• Google身份验证器Google Authenticator的java服务端实现

    Google身份验证器Google Authenticator是谷歌推出的一款基于时间与哈希的一次性密码算法的两步验证软件令牌，此软件用于Google的认证服务。此项服务所使用的算法已列于RFC 6238和RFC 4226中。谷歌验证器上的动态密码按照时间或使用次数不断动态变化（默认30秒变更一次）。

    在本实现demo中，注释说明非常详尽，可供参考，如遇问题欢迎可以留言沟通。

    废话不多说，直接上代码，本次代码尽可能简单，最简单的结构附图

    1. package com.wuge.google;
    2.  
    3. import org.apache.commons.codec.binary.Base32;
    4. import org.apache.commons.codec.binary.Hex;
    5. import org.springframework.util.StringUtils;
    6.  
    7. import javax.crypto.Mac;
    8. import javax.crypto.spec.SecretKeySpec;
    9. import java.io.UnsupportedEncodingException;
    10. import java.net.URLEncoder;
    11. import java.security.InvalidKeyException;
    12. import java.security.NoSuchAlgorithmException;
    13. import java.security.SecureRandom;
    14.  
    15. /**
    16.  * 谷歌身份验证器工具类
    17.  *
    18.  * @author wuge
    19.  */
    20. public class GoogleAuthenticator {
    21.  
    22.     /**
    23.      * 时间前后偏移量
    24.      * 用于防止客户端时间不精确导致生成的TOTP与服务器端的TOTP一直不一致
    25.      * 如果为0,当前时间为 10:10:15
    26.      * 则表明在 10:10:00-10:10:30 之间生成的TOTP 能校验通过
    27.      * 如果为1,则表明在
    28.      * 10:09:30-10:10:00
    29.      * 10:10:00-10:10:30
    30.      * 10:10:30-10:11:00 之间生成的TOTP 能校验通过
    31.      * 以此类推
    32.      */
    33.     private static int WINDOW_SIZE = 0;
    34.  
    35.     /**
    36.      * 加密方式，HmacSHA1、HmacSHA256、HmacSHA512
    37.      */
    38.     private static final String CRYPTO = "HmacSHA1";
    39.  
    40.     /**
    41.      * 生成密钥，每个用户独享一份密钥
    42.      *
    43.      * @return
    44.      */
    45.     public static String getSecretKey() {
    46.         SecureRandom random = new SecureRandom();
    47.         byte[] bytes = new byte[20];
    48.         random.nextBytes(bytes);
    49.         Base32 base32 = new Base32();
    50.         String secretKey = base32.encodeToString(bytes);
    51.         // make the secret key more human-readable by lower-casing and
    52.         // inserting spaces between each group of 4 characters
    53.         return secretKey.toUpperCase();
    54.     }
    55.  
    56.     /**
    57.      * 生成二维码内容
    58.      *
    59.      * @param secretKey 密钥
    60.      * @param account   账户名
    61.      * @param issuer    网站地址（可不写）
    62.      * @return
    63.      */
    64.     public static String getQrCodeText(String secretKey, String account, String issuer) {
    65.         String normalizedBase32Key = secretKey.replace(" ", "").toUpperCase();
    66.         try {
    67.             return "otpauth://totp/"
    68.                     + URLEncoder.encode((!StringUtils.isEmpty(issuer) ? (issuer + ":") : "") + account, "UTF-8").replace("+", "%20")
    69.                     + "?secret=" + URLEncoder.encode(normalizedBase32Key, "UTF-8").replace("+", "%20")
    70.                     + (!StringUtils.isEmpty(issuer) ? ("&issuer=" + URLEncoder.encode(issuer, "UTF-8").replace("+", "%20")) : "");
    71.         } catch (UnsupportedEncodingException e) {
    72.             throw new IllegalStateException(e);
    73.         }
    74.     }
    75.  
    76.     /**
    77.      * 获取验证码
    78.      *
    79.      * @param secretKey
    80.      * @return
    81.      */
    82.     public static String getCode(String secretKey) {
    83.         String normalizedBase32Key = secretKey.replace(" ", "").toUpperCase();
    84.         Base32 base32 = new Base32();
    85.         byte[] bytes = base32.decode(normalizedBase32Key);
    86.         String hexKey = Hex.encodeHexString(bytes);
    87.         long time = (System.currentTimeMillis() / 1000) / 30;
    88.         String hexTime = Long.toHexString(time);
    89.         return TOTP.generateTOTP(hexKey, hexTime, "6", CRYPTO);
    90.     }
    91.  
