HOTP and TOTP: one-time passwords done right

// HOTP of RFC 4226: an HMAC-SHA-1 of an 8-byte counter, cut down to a few decimal digits. The program computes the
// codes of Appendix D (secret "12345678901234567890", counters 0 to 9) and compares them with the RFC's table.
import { createHmac } from 'node:crypto';

const secret = Buffer.from('12345678901234567890', 'ascii'); // 20 bytes = 160 bits, the length RFC 4226 recommends

// The counter is an 8-byte big-endian integer.
function counterBytes(counter) {
  const bytes = Buffer.alloc(8);
  bytes.writeBigUInt64BE(BigInt(counter));
  return bytes;
}

// Dynamic truncation (RFC 4226 section 5.3): the low 4 bits of the last byte are an offset into the 20 bytes; the 4 bytes
// there are read as a number with the top bit cleared (31 bits); the code is that number modulo 10^digits.
function truncate(mac, digits) {
  const offset = mac[mac.length - 1] & 0x0f;
  const number = mac.readUInt32BE(offset) & 0x7fffffff;
  return { offset, number, code: String(number % 10 ** digits).padStart(digits, '0') };
}

const mac = (counter) => createHmac('sha1', secret).update(counterBytes(counter)).digest();
const hotp = (counter, digits = 6) => truncate(mac(counter), digits).code;

// One code, step by step.
const first = mac(0);
const t = truncate(first, 6);
console.log(`secret         "12345678901234567890", ${secret.length} bytes (${secret.length * 8} bits)`);
console.log(`counter        ${counterBytes(0).toString('hex')}   (8 bytes, big-endian)`);
console.log(`HMAC-SHA-1     ${first.toString('hex')}   (${first.length} bytes)`);
console.log(`offset         ${t.offset}   (the low 4 bits of the last byte, 0x${first.at(-1).toString(16)})`);
console.log(`31-bit number  ${t.number.toString(16)} = ${t.number}   (the first byte 0x${first[t.offset].toString(16)} with its top bit cleared is 0x${(first[t.offset] & 0x7f).toString(16)})`);
console.log(`6 digits       ${t.code}   (${t.number} mod 1,000,000)`);
console.log(`8 digits       ${hotp(0, 8)}   (the same number mod 100,000,000)`);
console.log('');

// RFC 4226 Appendix D, Table 2: the HOTP value for each count.
const published = ['755224', '287082', '359152', '969429', '338314', '254676', '287922', '162583', '399871', '520489'];
console.log('counter  code    RFC 4226 table  same');
let all = true;
published.forEach((expected, counter) => {
  const code = hotp(counter);
  all &&= code === expected;
  console.log(`${String(counter).padEnd(8)} ${code}  ${expected}          ${code === expected ? 'yes' : 'NO'}`);
});
console.log(`all ten codes equal the RFC's table: ${all}`);
console.log('');

// RFC 4226 section 5.4 gives the 20 bytes of one HMAC and works the truncation through by hand.
const sample = Buffer.from('1f8698690e02ca16618550ef7f19da8e945b555a', 'hex');
console.log(`section 5.4 sample: offset ${truncate(sample, 6).offset}, 4 bytes ${sample.subarray(10, 14).toString('hex')}, code ${truncate(sample, 6).code}   (the RFC says 872921)`);

secret         "12345678901234567890", 20 bytes (160 bits)
counter        0000000000000000   (8 bytes, big-endian)
HMAC-SHA-1     cc93cf18508d94934c64b65d8ba7667fb7cde4b0   (20 bytes)
offset         0   (the low 4 bits of the last byte, 0xb0)
31-bit number  4c93cf18 = 1284755224   (the first byte 0xcc with its top bit cleared is 0x4c)
6 digits       755224   (1284755224 mod 1,000,000)
8 digits       84755224   (the same number mod 100,000,000)

counter  code    RFC 4226 table  same
0        755224  755224          yes
1        287082  287082          yes
2        359152  359152          yes
3        969429  969429          yes
4        338314  338314          yes
5        254676  254676          yes
6        287922  287922          yes
7        162583  162583          yes
8        399871  399871          yes
9        520489  520489          yes
all ten codes equal the RFC's table: true

section 5.4 sample: offset 10, 4 bytes 50ef7f19, code 872921   (the RFC says 872921)