TwoStepsAuthenticator

.net implementation of the TOTP: Time-Based One-Time Password Algorithm and HOTP: HMAC-Based One-Time Password Algorithm
RFC 6238 http://tools.ietf.org/html/rfc6238
RFC 4226 http://tools.ietf.org/html/rfc4226

Compatible with Microsoft Authenticator for Windows Phone, and Google Authenticator for Android and iPhone.

You can use this library as well for a client application (if you want to create your own authenticator) or for a server application (add two-step authentication on your asp.net website)

Install using Nuget

To install TwoStepsAuthenticator, run the following command in the Package Manager Console

Install-Package TwoStepsAuthenticator

TOTP

Client usage

For a client application, you need to save the secret key for your user.
Then, you only have to call the method GetCode(string) :

var secret = user.secretAuthToken;
var authenticator = new TwoStepsAuthenticator.TimeAuthenticator();
var code = authenticator.GetCode(secret);

Server usage

On a server application, you will have to generate a secret key, and share it with the user, who will have to enter it in his own authenticator app.

var key = TwoStepsAuthenticator.Authenticator.GenerateKey();

When the user will login, he will have to give you the code generated by his authenticator.
You can check if the code is correct with the method CheckCode(string secret, string code).
If the code is incorrect, don't log him.

var secret = user.secretAuthToken;
var code = Request.Form["code"];
var authenticator = new TwoStepsAuthenticator.TimeAuthenticator();
bool isok = authenticator.CheckCode(secret, code);

Used codes manager

Every code should only be used once. To prevent repeated use of a code a IUsedCodesManager interface is provided.

A default implementation is provided : used codes are kept in memory for 5 minutes (long enough for codes to become invalid)

You can define how the used codes are stored, for example if you want to handle persistence (database storage), or if you have multiple webservers.
You have to implement the 2 methods of the IUsedCodesManager :

void AddCode(ulong challenge, string code, object user);
bool IsCodeUsed(ulong challenge, string code, object user);

The user class must implement correctly the GetHashCode and Equals methods, because they are used to check if a specific user has used each code.

When you create a new Authenticator, add the instance of your IUsedCodesManager as the first param

var usedCodeManager = new CustomUsedCodeManager();
var authenticator = new TwoStepsAuthenticator.TimeAuthenticator(usedCodeManager);

And when you check if the code is ok, you need to add the user object to the CheckCode method

bool isok = authenticator.CheckCode(secret, code, user);

HOTP

With the HOTP authenticator, the user has an ordered list of codes, and he uses them one by one. When a code is used, all the previous codes are disabled.

On a server application, you will generate a secret key, and you need to store for every user its secret key and the index of the last code used.

var key = TwoStepsAuthenticator.Authenticator.GenerateKey();

When the user sends his code, you need to check if it is valid, and is after the last code used. The CheckCode method will check the 10 folloing codes, and return the id of the code used.

var secret = user.secretAuthToken;
var lastCodeUsed = user.lastCodeUsed;
var code = Request.Form["code"];
var authenticator = new TwoStepsAuthenticator.CounterAuthenticator();
ulong newCodeUsed;
bool isok = authenticator.CheckCode(secret, code, lastCodeUsed, out newCodeUsed);

if (isOk) {
    user.lastCodeUsed = newCodeUsed;
}

If you want to generate the codes, you can use the method GetCode(string secret, ulong counter)

var nextCodes = new List<strig>();
var secret = user.secretAuthToken;
var lastCodeUsed = user.lastCodeUsed;
var authenticator = new TwoStepsAuthenticator.CounterAuthenticator();
for (int i = lastCodeUsed + 1 ; i < lastCodeUsed + 100 ; i++){
    nextCodes.Add(authenticator.GetCode(secret, i));
}