How can you generate OTP with system.security.cryptography that can be authenticated on client?

Question

Anyone know where I could find sample code for this with system.security.cryptography namespace -- or instructions followable by a developer?

The purpose is to add two-factor authentication to an asp.net website. On website I want to ask user to enter a passcode (similar to if they got it from a keyfob). On the client side I want to provide a vb.net windows.forms program that generates the correct passcode.

I want to do this with system.security.cryptography namespace on a small scale. I was looking for sample code I don't want to mess with devices or purchase authentication server appliances.

Most of the algorithms out there require an advanced degree in math or are for other platforms such as Linux or PHP. I'm looking for the .net equivalent.

Why do you need this? I think that there could be better solution and if you provide more info you might get provide better security and solution. — Luka Rahne, Sep 13 '10 at 10:07
To add two-factor authentication to an asp.net website. On website I want to ask user to enter a passcode (similar to if they got it from a keyfob). On the client side I want to provide a vb.net windows.forms program that generates the correct passcode. I want to do this with system.security.cryptography namespace. Was looking for sample code. — pghcpa, Sep 14 '10 at 17:14

score 1 · Answer 1 · edited Oct 07 '21 at 07:15

The cryptographic parts of RFC4226 (counter-based OTP) or draft-mraihi-totp-timebased (time-based OTP) are relatively simple:

Generate a HMAC based on the shared-key and the counter/time
Truncate it in a secure way

It is usually the user-management and the static/dynamic synchronization that makes it complicated.

Something like this should work:

public static int CalculateHotp(byte[] key, byte[] counter)
{
    var hmacsha1 = new HMACSHA1(key);
    byte[] hmac_result = hmacsha1.ComputeHash(counter);
    int offset = hmac_result[19] & 0x0f;
    int bin_code = (hmac_result[offset]  & 0x7f) << 24
                   | (hmac_result[offset+1] & 0xff) << 16
                   | (hmac_result[offset+2] & 0xff) <<  8
                   | (hmac_result[offset+3] & 0xff);
    int hotp = bin_code % 1000000;
    return hotp;
}

Thanks, but how do you do this in .NET with system.security.cryptography? — pghcpa, Sep 14 '10 at 17:11
pghcpa: Take a look at this [link](http://msdn.microsoft.com/en-us/library/system.security.cryptography.hmacsha1.aspx) — pistipanko, May 10 '12 at 10:22

How can you generate OTP with system.security.cryptography that can be authenticated on client?

1 Answers1

Linked