Package: opentotp
OpenTOTPOpenTOTPis yet another time-based, one-time passwords (OTPs) generator/verifier inspired byRFC 6238.It generates and validates OTPs based on:Shared secretCurrent UTC timeOpenTOTP usesHMAC-SHA256to generate OTPs, encodes them using any alphabet (predefined set of output characters) you may need, and truncates OTPs to the expected length.To ensure generated passwords can be used one-time only, applications that use this package must either mark successfully verified OTPs as already used ones (and temporarily store them in a database until OTP expires) so used OTPs can be rejected, or can use optional, one-timenoncevalue while generating OTP.As defined inRFC 6238, the OpenTOTP verification mechanism allows for an OTP drift so a specified number of older/newer OTP values are also accepted as valid ones. This helps to increase the chance of successful verification when the current UTC time on the client and server sides are slightly different.Note that theshared secretvalue can be customized in any manner, effectively limiting the validation scope of an OTP, for instance:Per application (shared secret = application-level secret)Per user/session (shared secret = user/session unique random secret)Per transaction (shared secret = transaction unique random secret)Needless to say, theshared secretmust be kept secret. Once its confidentiality or integrity is breached, the intruder can impersonate the user.InstallationYou can install the OpenTOTP fromPyPI:python-mpipinstallopentotpQuick startGenerate OTP (using default settings)python-mopentotpgenerateVerify OTPpython-mopentotpverifyOTP_VALUECommand line usageGenerate OTP usingcustom secretTOTP_SECRET=`python-c"import os; print(os.urandom(32).hex())"`python-mopentotp--secret${TOTP_SECRET}generateGenerate OTP usingverbose modepython-mopentotp-vgenerateGenerate OTP that changesevery 30 secondspython-mopentotp--otp-change-interval30generateGenerate OTP that usesonly Arabic numeralsas the output alphabetpython-mopentotp--alphabet"0123456789"generateVerify ifOTP is correct# Sample OTP value: yfPXifubpython-mopentotp--secret"REPLACE_WITH_SECRET_USED_TO_GENERATE_OTP"verifyyfPXifubWhen verifying, also accept4 older/newer OTPs# Sample OTP value: yfPXifubpython-mopentotp--otp-change-interval30--otp-drift4verifyyfPXifubCommand line parametersusage: opentotp.py [-h] [--timestamp TIMESTAMP] [--secret SECRET] [--alphabet ALPHABET] [--otp-length OTP_LENGTH] [--otp-change-interval OTP_CHANGE_INTERVAL] [--otp-drift OTP_DRIFT]
                   [--nonce NONCE] [--version] [-v | -q]
                   {generate,verify} ...

Generate or verify Time-based One-Time Passwords (TOTPs) based on shared secret and current UTC timestamp.

  To generate new OTP:
       python -m opentotp generate

  To verify OTP: 
       python -m opentotp verify OTP_VALUE

optional arguments:
  -h, --help            show this help message and exit
  --timestamp TIMESTAMP
                        Custom UTC Epoch timestamp to use
  --secret SECRET       Shared secret value
  --alphabet ALPHABET   Custom encoding (output) alphabet
  --otp-length OTP_LENGTH
                        Length of OTP
  --otp-change-interval OTP_CHANGE_INTERVAL
                        OTP change interval [in seconds]
  --otp-drift OTP_DRIFT
                        A number of previous/next OTPs to accept
  --nonce NONCE         A one-time-only NONCE value to prevent replay-attacks
  --version             show program's version number and exit
  -v, --verbose         Include configuration parameters in result screen
  -q, --quiet           Quiet mode. Print OTP only or return result of verification (TRUE or FALSE)

sub-commands:
  {generate,verify}     OpenTOTP mode of operation
    generate            Generate new OTP
    verify              Verify if provided OTP is correctModule usageSample code snippet#!/usr/bin/env python3fromopentotpimportOpenTOTPfromuuidimportuuid4otp=OpenTOTP(secret=uuid4().hex,alphabet="0123456789",otp_length=6,otp_change_interval=30,otp_drift=3)otp_value=otp.generate()result=otp.verify(otp_value)print("------------------------------------------")print(f"OTP:{otp_value}")print(f"OTP verification status:{'SUCCESS'ifresultelse'FAILURE'}")print("------------------------------------------")Docker usageFor some, this may be the fastest and cleanest way to try OpenTOTP:Build docker image and run the containergitclonehttps://github.com/prevenitylabs/opentotp.gitopentotpcdopentotp
dockerbuild-topentotp.
dockerrun--rmopentotp--helpGenerate OTPdockerrun--rmopentotpgenerateVerify OTPdockerrun--rmopentotp-vverifyOTP_VALUE