    92.     /**
    93.      * 检验 code 是否正确
    94.      *
    95.      * @param secret 密钥
    96.      * @param code   code
    97.      * @param time   时间戳
    98.      * @return
    99.      */
    100.     public static boolean checkCode(String secret, long code, long time) {
    101.         Base32 codec = new Base32();
    102.         byte[] decodedKey = codec.decode(secret);
    103.         // convert unix msec time into a 30 second "window"
    104.         // this is per the TOTP spec (see the RFC for details)
    105.         long t = (time / 1000L) / 30L;
    106.         // Window is used to check codes generated in the near past.
    107.         // You can use this value to tune how far you're willing to go.
    108.         long hash;
    109.         for (int i = -WINDOW_SIZE; i <= WINDOW_SIZE; ++i) {
    110.             try {
    111.                 hash = verifyCode(decodedKey, t + i);
    112.             } catch (Exception e) {
    113.                 // Yes, this is bad form - but
    114.                 // the exceptions thrown would be rare and a static
    115.                 // configuration problem
    116.                 // e.printStackTrace();
    117.                 throw new RuntimeException(e.getMessage());
    118.             }
    119.             if (hash == code) {
    120.                 return true;
    121.             }
    122.         }
    123.         return false;
    124.     }
    125.  
    126.     /**
    127.      * 根据时间偏移量计算
    128.      *
    129.      * @param key
    130.      * @param t
    131.      * @return
    132.      * @throws NoSuchAlgorithmException
    133.      * @throws InvalidKeyException
    134.      */
    135.     private static long verifyCode(byte[] key, long t) throws NoSuchAlgorithmException, InvalidKeyException {
    136.         byte[] data = new byte[8];
    137.         long value = t;
    138.         for (int i = 8; i-- > 0; value >>>= 8) {
    139.             data[i] = (byte) value;
    140.         }
    141.         SecretKeySpec signKey = new SecretKeySpec(key, CRYPTO);
    142.         Mac mac = Mac.getInstance(CRYPTO);
    143.         mac.init(signKey);
    144.         byte[] hash = mac.doFinal(data);
    145.         int offset = hash[20 - 1] & 0xF;
    146.         // We're using a long because Java hasn't got unsigned int.
    147.         long truncatedHash = 0;
    148.         for (int i = 0; i < 4; ++i) {
    149.             truncatedHash <<= 8;
    150.             // We are dealing with signed bytes:
    151.             // we just keep the first byte.
    152.             truncatedHash |= (hash[offset + i] & 0xFF);
    153.         }
    154.         truncatedHash &= 0x7FFFFFFF;
    155.         truncatedHash %= 1000000;
    156.         return truncatedHash;
    157.     }
    158.  
    159.     public static void main(String[] args) {
    160.         for (int i = 0; i < 100; i++) {
    161.             String secretKey = getSecretKey();
    162.             System.out.println("secretKey：" + secretKey);
    163.             String code = getCode(secretKey);
    164.             System.out.println("code：" + code);
    165.             boolean b = checkCode(secretKey, Long.parseLong(code), System.currentTimeMillis());
    166.             System.out.println("isSuccess：" + b);
    167.         }
    168.     }
    169. }
    1. package com.wuge.google;
    2.  
    3. import javax.crypto.Mac;
    4. import javax.crypto.spec.SecretKeySpec;
    5. import java.lang.reflect.UndeclaredThrowableException;
    6. import java.math.BigInteger;
    7. import java.security.GeneralSecurityException;
    8.  
    9. /**
    10.  * 验证码生成工具类
    11.  *
    12.  * @author wuge
    13.  */
    14. public class TOTP {
    15.  
    16.     private static final int[] DIGITS_POWER = {1, 10, 100, 1000, 10000, 100000, 1000000, 10000000, 100000000};
    17.  
    18.     /**
    19.      * This method uses the JCE to provide the crypto algorithm. HMAC computes a
    20.      * Hashed Message Authentication Code with the crypto hash algorithm as a
    21.      * parameter.
