simpletotp / src / simpletotp /

Full commit
#!/usr/bin/env python
OATH HOTP + TOTP Implementation in python.

Based on

Parameter and function names kept inline with the RFC
(e.g. HOTP, Truncate, K, C etc)
import hmac
import hashlib
import array
import time

def HOTP(K, C, digits=6):
    HOTP accepts key K and counter C
    optional digits parameter can control the response length

    returns the OATH integer code with {digits} length
    C_bytes = _long_to_byte_array(C)
    hmac_sha1 =, msg=C_bytes,
    return Truncate(hmac_sha1)[-digits:]

def TOTP(K, digits=6, window=30):
    TOTP is a time-based variant of HOTP.
    It accepts only key K, since the counter is derived from the current time
    optional digits parameter can control the response length
    optional window parameter controls the time window in seconds

    returns the OATH integer code with {digits} length
    C = long(time.time() / window)
    return HOTP(K, C, digits=digits)

def Truncate(hmac_sha1):
    Truncate represents the function that converts an HMAC-SHA-1
    value into an HOTP value as defined in Section 5.3.
    offset = int(hmac_sha1[-1], 16)
    binary = int(hmac_sha1[(offset * 2):((offset * 2) + 8)], 16) & 0x7fffffff
    return str(binary)

def _long_to_byte_array(long_num):
    helper function to convert a long number into a byte array
    byte_array = array.array('B')
    for i in range(7, -1, -1):
        byte_array.insert(0, long_num & 0xff)
        long_num >>= 8
    return byte_array

def google_totp():
    """Simple Google's 2 steps verification code generator.
    Yield a valid PIN for a given secret key.

    For the moment, the secret key is the last argument given to the sript.
    import sys
    import base64

    print TOTP(base64.b32decode(sys.argv[-1]))