Skip to main content

One-Time Password

The One-Time Password library supports the two standard OTP algorithms used for multi-factor authentication and access tokens:

  • HOTP (HMAC-based One-Time Password, RFC 4226) — derives a password from a shared secret plus a counter that both sides increment. Often used for hardware tokens.
  • TOTP (Time-based One-Time Password, RFC 6238) — derives a password from a shared secret plus the current UTC time, with a fixed step (typically 30 seconds). The basis for Google Authenticator, Authy, and most "verification code" apps.

NuGet package: GHIElectronics.TinyCLR.Drivers.OneTimePassword.

warning

TOTP requires both sides to agree on UTC time within the step window (typically 30 seconds). Make sure the device's clock is synced — see SNTP for the network time-sync pattern. A device with the wrong clock will generate passwords the server doesn't recognize.

Generating a TOTP code​

The constructor takes the shared secret (Base32-encoded, same as Google Authenticator's setup key). Generate(time, step) returns the OTP for that point in time:

using GHIElectronics.TinyCLR.Drivers.OneTimePassword;
using System;
using System.Diagnostics;

var otp = new OneTimePassword("JBSWY3DPEHPK3PXP");

// Standard TOTP — 30-second step.
var code = otp.Generate(DateTime.UtcNow, TimeSpan.FromSeconds(30));

Debug.WriteLine("TOTP: " + code);

Generating an HOTP code​

Generate(counter) returns the OTP for a given counter value. The server tracks the same counter; both sides increment after each successful use:

using GHIElectronics.TinyCLR.Drivers.OneTimePassword;

var otp = new OneTimePassword("JBSWY3DPEHPK3PXP");

var counter = 123;
var code = otp.Generate(counter);