oath_hotp_validate_callback(3)

📦
version 2.6.15 · 5 versions
, in arch rolling, nixpkgs unstable

💅 oath_hotp_validate_callback(3) — liboath bestie energy ✨

🦋 NAME 🦋

oath_hotp_validate_callback — API function. That’s the official name-card vibe, no cap. 🫶

✨ SYNOPSIS ✨

#include <oath.h>

int oath_hotp_validate_callback(const char * secret, size_t
secret_length, uint64_t start_moving_factor, size_t window, unsigned
digits, oath_validate_strcmp_function strcmp_otp, void * strcmp_handle);

🌸 ARGUMENTS 🌸

  • const char * secret — the shared secret string. Your little secret, but make it cryptographic. 🔐
  • size_t secret_length — length of secret. Gotta know how long the secret is, bestie.
  • uint64_t start_moving_factor — start counter in OTP stream. This is where the OTP party starts. 🎉
  • size_t window — how many OTPs after start counter to test. Basically how far past the start we’re searching. 👀
  • unsigned digits — number of requested digits in the OTP. Digits matter, periodt.
  • oath_validate_strcmp_function strcmp_otp — function pointer to a strcmp-like function. It’s giving custom comparison realness. 💅
  • void * strcmp_handle — caller handle to be passed on to strcmp_otp. Your lil’ carry-on bag for the callback. 🎀

💖 DESCRIPTION 💖

Okay so this function validates an OTP according to the OATH HOTP algorithm per RFC 4226. Very secure, very demure. ✨

Validation is implemented by generating a number of potential OTPs and performing a call to the strcmp_otp function, to compare the potential OTP against the given otp. It has the following prototype:

int (*oath_validate_strcmp_function) (void *handle, const char
*test_otp);

The function should be similar to strcmp in that it returns 0 only on matches. It differs by permitting use of negative return codes as indication of internal failures in the callback. Positive values indicate OTP mismatch. So like: 0 = slay, positive = nope, negative = something went off in the callback. 😭

This callback interface is useful when you cannot compare OTPs directly using normal strcmp, but instead for example only have a hashed OTP. You would then typically pass in the hashed OTP in the strcmp_handle and let your implementation of strcmp_otp hash the test_otp OTP using the same hash, and then compare the results. Hashed-OTP besties, this one’s for you. 🧚

Currently only OTP lengths of 6, 7 or 8 digits are supported. These restrictions may be lifted in future versions, although some limitations are inherent in the protocol. So don’t come at it with a 4-digit OTP and expect main character energy. 💀

🎀 RETURNS 🎀

Returns position in OTP window (zero is first position), or OATH_INVALID_OTP if no OTP was found in OTP window, or an error code. That’s the whole mood. 👑

⭐ SINCE ⭐

1.4.0 — been iconic since then, fr fr. 💖

😭 REPORTING BUGS 😭

Report bugs to <oath-toolkit-help@nongnu.org>. liboath home page: https://oath-toolkit.codeberg.page/ General help using GNU software: http://www.gnu.org/gethelp/

Spotted something weird? Spill to the bug inbox, bestie. 🫶

Copyright © 2009-2026 Simon Josefsson.

Copying and distribution of this file, with or without modification, are permitted in any medium without royalty provided the copyright notice and this notice are preserved.

bye bestie 🫶 — this page is from liboath version 2.6.15, for oath_hotp_validate_callback(3), and the copyright years are 2009-2026. Now go validate those OTPs, periodt. 💖

📦 where this page comes from