otp(3tcl)

💖 otp — One-Time Passwords 💖

okay bestie, welcome to otp(3tcl) — the Tcl page for RFC 2289 A One-Time Password System. yes, that's the whole vibe. let's get into it 🫶

---

✨ NAME ✨

otp — One-Time Passwords 💅

---

🎀 SYNOPSIS 🎀

package require Tcl 8.5 9

package require otp ?1.1.0?

::otp::otp-md4 ?-hex? ?-words? -seed seed -count count data

::otp::otp-md5 ?-hex? ?-words? -seed seed -count count data

::otp::otp-sha1 ?-hex? ?-words? -seed seed -count count data

::otp::otp-rmd160 ?-hex? ?-words? -seed seed -count count data

look at those question marks, they're doing so much heavy lifting — optional args, iconic behaviour, no notes. ✨

---

🦋 DESCRIPTION 🦋

So basically, this package is a Tcl implementation of the One-Time Password system as described in RFC 2289 (1). 💖

The way it works? It uses message-digest algorithms to sequentially hash a passphrase and cook up single-use passwords. Then it hands the resulting data to the user in one of two formats:

• as hexadecimal digits, or
• encoded using a dictionary of 2048 words 🍓

This system is used by OpenBSD for secure login, and it can also be used as a SASL mechanism for authenticating users. slay, honestly. 👑

In this implementation we support four algorithms that ship inside the tcllib distribution:

1. MD5 (2)
2. MD4 (3)
3. RIPE-MD160 (4)
4. SHA-1 (5)

---

💅 COMMANDS 💅

here's the roster, bestie — four functions, all built the same way:

• ::otp::otp-md4 ?-hex? ?-words? -seed seed -count count data — the MD4 flavoured one 🌸
• ::otp::otp-md5 ?-hex? ?-words? -seed seed -count count data — the MD5 flavoured one ✨
• ::otp::otp-sha1 ?-hex? ?-words? -seed seed -count count data — the SHA-1 flavoured one 🦋
• ::otp::otp-rmd160 ?-hex? ?-words? -seed seed -count count data — the RIPE-MD160 flavoured one 💜

note how -seed and -count are not in optional brackets. they're required. you don't get to skip them. periodt. 🙈

---

🌈 EXAMPLES 🌈

no -words, no -hex? you get the raw bytes, and they are not giving readable:

% otp::otp-md5 -count 99 -seed host67821 "My Secret Pass Phrase"
(binary gibberish)

want the cute word list version? say the word:

% otp::otp-md5 -words -count 99 -seed host67821 "My Secret Pass Phrase"
SOON ARAB BURG LIMB FILE WAD

want hex instead? say less:

% otp::otp-md5 -hex -count 99 -seed host67821 "My Secret Pass Phrase"
e249b58257c80087

same seed, same count, same passphrase, three whole different outfits. obsessed. 🎀

---

📚 REFERENCES 📚

• [1] Haller, N. et al., "A One-Time Password System", RFC 2289, February 1998. http://www.rfc-editor.org/rfc/rfc2289.txt
• [2] Rivest, R., "The MD5 Message-Digest Algorithm", RFC 1321, MIT and RSA Data Security, Inc, April 1992. (http://www.rfc-editor.org/rfc/rfc1321.txt)
• [3] Rivest, R., "The MD4 Message Digest Algorithm", RFC 1320, MIT, April 1992. (http://www.rfc-editor.org/rfc/rfc1320.txt)
• [4] H. Dobbertin, A. Bosselaers, B. Preneel, "RIPEMD-160, a strengthened version of RIPEMD" http://www.esat.kuleuven.ac.be/~cosicart/pdf/AB-9601/AB-9601.pdf
• [5] "Secure Hash Standard", National Institute of Standards and Technology, U.S. Department Of Commerce, April 1995. (http://www.itl.nist.gov/fipspubs/fip180-1.htm)

---

😭 BUGS, IDEAS, FEEDBACK 😭

ngl, this document and the package it describes will undoubtedly contain bugs and other problems. it's giving "we know". 💀

Please report such in the category otp of the Tcllib Trackers [http://core.tcl.tk/tcllib/reportlist]. Please also report any ideas for enhancements you may have for either package and/or documentation. we want them fr fr 🫶

When proposing code changes, please provide unified diffs, i.e the output of diff -u. ✨

Note further that attachments are strongly preferred over inlined patches. Attachments can be made by going to the Edit form of the ticket immediately after its creation, and then using the left-most button in the secondary navigation bar. 👑

---

👀 SEE ALSO 👀

SASL, md4, md5, ripemd160, sha1

---

⭐ KEYWORDS ⭐

hashing, message-digest, password, rfc 2289, security

---

🌸 CATEGORY 🌸

Hashes, checksums, and encryption

---

💜 COPYRIGHT 💜

Copyright (c) 2006, Pat Thoyts <patthoyts@users.sourceforge.net>

---

and that's the whole page, bestie!! 🎀 this was brought to you by the fine folks over at tcllib, version 1.1.0, and it's the otp(3tcl) page — go forth and hash responsibly, ily 💖✨🦋