TotpValidator.cs

using System;
using System.Threading.Tasks;
using Waher.Runtime.Counters;
using Waher.Runtime.Threading;
using Waher.Security.LoginMonitor;
 
namespace Waher.Security.TOTP
{
    public class TotpValidator
    {
        public const string ProtocolName = "TOTP";
 
        private readonly int nrDigits;
        private readonly byte[] secret;
        private readonly HashFunction hashFunction;
        private readonly LoginAuditor auditor;
        private readonly string endpoint;
        private readonly int timeStepSeconds;
        private readonly long t0;
 
        public TotpValidator(byte[] Secret, string OtpEndpoint, LoginAuditor Auditor)
            : this(HotpCalculator.DefaultNrDigits, Secret,
                  HotpCalculator.DefaultHashFunction, TotpCalculator.DefaultTimeStepSeconds,
                  OtpEndpoint, Auditor)
        {
        }
 
        public TotpValidator(int NrDigits, byte[] Secret, string OtpEndpoint, LoginAuditor Auditor)
            : this(NrDigits, Secret, HotpCalculator.DefaultHashFunction,
                  TotpCalculator.DefaultTimeStepSeconds, OtpEndpoint, Auditor)
        {
        }
 
        public TotpValidator(int NrDigits, byte[] Secret, HashFunction HashFunction,
            int TimeStepSeconds, string OtpEndpoint, LoginAuditor Auditor)
            : this(NrDigits, Secret, HashFunction, TimeStepSeconds, TotpCalculator.DefaultT0,
                  OtpEndpoint, Auditor)
        {
        }
 
        public TotpValidator(int NrDigits, byte[] Secret, HashFunction HashFunction,
            int TimeStepSeconds, long T0, string OtpEndpoint, LoginAuditor Auditor)
        {
            HotpCalculator.CheckNrDigits(NrDigits);
            HotpCalculator.CheckSecret(Secret);
            TotpCalculator.CheckTimeStepSeconds(TimeStepSeconds, T0);
 
            this.nrDigits = NrDigits;
            this.secret = Secret;
            this.hashFunction = HashFunction;
            this.endpoint = OtpEndpoint;
            this.auditor = Auditor;
            this.timeStepSeconds = TimeStepSeconds;
            this.t0 = T0;
        }
 
        public int NrDigits => this.nrDigits;
 
        public HashFunction HashFunction => this.hashFunction;
 
        public int TimeStepSeconds => this.timeStepSeconds;
 
        public string OtpEndpoint => this.endpoint;
 
        public LoginAuditor Auditor => this.auditor;
 
        public static async Task<TotpValidator> TryCreate(string OtpEndpoint, LoginAuditor Auditor)
        {
            ExternalCredential Secret = await ExternalCredential.GetSecret(OtpEndpoint, CredentialAlgorithm.TOTP);
            if (Secret is null || !Secret.HashFunction.HasValue)
                return null;
 
            return new TotpValidator(Secret.NrDigits, Secret.Secret, Secret.HashFunction.Value,
                Secret.TimeStepSeconds, OtpEndpoint, Auditor);
        }
 
        public Task<ValidationResult> Validate(string OtpEndpoint, string RemoteEndPoint,
            DateTime Timestamp, int PassCode)
        {
            return Validate(this.nrDigits, this.secret, this.hashFunction, OtpEndpoint,
                RemoteEndPoint, Timestamp, this.timeStepSeconds, PassCode, this.auditor);
        }
 
        public static Task<ValidationResult> Validate(byte[] Secret, string OtpEndpoint,
            string RemoteEndPoint, DateTime Timestamp, int TimeStepSeconds, int PassCode,
            LoginAuditor Auditor)
        {
            return Validate(HotpCalculator.DefaultNrDigits, Secret, OtpEndpoint,
                RemoteEndPoint, Timestamp, TimeStepSeconds, PassCode, Auditor);
        }
 
        public static Task<ValidationResult> Validate(int NrDigits, byte[] Secret,
            string OtpEndpoint, string RemoteEndPoint, DateTime Timestamp, int TimeStepSeconds,
            int PassCode, LoginAuditor Auditor)
        {
            return Validate(NrDigits, Secret, HotpCalculator.DefaultHashFunction,
                OtpEndpoint, RemoteEndPoint, Timestamp, TimeStepSeconds, PassCode, Auditor);
        }
 
        public static async Task<ValidationResult> Validate(int NrDigits, byte[] Secret,
            HashFunction HashFunction, string OtpEndpoint, string RemoteEndPoint,
            DateTime Timestamp, int TimeStepSeconds, int PassCode, LoginAuditor Auditor)
        {
            return await Validate(NrDigits, Secret, HashFunction, OtpEndpoint,
                RemoteEndPoint, Timestamp, TimeStepSeconds, TotpCalculator.DefaultT0,
                PassCode, Auditor);
        }
 
        public static async Task<ValidationResult> Validate(int NrDigits, byte[] Secret,
            HashFunction HashFunction, string OtpEndpoint, string RemoteEndPoint,
            DateTime Timestamp, int TimeStepSeconds, long T0, int PassCode,
            LoginAuditor Auditor)
        {
            using Semaphore Lock = await Semaphores.BeginWrite(ProtocolName + ":" + OtpEndpoint);
 
            string Key = ProtocolName + "." + OtpEndpoint;
            long LastCounter = await RuntimeCounters.GetCount(Key);
            long Counter = TotpCalculator.CalcCounter(Timestamp, TimeStepSeconds, T0);
 
            if (Counter <= LastCounter)
            {
                LoginAuditor.Fail("Counter value not valid (replay attack?).", OtpEndpoint,
                    RemoteEndPoint, ProtocolName);
                return new ValidationResult();
            }
 
            await RuntimeCounters.IncrementCounter(Key, Counter - LastCounter);
 
            DateTime? EarliestOpportunity = await Auditor.GetEarliestLoginOpportunity(RemoteEndPoint, ProtocolName);
            if (EarliestOpportunity.HasValue)
                return new ValidationResult(EarliestOpportunity.Value);
 
            int Expected = HotpCalculator.Compute(NrDigits, Secret, HashFunction, Counter);
            bool Ok = Expected == PassCode;
 
            if (!Ok)    // Check previous time step
            {
                Counter--;  // Checking -1
                Expected = HotpCalculator.Compute(NrDigits, Secret, HashFunction, Counter);
                Ok = Expected == PassCode;
 
                if (Ok)
                    await RuntimeCounters.DecrementCounter(Key);
                else
                {
                    Counter += 2;  // Checking +1
                    Expected = HotpCalculator.Compute(NrDigits, Secret, HashFunction, Counter);
                    Ok = Expected == PassCode;
 
                    if (Ok)
                        await RuntimeCounters.IncrementCounter(Key);
                }
            }
 
            if (Ok)
            {
                LoginAuditor.Success(ProtocolName + " authentication successful.",
                    OtpEndpoint, RemoteEndPoint, ProtocolName);
            }
            else
            {
                LoginAuditor.Fail(ProtocolName + " authentication failed.",
                    OtpEndpoint, RemoteEndPoint, ProtocolName);
            }
 
            return new ValidationResult(Ok);
        }
    }
}