You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
105 lines
3.4 KiB
105 lines
3.4 KiB
7 months ago
|
<?php
|
||
|
|
class Api_Google_Authenticator{
|
||
|
|
const keyRegeneration = 30; // Interval between key regeneration
|
||
|
|
const otpLength = 6; // Length of the Token generated
|
||
|
|
private static $lut = array("A" => 0, "B" => 1, "C" => 2, "D" => 3, "E" => 4, "F" => 5, "G" => 6, "H" => 7, "I" => 8, "J" => 9, "K" => 10, "L" => 11, "M" => 12, "N" => 13, "O" => 14, "P" => 15, "Q" => 16, "R" => 17, "S" => 18, "T" => 19, "U" => 20, "V" => 21, "W" => 22, "X" => 23, "Y" => 24, "Z" => 25, "2" => 26, "3" => 27, "4" => 28, "5" => 29, "6" => 30, "7" => 31);
|
||
|
|
|
||
|
|
/**
|
||
|
|
* Generates a 16 digit secret key in base32 format
|
||
|
|
* @return string
|
||
|
|
*/
|
||
|
|
static function generate_secret_key($length = 16){
|
||
|
|
$b32 = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
|
||
|
|
$s = "";
|
||
|
|
for($i = 0; $i < $length; $i++) $s .= $b32[rand(0, 31)];
|
||
|
|
return $s;
|
||
|
|
}
|
||
|
|
|
||
|
|
/**
|
||
|
|
* Returns the current Unix Timestamp devided by the keyRegeneration period.
|
||
|
|
* @return integer
|
||
|
|
*/
|
||
|
|
static function get_timestamp(){
|
||
|
|
return floor(microtime(true) / self::keyRegeneration);
|
||
|
|
}
|
||
|
|
|
||
|
|
/**
|
||
|
|
* Decodes a base32 string into a binary string.
|
||
|
|
*/
|
||
|
|
static function base32_decode($b32){
|
||
|
|
$b32 = strtoupper($b32);
|
||
|
|
if(!preg_match('/^[ABCDEFGHIJKLMNOPQRSTUVWXYZ234567]+$/', $b32, $match)) {
|
||
|
|
Tool_Fnc::showMsg('非法输入');
|
||
|
|
}
|
||
|
|
$l = strlen($b32);
|
||
|
|
$n = 0;
|
||
|
|
$j = 0;
|
||
|
|
$binary = "";
|
||
|
|
for($i = 0; $i < $l; $i++){
|
||
|
|
$n = $n << 5; // Move buffer left by 5 to make room
|
||
|
|
$n = $n + self::$lut[$b32[$i]]; // Add value into buffer
|
||
|
|
$j = $j + 5; // Keep track of number of bits in buffer
|
||
|
|
if($j >= 8){
|
||
|
|
$j = $j - 8;
|
||
|
|
$binary .= chr(($n & (0xFF << $j)) >> $j);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
return $binary;
|
||
|
|
}
|
||
|
|
|
||
|
|
/**
|
||
|
|
* Takes the secret key and the timestamp and returns the one time
|
||
|
|
* password.
|
||
|
|
*
|
||
|
|
* @param binary $key - Secret key in binary form.
|
||
|
|
* @param integer $counter - Timestamp as returned by get_timestamp.
|
||
|
|
* @return string
|
||
|
|
*/
|
||
|
|
static function oath_hotp($key, $counter){
|
||
|
|
$bin_counter = pack('N*', 0) . pack('N*', $counter); // Counter must be 64-bit int
|
||
|
|
$hash = hash_hmac('sha1', $bin_counter, $key, true);
|
||
|
|
return str_pad(self::oath_truncate($hash), self::otpLength, '0', STR_PAD_LEFT);
|
||
|
|
}
|
||
|
|
|
||
|
|
/**
|
||
|
|
* Verifys a user inputted key against the current timestamp. Checks $window
|
||
|
|
* keys either side of the timestamp.
|
||
|
|
*
|
||
|
|
* @param string $b32seed
|
||
|
|
* @param string $key - User specified key
|
||
|
|
* @param integer $window
|
||
|
|
* @param boolean $useTimeStamp
|
||
|
|
* @return boolean
|
||
|
|
*/
|
||
|
|
static function verify_key($b32seed, $key, $window = 4, $useTimeStamp = true){
|
||
|
|
$timeStamp = self::get_timestamp();
|
||
|
|
if($useTimeStamp !== true) $timeStamp = (int)$useTimeStamp;
|
||
|
|
$binarySeed = self::base32_decode($b32seed);
|
||
|
|
for($ts = $timeStamp - $window; $ts <= $timeStamp + $window; $ts++) if(self::oath_hotp($binarySeed, $ts) == $key) return true;
|
||
|
|
return false;
|
||
|
|
}
|
||
|
|
|
||
|
|
/**
|
||
|
|
* Extracts the OTP from the SHA1 hash.
|
||
|
|
*
|
||
|
|
* @param binary $hash
|
||
|
|
* @return integer
|
||
|
|
*/
|
||
|
|
static function oath_truncate($hash){
|
||
|
|
$offset = ord($hash[19]) & 0xf;
|
||
|
|
return (((ord($hash[$offset + 0]) & 0x7f) << 24) | ((ord($hash[$offset + 1]) & 0xff) << 16) | ((ord($hash[$offset + 2]) & 0xff) << 8) | (ord($hash[$offset + 3]) & 0xff)) % pow(10, self::otpLength);
|
||
|
|
}
|
||
|
|
|
||
|
|
/**
|
||
|
|
* 通过用户ID得到双重口令
|
||
|
|
* @param $pUid
|
||
|
|
* @return array
|
||
|
|
*/
|
||
|
|
static function getByUid($pUid){
|
||
|
|
$tGA = array('secret'=>'', 'open'=>0);
|
||
|
|
if($tHotp = Cache_Redis::instance()->hGet('user_ga', $pUid)){
|
||
|
|
list($tGA['secret'], $tGA['open']) = explode(',', $tHotp);
|
||
|
|
}
|
||
|
|
return $tGA;
|
||
|
|
}
|
||
|
|
}
|