【笔记】Go语言基于TOTP实现2FA认证

发表于 2023-10-12 更新于 2025-12-26 阅读次数：

前言

Go语言基于TOTP实现2FA认证（双因素认证、双因子认证）

源代码

通过CheckCode()函数获取当前时间节点基于secret产生的密码，secretKeyBase32必须是Base32编码后的字符串

secretKeyBase32：Base32编码的字符串，用于作为计算密码的secret

package main

import (
	"crypto/hmac"
	"crypto/sha1"
	"encoding/base32"
	"fmt"
	"strings"
	"time"
)

// toBytes int64转byte切片
func int64ToBytes(value int64) []byte {
	var result []byte
	mask := int64(0xFF)
	shifts := [8]uint16{56, 48, 40, 32, 24, 16, 8, 0}
	for _, shift := range shifts {
		result = append(result, byte((value>>shift)&mask))
	}
	return result
}

// bytesToUint32 byte切片转uint32
func bytesToUint32(bytes []byte) uint32 {
	return (uint32(bytes[0]) << 24) + (uint32(bytes[1]) << 16) +
		(uint32(bytes[2]) << 8) + uint32(bytes[3])
}

// oneTimePassword 一次密码
func oneTimePassword(key []byte, value []byte) uint32 {
	hmacSha1 := hmac.New(sha1.New, key)
	hmacSha1.Write(value)
	hash := hmacSha1.Sum(nil)
	offset := hash[len(hash)-1] & 0x0F
	hashParts := hash[offset : offset+4]
	hashParts[0] = hashParts[0] & 0x7F
	number := bytesToUint32(hashParts)
	pwd := number % 1000000
	return pwd
}

// GetCode 获取验证码
func GetCode(secretKeyBase32 string, epochSeconds int64) (code int32) {
	secretKeyUpper := strings.ToUpper(secretKeyBase32)
	key, err := base32.StdEncoding.DecodeString(secretKeyUpper)
	if err != nil {
		fmt.Println(err)
		return
	}
	code = int32(oneTimePassword(key, int64ToBytes(epochSeconds/30)))
	return code
}

// CheckCode 校验验证码
func CheckCode(secretKeyBase32 string, code int32) bool {
	// 获取当前时间
	epochSeconds := time.Now().Unix()
	// 当前时间校验
	if GetCode(secretKeyBase32, epochSeconds) == code {
		return true
	}
	// 前30秒校验
	if GetCode(secretKeyBase32, epochSeconds-30) == code {
		return true
	}
	// 后30秒校验
	if GetCode(secretKeyBase32, epochSeconds+30) == code {
		return true
	}
	return false
}