clarifies doc for `secret`: should be non-encoded
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127
diff --git a/src/lib.rs b/src/lib.rs
index be92b46..7927289 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -1,7 +1,7 @@
//! This library permits the creation of 2FA authentification tokens per TOTP, the verification of said tokens, with configurable time skew, validity time of each token, algorithm and number of digits! Default features are kept as low-dependency as possible to ensure small binaries and short compilation time
//!
-//! Be aware that some authenticator apps will accept the `SHA256`
-//! and `SHA512` algorithms but silently fallback to `SHA1` which will
+//! Be aware that some authenticator apps will accept the `SHA256`
+//! and `SHA512` algorithms but silently fallback to `SHA1` which will
//! make the `check()` function fail due to mismatched algorithms.
//!
//! Use the `SHA1` algorithm to avoid this problem.
@@ -45,6 +45,8 @@
//! # }
//! ```
+pub use base32;
+
use constant_time_eq::constant_time_eq;
#[cfg(feature = "serde_support")]
@@ -144,6 +146,8 @@ pub struct TOTP<T = Vec<u8>> {
/// Duration in seconds of a step. The recommended value per [rfc-6238](https://tools.ietf.org/html/rfc6238#section-5.2) is 30 seconds
pub step: u64,
/// As per [rfc-4226](https://tools.ietf.org/html/rfc4226#section-4) the secret should come from a strong source, most likely a CSPRNG. It should be at least 128 bits, but 160 are recommended
+ ///
+ /// non-encoded value
pub secret: T,
/// The "Github" part of "Github:constantoine@github.com". Must not contain a colon `:`
/// For example, the name of your service/website.
@@ -177,8 +181,17 @@ impl <T: AsRef<[u8]>> PartialEq for TOTP<T> {
impl<T: AsRef<[u8]>> TOTP<T> {
/// Will create a new instance of TOTP with given parameters. See [the doc](struct.TOTP.html#fields) for reference as to how to choose those values
///
+ /// # Description
+ /// * `secret`: expect a non-encoded value, base32 encoded values should be decoded beforehand
+ /// ```
+ /// use totp_rs::{base32, TOTP, Algorithm};
+ /// let secret = String::from("NV4S243FMNZGK5A");
+ /// let decoded = base32::decode(base32::Alphabet::RFC4648 { padding: false }, &secret).unwrap();
+ /// let totp = TOTP::new(Algorithm::SHA1, 6, 1, 30, decoded, None, "".to_string()).unwrap();
+ /// ```
+ ///
/// # Errors
- ///
+ ///
/// Will return an error in case issuer or label contain the character ':'
pub fn new(algorithm: Algorithm, digits: usize, skew: u8, step: u64, secret: T, issuer: Option<String>, account_name: String) -> Result<TOTP<T>, TotpUrlError> {
if issuer.is_some() && issuer.as_ref().unwrap().contains(':') {
@@ -244,7 +257,7 @@ impl<T: AsRef<[u8]>> TOTP<T> {
let basestep = time / self.step - (self.skew as u64);
for i in 0..self.skew * 2 + 1 {
let step_time = (basestep + (i as u64)) * (self.step as u64);
-
+
if constant_time_eq(self.generate(step_time).as_bytes(), token.as_bytes()) {
return true;
}
@@ -265,7 +278,7 @@ impl<T: AsRef<[u8]>> TOTP<T> {
self.secret.as_ref(),
)
}
-
+
/// Generate a TOTP from the standard otpauth URL
#[cfg(feature = "otpauth")]
pub fn from_url<S: AsRef<str>>(url: S) -> Result<TOTP<Vec<u8>>, TotpUrlError> {
@@ -276,7 +289,7 @@ impl<T: AsRef<[u8]>> TOTP<T> {
if url.host() != Some(Host::Domain("totp")) {
return Err(TotpUrlError::Host);
}
-
+
let mut algorithm = Algorithm::SHA1;
let mut digits = 6;
let mut step = 30;
@@ -292,7 +305,7 @@ impl<T: AsRef<[u8]>> TOTP<T> {
} else {
account_name = path.to_owned();
}
-
+
account_name = urlencoding::decode(account_name.as_str()).map_err(|_| TotpUrlError::AccountName)?.to_string();
for (key, value) in url.query_pairs() {
@@ -341,7 +354,7 @@ impl<T: AsRef<[u8]>> TOTP<T> {
}
/// Will generate a standard URL used to automatically add TOTP auths. Usually used with qr codes
- ///
+ ///
/// Label and issuer will be URL-encoded if needed be
/// Secret will be base 32'd without padding, as per RFC.
#[cfg(feature = "otpauth")]
@@ -383,12 +396,12 @@ impl<T: AsRef<[u8]>> TOTP<T> {
let mut vec = Vec::new();
let qr = qrcodegen::QrCode::encode_text(&url, qrcodegen::QrCodeEcc::Medium)?;
let size = qr.size() as u32;
-
+
// "+ 8 * 8" is here to add padding (the white border around the QRCode)
- // As some QRCode readers don't work without padding
+ // As some QRCode readers don't work without padding
let image_size = size * 8 + 8 * 8;
let mut canvas = image::GrayImage::new(image_size, image_size);
-
+
// Draw the border
for x in 0..image_size {
for y in 0..image_size {
@@ -405,12 +418,12 @@ impl<T: AsRef<[u8]>> TOTP<T> {
// This clever trick to one-line the value was achieved with advanced mathematics
// And deep understanding of Boolean algebra.
let val = !qr.get_module(x_qr as i32, y_qr as i32) as u8 * 255;
-
+
// Multiply coordinates by width of pixels
// And take into account the 8*4 padding on top and left side
let x_start = x_qr * 8 + 8*4;
let y_start = y_qr * 8 + 8*4;
-
+
// Draw a 8-pixels-wide square
for x_img in x_start..x_start + 8 {
for y_img in y_start..y_start + 8 {