    22.      *
    23.      * @param crypto   : the crypto algorithm (HmacSHA1, HmacSHA256, HmacSHA512)
    24.      * @param keyBytes : the bytes to use for the HMAC key
    25.      * @param text     : the message or text to be authenticated
    26.      */
    27.     private static byte[] hmac_sha(String crypto, byte[] keyBytes, byte[] text) {
    28.         try {
    29.             Mac hmac;
    30.             hmac = Mac.getInstance(crypto);
    31.             SecretKeySpec macKey = new SecretKeySpec(keyBytes, "RAW");
    32.             hmac.init(macKey);
    33.             return hmac.doFinal(text);
    34.         } catch (GeneralSecurityException gse) {
    35.             throw new UndeclaredThrowableException(gse);
    36.         }
    37.     }
    38.  
    39.     /**
    40.      * This method converts a HEX string to Byte[]
    41.      *
    42.      * @param hex : the HEX string
    43.      * @return: a byte array
    44.      */
    45.     private static byte[] hexStr2Bytes(String hex) {
    46.         // Adding one byte to get the right conversion
    47.         // Values starting with "0" can be converted
    48.         byte[] bArray = new BigInteger("10" + hex, 16).toByteArray();
    49.  
    50.         // Copy all the REAL bytes, not the "first"
    51.         byte[] ret = new byte[bArray.length - 1];
    52.         System.arraycopy(bArray, 1, ret, 0, ret.length);
    53.         return ret;
    54.     }
    55.  
    56.     /**
    57.      * This method generates a TOTP value for the given set of parameters.
    58.      *
    59.      * @param key          : the shared secret, HEX encoded
    60.      * @param time         : a value that reflects a time
    61.      * @param returnDigits : number of digits to return
    62.      * @param crypto       : the crypto function to use
    63.      * @return: a numeric String in base 10 that includes
    64.      */
    65.     public static String generateTOTP(String key, String time, String returnDigits, String crypto) {
    66.         int codeDigits = Integer.decode(returnDigits);
    67.         String result = null;
    68.  
    69.         // Using the counter
    70.         // First 8 bytes are for the movingFactor
    71.         // Compliant with base RFC 4226 (HOTP)
    72.         while (time.length() < 16) {
    73.             time = "0" + time;
    74.         }
    75.  
    76.         // Get the HEX in a Byte[]
    77.         byte[] msg = hexStr2Bytes(time);
    78.         byte[] k = hexStr2Bytes(key);
    79.         byte[] hash = hmac_sha(crypto, k, msg);
    80.  
    81.         // put selected bytes into result int
    82.         int offset = hash[hash.length - 1] & 0xf;
    83.  
    84.         int binary = ((hash[offset] & 0x7f) << 24)
    85.                 | ((hash[offset + 1] & 0xff) << 16)
    86.                 | ((hash[offset + 2] & 0xff) << 8) | (hash[offset + 3] & 0xff);
    87.  
    88.         int otp = binary % DIGITS_POWER[codeDigits];
    89.  
    90.         result = Integer.toString(otp);
    91.         while (result.length() < codeDigits) {
    92.             result = "0" + result;
    93.         }
    94.         return result;
    95.     }
    96. }
    1. package com.wuge;
    2.  
    3. import com.wuge.google.GoogleAuthenticator;
    4. import org.iherus.codegen.qrcode.SimpleQrcodeGenerator;
    5. import org.springframework.boot.SpringApplication;
    6. import org.springframework.boot.autoconfigure.SpringBootApplication;
    7. import org.springframework.web.bind.annotation.GetMapping;
    8. import org.springframework.web.bind.annotation.RequestParam;
    9. import org.springframework.web.bind.annotation.RestController;
    10.  
    11. import javax.servlet.http.HttpServletResponse;
    12.  
    13. /**
    14.  * 项目启动类
    15.  *
    16.  * @author wuge
    17.  */
    18. @RestController
    19. @SpringBootApplication
    20. public class Application {
    21.  
    22.     private static String SECRET_KEY = "";
    23.  
    24.     public static void main(String[] args) {
    25.         SpringApplication.run(Application.class, args);
    26.     }
    27.  
    28.     /**
    29.      * 生成 Google 密钥，两种方式任选一种
    30.      */
    31.     @GetMapping("getSecretKey")
    32.     public String getSecretKey() {
    33.         String secretKey = GoogleAuthenticator.getSecretKey();
    34.         SECRET_KEY = secretKey;
    35.         return secretKey;
    36.     }
    37.  
