RFC 6238 time-based one-time password generation. More...

#include <totp.h>

Classes
struct	Settings
	Validated TOTP parameters. Only Totp::parse() produces one. More...

Public Types
enum class	Algorithm { Sha1 , Sha256 , Sha512 }
	HMAC hash function, selected by the algorithm URI parameter. More...
enum class	Encoder { Base10 , Steam }
	Digit encoding, selected by the encoder URI parameter. More...

Static Public Member Functions
static auto	parse (const QString &config) -> std::optional< Settings >
	Parse an OTP configuration string.
static auto	isValid (const QString &config) -> bool
	Convenience validity test, for UI feedback.
static auto	generate (const Settings &settings, quint64 unixTime) -> QString
	Generate the code for a given point in time.
static auto	generateNow (const Settings &settings) -> QString
	Generate the code for the current wall-clock time.
static auto	counter (const Settings &settings, quint64 unixTime) -> quint64
	Time-step counter for a point in time.
static auto	secondsRemaining (const Settings &settings, quint64 unixTime) -> uint
	Seconds until the code for `unixTime` expires.
static auto	toUri (const Settings &settings) -> QString
	Serialise settings as a canonical otpauth URI.
static auto	normalize (const QString &config, const QString &label={}, const QString &issuer={}) -> QString
	Normalise a user-entered value to a canonical otpauth URI.
static auto	currentUnixTime () -> quint64
	Current wall-clock time.

Static Public Attributes
static constexpr uint	DEFAULT_DIGITS = 6U
	RFC 6238 default code length.
static constexpr uint	DEFAULT_STEP = 30U
	RFC 6238 default period.
static constexpr uint	STEAM_DIGITS = 5U
	Steam codes are always 5 chars.
static constexpr uint	MIN_DIGITS = 1U
	Lower clamp for digits.
static constexpr uint	MAX_DIGITS = 10U
	Upper clamp for digits.
static constexpr uint	MAX_STEP = 86400U
static constexpr qsizetype	MAX_CONFIG_LENGTH = 4096

Private Member Functions
	Totp ()=default
	Static-only class; never instantiated.

Detailed Description

RFC 6238 time-based one-time password generation.

Ported and trimmed from KeePassXC (src/core/Totp.cpp). QtPass stores TOTP configuration as an otpauth://totp/... URI — canonically in the OTP template field, and also accepted as a bare line in the entry body, which is the convention the pass-otp extension uses. Only that dialect plus a bare base32 secret is parsed; KeePassXC's KeeOtp and legacy [step];[digits] formats exist purely to read .kdbx entry attributes and have no meaning in a password store.

Totp::parse() validates everything it returns, so Settings is valid by construction and Totp::generate() cannot fail. HMAC comes from QtCore (QMessageAuthenticationCode), so no crypto dependency is added.

Definition at line 36 of file totp.h.

Member Enumeration Documentation

◆ Algorithm

enum class Totp::Algorithm

strong

HMAC hash function, selected by the algorithm URI parameter.

Enumerator
Sha1	HMAC-SHA-1, the RFC 6238 default.
Sha256	HMAC-SHA-256.
Sha512	HMAC-SHA-512.

Definition at line 41 of file totp.h.

◆ Encoder

enum class Totp::Encoder

strong

Digit encoding, selected by the encoder URI parameter.

Enumerator
Base10	RFC 6238 decimal digits, zero padded.
Steam	Steam Guard's five-character alphabet.

Definition at line 50 of file totp.h.

Member Function Documentation

◆ counter()

auto Totp::counter	(	const Settings &	settings,
		quint64	unixTime ) -> quint64

staticnodiscard

Time-step counter for a point in time.

Parameters

settings	Validated settings.
unixTime	Seconds since the Unix epoch (UTC).

Returns: unixTime / settings.step.

Definition at line 205 of file totp.cpp.

Here is the caller graph for this function:

◆ currentUnixTime()

auto Totp::currentUnixTime ( ) -> quint64

staticnodiscard

Current wall-clock time.

Returns: Seconds since the Unix epoch (UTC).

Definition at line 318 of file totp.cpp.

Here is the caller graph for this function:

◆ generate()

auto Totp::generate	(	const Settings &	settings,
		quint64	unixTime ) -> QString

staticnodiscard

Generate the code for a given point in time.

Parameters

settings	Validated settings.
unixTime	Seconds since the Unix epoch (UTC).

Returns: The code, exactly Settings::digits characters long.

Definition at line 214 of file totp.cpp.

Here is the call graph for this function:

Here is the caller graph for this function:

◆ generateNow()

auto Totp::generateNow ( const Settings & settings ) -> QString

staticnodiscard

Generate the code for the current wall-clock time.

Parameters

settings Validated settings.

Returns: The current code.

Definition at line 259 of file totp.cpp.

Here is the call graph for this function:

Here is the caller graph for this function:

◆ isValid()

auto Totp::isValid ( const QString & config ) -> bool

staticnodiscard

Convenience validity test, for UI feedback.

