otp(n)

✨ NAME ✨

otp — One-Time Passwords 💖

(yes bestie, that's the Tcl manual page otp(n) from tcllib, and we're getting into it)

---

🌸 SYNOPSIS 🌸

package require Tcl 8.5 9

package require otp ?1.1.0?

::otp::otp-md4 ?-hex? ?-words? -seed seed -count count data

::otp::otp-md5 ?-hex? ?-words? -seed seed -count count data

::otp::otp-sha1 ?-hex? ?-words? -seed seed -count count data

::otp::otp-rmd160 ?-hex? ?-words? -seed seed -count count data

---

💖 DESCRIPTION 💖

Okay so, this package is a Tcl implementation of the One-Time Password system, exactly like RFC 2289 describes it (that's reference (1) down below, don't worry, we get there 🫶).

The whole vibe? It takes message-digest algorithms and sequentially hashes a passphrase to create single-use passwords. One and done. No reuse. Iconic behaviour honestly.

Then the resulting data gets handed to you either as hexadecimal digits or encoded using a dictionary of 2048 words. Yes, 2048. A whole dictionary. It's giving wordle but make it security 🔐

Where's this used fr fr? OpenBSD uses it for secure login, and it can also be used as a SASL mechanism for authenticating users. Main character energy across multiple platforms, we love to see it.

And in this implementation, we support four algorithms that ship inside the tcllib distribution:

• MD5 (2)
• MD4 (3)
• RIPE-MD160 (4)
• SHA-1 (5)

Four algorithms. Four besties. All slaying 💅

---

👑 COMMANDS 👑

Here's the full lineup, no gatekeeping:

::otp::otp-md4 ?-hex? ?-words? -seed seed -count count data

::otp::otp-md5 ?-hex? ?-words? -seed seed -count count data

::otp::otp-sha1 ?-hex? ?-words? -seed seed -count count data

::otp::otp-rmd160 ?-hex? ?-words? -seed seed -count count data

Quick rundown of the pieces you'll see in all four: -hex gets you the output as hexadecimal digits, -words gets you the output encoded with that 2048-word dictionary, -seed seed is your seed, -count count is your count, and data is the passphrase you're hashing. Every one of those four commands takes the same shape, just with a different digest algorithm underneath 💫

---

🎀 EXAMPLES 🎀

Not me giving you receipts, but here's literally what it looks like in action:

% otp::otp-md5 -count 99 -seed host67821 "My Secret Pass Phrase"
(binary gibberish)

Yeah so that one just dumps raw bytes at you and it's giving chaos 😭 (that's what the original says, (binary gibberish), and honestly same).

Now watch the glow-up with -words:

% otp::otp-md5 -words -count 99 -seed host67821 "My Secret Pass Phrase"
SOON ARAB BURG LIMB FILE WAD

SOON ARAB BURG LIMB FILE WAD. That's a whole sentence and it's a password. Ate. 🔥

And with -hex:

% otp::otp-md5 -hex -count 99 -seed host67821 "My Secret Pass Phrase"
e249b58257c80087

e249b58257c80087 — clean, compact, hex girl summer 💅

---

🦋 REFERENCES 🦋

The receipts, in order, because we cite our sources in this house:

• [1] Haller, N. et al., "A One-Time Password System", RFC 2289, February 1998. http://www.rfc-editor.org/rfc/rfc2289.txt
• [2] Rivest, R., "The MD5 Message-Digest Algorithm", RFC 1321, MIT and RSA Data Security, Inc, April 1992. (http://www.rfc-editor.org/rfc/rfc1321.txt)
• [3] Rivest, R., "The MD4 Message Digest Algorithm", RFC 1320, MIT, April 1992. (http://www.rfc-editor.org/rfc/rfc1320.txt)
• [4] H. Dobbertin, A. Bosselaers, B. Preneel, "RIPEMD-160, a strengthened version of RIPEMD" http://www.esat.kuleuven.ac.be/~cosicart/pdf/AB-9601/AB-9601.pdf
• [5] "Secure Hash Standard", National Institute of Standards and Technology, U.S. Department Of Commerce, April 1995. (http://www.itl.nist.gov/fipspubs/fip180-1.htm)

---

💅 BUGS, IDEAS, FEEDBACK 💅

Okay bestie, real talk, and I'm saying this with love:

This document, and the package it describes, will undoubtedly contain bugs and other problems.

Undoubtedly. The manpage said it, not me 🙈 No piece of software is safe from a little chaos.

So if you find one, please report it in the category otp of the Tcllib Trackers at http://core.tcl.tk/tcllib/reportlist. And if you've got ideas for enhancements — for the package, for the docs, either, both, whatever — report those too. We want them. All of them. ✨

When you're proposing code changes, please provide unified diffs, i.e. the output of diff -u. That's the format. That's the one. Don't freestyle it.

Also, note further that attachments are strongly preferred over inlined patches. You can attach stuff by going to the Edit form of the ticket immediately after its creation, and then using the left-most button in the secondary navigation bar. That's the move. Periodt.

---

🌈 SEE ALSO 🌈

Your little rabbit hole, go explore:

• SASL
• md4
• md5
• ripemd160
• sha1

---

⭐ KEYWORDS ⭐

• hashing
• message-digest
• password
• rfc 2289
• security

---

🍓 CATEGORY 🍓

• Hashes, checksums, and encryption

---

💜 COPYRIGHT 💜

Copyright (c) 2006, Pat Thoyts <patthoyts@users.sourceforge.net>

---

and that's the whole page, bestie 🫶 this was tcllib version 1.1.0, the otp(n) manual, and you absolutely understood all of it. go hash something. one time only tho. 💖✨🎀