diff options
| -rw-r--r-- | roseh.moe.go | 15 |
1 files changed, 10 insertions, 5 deletions
diff --git a/roseh.moe.go b/roseh.moe.go index 49f62d3..40bc076 100644 --- a/roseh.moe.go +++ b/roseh.moe.go @@ -522,10 +522,10 @@ func cookieAuth(w http.ResponseWriter, r *http.Request) bool { return true } -func totp(key []byte) []byte { +func totp(t int64) []byte { ts := make([]byte, 8) - binary.BigEndian.PutUint64(ts, uint64(time.Now().Unix()/30)) - hash := hmac.New(sha1.New, key) + binary.BigEndian.PutUint64(ts, uint64(t)) + hash := hmac.New(sha1.New, authenticatorKey) hash.Write(ts) mac := hash.Sum(nil) offset := mac[len(mac)-1] & 0xf @@ -536,13 +536,18 @@ func totp(key []byte) []byte { return strconv.AppendInt(nil, int64(n%1_000_000), 10) } +func checkOTP(auth string) int { + now := time.Now().Unix() / 30 + return subtle.ConstantTimeCompare([]byte(auth), totp(now)) | subtle.ConstantTimeCompare([]byte(auth), totp(now-1)) +} + func checkPassword(password, auth string) bool { - otp := totp(authenticatorKey) + otpMatches := checkOTP(auth) hash, err := pwhash.Hash(password, notepadPassword[:pwhash.SaltSize]) if err != nil { return false } - return subtle.ConstantTimeCompare(hash, notepadPassword[pwhash.SaltSize:])&subtle.ConstantTimeCompare([]byte(auth), otp) != 0 + return subtle.ConstantTimeCompare(hash, notepadPassword[pwhash.SaltSize:])&otpMatches != 0 } var ( |