petrsnd / OtpCore

HOTP and TOTP utilities for one-time password algorithm implementation
MIT License
6 stars 1 forks source link

Treat long counter as if it were an 8-byte buffer #13

Closed petrsnd closed 1 year ago

petrsnd commented 1 year ago

This is better. Don't have to worry about checking for negative counters which aren't disallowed in the spec. The spec says 8-byte it is an 8-byte integer. Using a ulong isn't a good option because the TOTP implementation use HOTP under the covers and Unix time is signed for historical reasons. You start to run into a lot of casting problems when converting a Unix time to a counter if you try to make counters unsigned. It is better just to do the arithmetic with signed integers and calculate the buffer as if it were unsigned by just grabbing the bytes. I explicitly removed bounds checking in the unlikely case that long.MaxValue is incremented which results in the correct buffer but does strange things arithmetically. There are unit tests to catch a platform compiling this code that behaves differently than what is expected by this library.