def appinfo():
    return "usage: totp.py [TOTP|HOTP] [TOKEN]\n\nSecret used: " + secret + "\n\nUse following URI to generate QRCode or open in Google Authenticator:\notpauth://hotp/Python:HOTP?secret=" + secret + "\notpauth://totp/Python:TOTP?secret=" + secret
 
try:
    tokenType = sys.argv[1]
    tokenInput = int(sys.argv[2])
except (IndexError):
    print 'Error: Console: Insufficient parameters!'
    print appinfo()
    exit()
except (ValueError): 
    print 'Error: Console: Given token is illegal!'
    print appinfo()
    exit()
 
# 当 token 作为 string 输出时，记得 padding 至 6 位数字
if tokenType in ('hotp', 'HOTP'):
    hotp_token = get_hotp_token(secret, hotp_counter)
    if hotp_token == tokenInput:
        print 'HOTP token is correct!\nCurrent token will become invalid.' 
        increase_hotp_counter()
    else:
        print 'HOTP token is invalid!\nToken should be ' + str(hotp_token).zfill(6)
elif tokenType in ('totp', 'TOTP'):
    totp_token = get_totp_token(secret)
    if totp_token == tokenInput:
        print 'TOTP token is correct!'
    else:
        print 'TOTP token is invalid!\nToken should be ' + str(totp_token).zfill(6)
else:
    print 'Error: Console: Illegal token type!'
    print appinfo()

MZXW633PN5XW6MZX
10

$ ./oauth.py 
Error: Console: Insufficient parameters!
usage: totp.py [TOTP|HOTP] [TOKEN]
 
Secret used: MZXW633PN5XW6MZX
 
Use following URI to generate QRCode or open in Google Authenticator:
otpauth://hotp/Python:HOTP?secret=MZXW633PN5XW6MZX
otpauth://totp/Python:TOTP?secret=MZXW633PN5XW6MZX
 
# TOTP with correct token
$ ./oauth.py totp 879472
TOTP token is correct!
 
# TOTP with incorrect token
$ ./oauth.py totp 123123
TOTP token is invalid!
Token should be 879472
 
# HOTP with incorrect token
$ ./oauth.py hotp 123123
HOTP token is invalid!
Token should be 171710
 
# HOTP with correct token
$ ./oauth.py hotp 171710
HOTP token is correct!
Current token will become invalid.
 
# HOTP with used token
$ ./oauth.py hotp 171710
HOTP token is invalid!
Token should be 930616