totp

https://github.com/pyramation/totp/blob/master/packages/totp... yes in the notes of the source here The first TOTP implementation I wrote was here was much less efficient, literally the algorithm in steps: https://github.com/pyramation/learn-totp/blob/master/package... That gist is essentially the pure TOTP algo, but it was missing what we use in industry practice that the RFC was missing... base32 encode/decode. So I implemented a base32 encode/decode so that the TOTP algo actually works with google authenticator and authy https://github.com/pyramation/totp/blob/master/extensions/%4... When I found the gist, while the original code worked, the gist was much smaller (used more efficient bitwise operations) and the gist author I collaborated briefly and decided to combine the gist and the code for OSS

This is very interesting if it was done for fun. However, this is very likely unsuitable for real world usage. A couple of issues I could see with a quick glance: - Using '=' for comparing TOTPs in the totp.verify function[1] is not safe from timing attacks. - The function random() used in the totp.random_base32 function[2] is not a cryptographically secure random number generator. [1]: https://github.com/pyramation/totp/blob/7ec3104/packages/tot... [2]: https://github.com/pyramation/totp/blob/7ec3104/packages/tot...

Author here. Here is the full code if anyone is interested: https://github.com/pyramation/totp/blob/master/packages/totp...

The file you're pointing to is not the full extension, here it is: https://github.com/pyramation/totp/blob/master/packages/totp...

The author's main SQL code seems to be in this file: https://github.com/pyramation/totp/blob/master/packages/totp... For comparison, these are my relatively short TOTP implementations in {TypeScript, Python, Java, Rust, C++}: https://www.nayuki.io/page/time-based-one-time-password-tool... . I even have a 6-line Python function.