Parameters

config URI or bare base32 secret.

Returns: true when parse() would succeed.

Definition at line 201 of file totp.cpp.

Here is the call graph for this function:

Here is the caller graph for this function:

◆ normalize()

auto Totp::normalize	(	const QString &	config,
		const QString &	label = {},
		const QString &	issuer = {} ) -> QString

staticnodiscard

Normalise a user-entered value to a canonical otpauth URI.

Parameters

config	URI or bare base32 secret.
label	Fallback label, used when `config` carries none. The entry name is a good choice.
issuer	Fallback issuer, used when `config` carries none.

Returns: A canonical URI, or an empty string when config is not valid or its URI would be longer than MAX_CONFIG_LENGTH.

Definition at line 296 of file totp.cpp.

Here is the call graph for this function:

Here is the caller graph for this function:

◆ parse()

auto Totp::parse ( const QString & config ) -> std::optional< Settings >

staticnodiscard

Parse an OTP configuration string.

Accepts an otpauth://totp/<label>?secret=... URI, reading the secret, digits, period, algorithm, encoder and issuer parameters, or a bare base32 secret. otpauth://hotp/... is rejected: a counter-based HOTP value cannot be derived from a clock, and returning a plausible-looking TOTP code for it would be silently wrong.

digits is clamped to MIN_DIGITS..MAX_DIGITS and period to 1..MAX_STEP.

Parameters

config URI or bare base32 secret; surrounding whitespace is ignored.

Returns: Validated settings, or std::nullopt when the secret is missing or is not decodable base32, or the configuration (its surrounding whitespace included) is longer than MAX_CONFIG_LENGTH.

Definition at line 106 of file totp.cpp.

Here is the call graph for this function:

Here is the caller graph for this function:

◆ secondsRemaining()

auto Totp::secondsRemaining	(	const Settings &	settings,
		quint64	unixTime ) -> uint

staticnodiscard

Seconds until the code for unixTime expires.

Parameters

settings	Validated settings.
unixTime	Seconds since the Unix epoch (UTC).

Returns: A value in 1..settings.step, so a period boundary reads as a full step rather than zero.

Definition at line 209 of file totp.cpp.

Here is the caller graph for this function:

◆ toUri()

auto Totp::toUri ( const Settings & settings ) -> QString

staticnodiscard

Serialise settings as a canonical otpauth URI.

Always emits secret, digits and period; emits issuer when it is set, algorithm only when it differs from the RFC 6238 default, and encoder=steam for Encoder::Steam.

Percent-encoding can make the URI longer than the configuration it was parsed from: for one near MAX_CONFIG_LENGTH, parse() refuses it, and normalize() returns nothing rather than such a URI.

Parameters

settings Validated settings.

Returns: An otpauth://totp/... URI.

Definition at line 263 of file totp.cpp.

Here is the call graph for this function:

Here is the caller graph for this function:

Member Data Documentation

◆ DEFAULT_DIGITS

uint Totp::DEFAULT_DIGITS = 6U

staticconstexpr

RFC 6238 default code length.

Definition at line 73 of file totp.h.

◆ DEFAULT_STEP

uint Totp::DEFAULT_STEP = 30U

staticconstexpr

RFC 6238 default period.

Definition at line 74 of file totp.h.

◆ MAX_CONFIG_LENGTH

qsizetype Totp::MAX_CONFIG_LENGTH = 4096

staticconstexpr

Longest configuration parse() takes: far beyond any real otpauth URI, short of what a compressed entry can expand to (millions of query parameters, each an object, before anything is checked).

Definition at line 82 of file totp.h.

◆ MAX_DIGITS

uint Totp::MAX_DIGITS = 10U

staticconstexpr

Upper clamp for digits.

Definition at line 77 of file totp.h.

◆ MAX_STEP

uint Totp::MAX_STEP = 86400U

staticconstexpr

Upper clamp for period.

Definition at line 78 of file totp.h.

◆ MIN_DIGITS

uint Totp::MIN_DIGITS = 1U

staticconstexpr

Lower clamp for digits.

Definition at line 76 of file totp.h.

◆ STEAM_DIGITS

uint Totp::STEAM_DIGITS = 5U

staticconstexpr

Steam codes are always 5 chars.

Definition at line 75 of file totp.h.

The documentation for this class was generated from the following files:

src/totp.h
src/totp.cpp

Classes

Public Types

Static Public Member Functions

Static Public Attributes

Private Member Functions

Detailed Description

Member Enumeration Documentation

◆ Algorithm

◆ Encoder

Member Function Documentation

◆ counter()

◆ currentUnixTime()

◆ generate()

◆ generateNow()

◆ isValid()

◆ normalize()

◆ parse()

◆ secondsRemaining()

◆ toUri()

Member Data Documentation

◆ DEFAULT_DIGITS

◆ DEFAULT_STEP

◆ MAX_CONFIG_LENGTH

◆ MAX_DIGITS

◆ MAX_STEP

◆ MIN_DIGITS

◆ STEAM_DIGITS