    38.     /**
    39.      * 生成二维码，APP直接扫描绑定，两种方式任选一种
    40.      */
    41.     @GetMapping("getQrcode")
    42.     public void getQrcode(@RequestParam("name") String name, HttpServletResponse response) throws Exception {
    43.         String secretKey = GoogleAuthenticator.getSecretKey();
    44.         SECRET_KEY = secretKey;
    45.         // 生成二维码内容
    46.         String qrCodeText = GoogleAuthenticator.getQrCodeText(secretKey, name, "");
    47.         // 生成二维码输出
    48.         new SimpleQrcodeGenerator().generate(qrCodeText).toStream(response.getOutputStream());
    49.     }
    50.  
    51.     /**
    52.      * 获取code
    53.      */
    54.     @GetMapping("getCode")
    55.     public String getCode() {
    56.         return GoogleAuthenticator.getCode(SECRET_KEY);
    57.     }
    58.  
    59.     /**
    60.      * 验证 code 是否正确
    61.      */
    62.     @GetMapping("checkCode")
    63.     public Boolean checkCode(@RequestParam("code") String code) {
    64.         return GoogleAuthenticator.checkCode(SECRET_KEY, Long.parseLong(code), System.currentTimeMillis());
    65.     }
    66. }
    1. "1.0" encoding="UTF-8"?>
    2. <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    3.          xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
    4.     <modelVersion>4.0.0modelVersion>
    5.     <parent>
    6.         <groupId>org.springframework.bootgroupId>
    7.         <artifactId>spring-boot-starter-parentartifactId>
    8.         <version>2.3.1.RELEASEversion>
    9.         <relativePath/>
    10.     parent>
    11.  
    12.     <repositories>
    13.         
    14.         <repository>
    15.             <id>aliyunid>
    16.             <name>aliyun Repositoryname>
    17.             <url>http://maven.aliyun.com/nexus/content/groups/publicurl>
    18.             <snapshots>
    19.                 <enabled>falseenabled>
    20.             snapshots>
    21.         repository>
    22.     repositories>
    23.  
    24.     <groupId>com.asurplusgroupId>
    25.     <artifactId>asurplusartifactId>
    26.     <version>0.0.1-SNAPSHOTversion>
    27.     <name>asurplusname>
    28.     <description>Google身份验证器description>
    29.  
    30.     <properties>
    31.         <project.reporting.outputEncoding>UTF-8project.reporting.outputEncoding>
    32.         <project.build.sourceEncoding>UTF-8project.build.sourceEncoding>
    33.         <java.version>1.8java.version>
    34.         <codec.version>1.15codec.version>
    35.         <qrext4j.version>1.3.1qrext4j.version>
    36.     properties>
    37.  
    38.     <dependencies>
    39.         
    40.         <dependency>
    41.             <groupId>org.springframework.bootgroupId>
    42.             <artifactId>spring-boot-starter-webartifactId>
    43.         dependency>
    44.         
    45.         
    46.         <dependency>
    47.             <groupId>commons-codecgroupId>
    48.             <artifactId>commons-codecartifactId>
    49.             <version>${codec.version}version>
    50.         dependency>
    51.         
    52.         <dependency>
    53.             <groupId>org.iherusgroupId>
    54.             <artifactId>qrext4jartifactId>
    55.             <version>${qrext4j.version}version>
    56.         dependency>
    57.     dependencies>
    58.  
    59.     <build>
    60.         <finalName>google-authfinalName>
    61.         <plugins>
    62.             <plugin>
    63.                 <groupId>org.springframework.bootgroupId>
    64.                 <artifactId>spring-boot-maven-pluginartifactId>
    65.             plugin>
    66.         plugins>
    67.     build>
    68.  
    69. project>

  • 相关阅读:
    Swoole 4.8版本的安装
    人工智能基础 作业6
    python爬虫入门（六）BeautifulSoup使用
    天津工业大学计算机考研资料汇总
    GaussDB(分布式)实例故障处理
    《重构改善代码设计》
    MacOS怎么安装Nacos（附带：Windows系统）
    C++异步并发编程future、promise和packaged_task三者的区别和联系
    设计模式 -- 状态模式（State Pattern）
    [含lw+源码等]微信小程序家政预约系统+后台管理系统[包运行成功]
  • 原文地址：https://blog.csdn.net/wuge507639721/article/details/134514462