3

I want to create an HOTP client using javascript similar to SpeakEasy

The above library is intended for server side javascript usage and it uses NodeJS.

I want to do the same thing on front end javascript in a browser but I haven't been able to use CryptoJS to achieve this behavior. 

         var key = "abc";
         var counter = "123";

         // create an octet array from the counter
         var octet_array = new Array(8);

         var counter_temp = counter;

         for (var i = 0; i < 8; i++) {
             var i_from_right = 7 - i;

             // mask 255 over number to get last 8
             octet_array[i_from_right] = counter_temp & 255;

             // shift 8 and get ready to loop over the next batch of 8
             counter_temp = counter_temp >> 8;
         }

        // There is no such class called as Buffer on Browsers (its node js)
         var counter_buffer = new Buffer(octet_array);

         var hash = CryptoJS.HmacSHA1(key,counter_buffer);

         document.write("hex value "+ hash);
         document.write("hash value "+    CryptoJS.enc.Hex.stringify(hash));

I know this is possible on a native platform like java (android) or objective c (ios) Here is the corresponding implementation HOTP in Objective C but I doubt if it's possible to do on a web based front end.

Also, I highly doubt if such a thing is secure in browser because javascript is viewable from any browser. Any inputs suggestions would be useful. I am doing this for a POC. I am curious if anyone has used Hotp on web based platform.

4

2 回答 2

3

没有这样的语言支持代码中的二进制数据字符串。您需要将二进制数据编码为某种格式，例如 Hex 或 Base64，然后让 CryptoJS 将其解码为它自己的内部二进制格式，然后您可以将其传递给各种 CryptoJS 函数：

var wordArrayFromUtf = CryptoJS.enc.Utf8.parse("test");
var wordArrayFromHex = CryptoJS.enc.Hex.parse("74657374"); // "test"
var wordArrayFromB64 = CryptoJS.enc.Base64.parse("dGVzdA=="); // "test"

其他功能有：

wordArrayFromHex.toString(CryptoJS.enc.Utf8)  // "test"
CryptoJS.enc.Utf8.stringify(wordArrayFromB64) // "test"

如果你将一个字符串传递给一个 CrypoJS 函数（这里不是这些），它将被假定为一个 Utf8 编码的字符串。如果你不想这样，你需要自己解码。

于 2015-06-29T20:10:41.443 回答
1

http://caligatio.github.io/jsSHA/上的代码适用于SHA-512.

删除 .js 文件，在第 515 行查看它们的 test/test.html。它可能看起来像一个字符串，但它是二进制十六进制。

所以他们的输入是二进制的，这是正确的。不要挂断它坐在一根大绳子上的事实。

于 2015-06-29T20:31:08.507 回答