HotpValidator.cs

using System;
using System.Threading.Tasks;
using Waher.Runtime.Counters;
using Waher.Runtime.Threading;
using Waher.Security.LoginMonitor;
 
namespace Waher.Security.TOTP
{
    public class HotpValidator
    {
        public const string ProtocolName = "HOTP";
 
        private readonly int nrDigits;
        private readonly byte[] secret;
        private readonly HashFunction hashFunction;
        private readonly LoginAuditor auditor;
        private readonly string endpoint;
 
        public HotpValidator(byte[] Secret, string OtpEndpoint, LoginAuditor Auditor)
            : this(HotpCalculator.DefaultNrDigits, Secret,
                  HotpCalculator.DefaultHashFunction, OtpEndpoint, Auditor)
        {
        }
 
        public HotpValidator(int NrDigits, byte[] Secret, string OtpEndpoint, 
            LoginAuditor Auditor)
            : this(NrDigits, Secret, HotpCalculator.DefaultHashFunction, OtpEndpoint, Auditor)
        {
        }
 
        public HotpValidator(int NrDigits, byte[] Secret, HashFunction HashFunction,
            string OtpEndpoint, LoginAuditor Auditor)
        {
            HotpCalculator.CheckNrDigits(NrDigits);
            HotpCalculator.CheckSecret(Secret);
 
            this.nrDigits = NrDigits;
            this.secret = Secret;
            this.hashFunction = HashFunction;
            this.endpoint = OtpEndpoint;
            this.auditor = Auditor;
        }
 
        public int NrDigits => this.nrDigits;
 
        public HashFunction HashFunction => this.hashFunction;
 
        public string OtpEndpoint => this.endpoint;
 
        public LoginAuditor Auditor => this.auditor;
 
        public static async Task<HotpValidator> TryCreate(string OtpEndpoint, 
            LoginAuditor Auditor)
        {
            ExternalCredential Secret = await ExternalCredential.GetSecret(OtpEndpoint, CredentialAlgorithm.HOTP);
            if (Secret is null || !Secret.HashFunction.HasValue)
                return null;
 
            return new HotpValidator(Secret.NrDigits, Secret.Secret, Secret.HashFunction.Value, 
                OtpEndpoint, Auditor);
        }
 
        public Task<ValidationResult> Validate(string OtpEndpoint, string RemoteEndPoint,
            long Counter, int PassCode)
        {
            return Validate(this.nrDigits, this.secret, this.hashFunction, OtpEndpoint, 
                RemoteEndPoint, Counter, PassCode, this.auditor);
        }
 
        public static Task<ValidationResult> Validate(byte[] Secret, string OtpEndpoint, 
            string RemoteEndPoint, long Counter, int PassCode, LoginAuditor Auditor)
        {
            return Validate(HotpCalculator.DefaultNrDigits, Secret, OtpEndpoint, 
                RemoteEndPoint, Counter, PassCode, Auditor);
        }
 
        public static Task<ValidationResult> Validate(int NrDigits, byte[] Secret,
            string OtpEndpoint, string RemoteEndPoint, long Counter, int PassCode, 
            LoginAuditor Auditor)
        {
            return Validate(NrDigits, Secret, HotpCalculator.DefaultHashFunction,
                OtpEndpoint, RemoteEndPoint, Counter, PassCode, Auditor);
        }
 
        public static async Task<ValidationResult> Validate(int NrDigits, byte[] Secret,
            HashFunction HashFunction, string OtpEndpoint, string RemoteEndPoint, 
            long Counter, int PassCode, LoginAuditor Auditor)
        {
            using Semaphore Lock = await Semaphores.BeginWrite(ProtocolName + ":" + OtpEndpoint);
 
            string Key = ProtocolName + "." + OtpEndpoint;
            long LastCounter = await RuntimeCounters.GetCount(Key);
            if (Counter <= LastCounter)
            {
                LoginAuditor.Fail("Counter value not valid (replay attack?).", OtpEndpoint,
                    RemoteEndPoint, ProtocolName);
                return new ValidationResult();
            }
 
            await RuntimeCounters.IncrementCounter(Key, Counter - LastCounter);
 
            DateTime? EarliestOpportunity = await Auditor.GetEarliestLoginOpportunity(RemoteEndPoint, ProtocolName);
            if (EarliestOpportunity.HasValue)
                return new ValidationResult(EarliestOpportunity.Value);
 
            int Expected = HotpCalculator.Compute(NrDigits, Secret, HashFunction, Counter);
            bool Ok = Expected == PassCode;
 
            if (Ok)
            {
                LoginAuditor.Success(ProtocolName + " authentication successful.",
                    OtpEndpoint, RemoteEndPoint, ProtocolName);
            }
            else
            {
                LoginAuditor.Fail(ProtocolName + " authentication failed.",
                    OtpEndpoint, RemoteEndPoint, ProtocolName);
            }
 
            return new ValidationResult(Ok);
        }
    }
}