php整合動態口令認證_php實例
大多數系統目前均使用的靜態密碼進行身份認證登錄,但由於靜態密碼容易被竊取,其安全性無法滿足安全要求。
動態口令採用一次一密、用過密碼作廢的方式防止了密碼被竊取帶來的安全問題。
動態口令分為HOTP(基於事件計數的動態口令,RFC4226)、TOTP(基於時間計數的動態口令,RFC6238)、OCRA(挑戰應答式動態口令,RFC6287)等方式。
本文介紹了整合TOTP方式的動態口令認證的方案,PHP框架採用Thinkphp3.2.3,動態口令產生器使用的是google authtication。
1、為Thinkphp框架添加oath演算法類別
oath演算法封裝類別oath.php程式碼如下:
<?PHP /** * This program is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program. If not, see <http://www.gnu.org/licenses/>. * * PHP Google two-factor authentication module. * * See http://www.idontplaydarts.com/2011/07/google-totp-two-factor-authentication-for-php/ * for more details * * @author Phil **/ class Google2FA { const keyRegeneration = 30; // Interval between key regeneration const otpLength = 6; // Length of the Token generated private static $lut = array( // Lookup needed for Base32 encoding "A" => 0, "B" => 1, "C" => 2, "D" => 3, "E" => 4, "F" => 5, "G" => 6, "H" => 7, "I" => 8, "J" => 9, "K" => 10, "L" => 11, "M" => 12, "N" => 13, "O" => 14, "P" => 15, "Q" => 16, "R" => 17, "S" => 18, "T" => 19, "U" => 20, "V" => 21, "W" => 22, "X" => 23, "Y" => 24, "Z" => 25, "2" => 26, "3" => 27, "4" => 28, "5" => 29, "6" => 30, "7" => 31 ); /** * Generates a 16 digit secret key in base32 format * @return string **/ public static function generate_secret_key($length = 16) { $b32 = "234567QWERTYUIOPASDFGHJKLZXCVBNM"; $s = ""; for ($i = 0; $i < $length; $i++) $s .= $b32[rand(0,31)]; return $s; } /** * Returns the current Unix Timestamp devided by the keyRegeneration * period. * @return integer **/ public static function get_timestamp() { return floor(microtime(true)/self::keyRegeneration); } /** * Decodes a base32 string into a binary string. **/ public static function base32_decode($b32) { $b32 = strtoupper($b32); if (!preg_match('/^[ABCDEFGHIJKLMNOPQRSTUVWXYZ234567]+$/', $b32, $match)) throw new Exception('Invalid characters in the base32 string.'); $l = strlen($b32); $n = 0; $j = 0; $binary = ""; for ($i = 0; $i < $l; $i++) { $n = $n << 5; // Move buffer left by 5 to make room $n = $n + self::$lut[$b32[$i]]; // Add value into buffer $j = $j + 5; // Keep track of number of bits in buffer if ($j >= 8) { $j = $j - 8; $binary .= chr(($n & (0xFF << $j)) >> $j); } } return $binary; } /*by tang*/ public static function base32_encode($data, $length){ $basestr = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567"; $count = 0; if ($length > 0) { $buffer = $data[0]; $next = 1; $bitsLeft = 8; while (($bitsLeft > 0 || $next < $length)) { if ($bitsLeft < 5) { if ($next < $length) { $buffer <<= 8; $buffer |= $data[$next++] & 0xFF; $bitsLeft += 8; } else { $pad = 5 - $bitsLeft; $buffer <<= $pad; $bitsLeft += $pad; } } $index = 0x1F & ($buffer >> ($bitsLeft - 5)); $bitsLeft -= 5; $result .= $basestr[$index]; $count++; } } return $result; } /** * Takes the secret key and the timestamp and returns the one time * password. * * @param binary $key - Secret key in binary form. * @param integer $counter - Timestamp as returned by get_timestamp. * @return string **/ public static function oath_hotp($key, $counter) { if (strlen($key) < 8) throw new Exception('Secret key is too short. Must be at least 16 base 32 characters'); $bin_counter = pack('N*', 0) . pack('N*', $counter); // Counter must be 64-bit int $hash = hash_hmac ('sha1', $bin_counter, $key, true); return str_pad(self::oath_truncate($hash), self::otpLength, '0', STR_PAD_LEFT); } /** * Verifys a user inputted key against the current timestamp. Checks $window * keys either side of the timestamp. * * @param string $b32seed * @param string $key - User specified key * @param integer $window * @param boolean $useTimeStamp * @return boolean **/ public static function verify_key($b32seed, $key, $window = 5, $useTimeStamp = true) { $timeStamp = self::get_timestamp(); if ($useTimeStamp !== true) $timeStamp = (int)$useTimeStamp; $binarySeed = self::base32_decode($b32seed); for ($ts = $timeStamp - $window; $ts <= $timeStamp + $window; $ts++) if (self::oath_hotp($binarySeed, $ts) == $key) return true; return false; } /** * Extracts the OTP from the SHA1 hash. * @param binary $hash * @return integer **/ public static function oath_truncate($hash) { $offset = ord($hash[19]) & 0xf; return ( ((ord($hash[$offset+0]) & 0x7f) << 24 ) | ((ord($hash[$offset+1]) & 0xff) << 16 ) | ((ord($hash[$offset+2]) & 0xff) << 8 ) | (ord($hash[$offset+3]) & 0xff) ) % pow(10, self::otpLength); } } /* $InitalizationKey = "LFLFMU2SGVCUIUCZKBMEKRKLIQ"; // Set the inital key $TimeStamp = Google2FA::get_timestamp(); $secretkey = Google2FA::base32_decode($InitalizationKey); // Decode it into binary $otp = Google2FA::oath_hotp($secretkey, $TimeStamp); // Get current token echo("Init key: $InitalizationKey\n"); echo("Timestamp: $TimeStamp\n"); echo("One time password: $otp\n"); // Use this to verify a key as it allows for some time drift. $result = Google2FA::verify_key($InitalizationKey, "123456"); var_dump($result); */ ?>
由於google的動態口令演算法中種子金鑰使用了base32編碼,因此需要base32演算法,base32.php內容如下:
<?php //namespace Base32; /** * Base32 encoder and decoder * * Last update: 2012-06-20 * * RFC 4648 compliant * @link http://www.ietf.org/rfc/rfc4648.txt * * Some groundwork based on this class * https://github.com/NTICompass/PHP-Base32 * * @author Christian Riesen <chris.riesen@gmail.com> * @link http://christianriesen.com * @license MIT License see LICENSE file */ class Base32 { /** * Alphabet for encoding and decoding base32 * * @var array */ private static $alphabet = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567='; /** * Creates an array from a binary string into a given chunk size * * @param string $binaryString String to chunk * @param integer $bits Number of bits per chunk * @return array */ private static function chunk($binaryString, $bits) { $binaryString = chunk_split($binaryString, $bits, ' '); if (substr($binaryString, (strlen($binaryString)) - 1) == ' ') { $binaryString = substr($binaryString, 0, strlen($binaryString)-1); } return explode(' ', $binaryString); } /** * Encodes into base32 * * @param string $string Clear text string * @return string Base32 encoded string */ public static function encode($string) { if (strlen($string) == 0) { // Gives an empty string return ''; } // Convert string to binary $binaryString = ''; foreach (str_split($string) as $s) { // Return each character as an 8-bit binary string $binaryString .= sprintf('%08b', ord($s)); } // Break into 5-bit chunks, then break that into an array $binaryArray = self::chunk($binaryString, 5); // Pad array to be divisible by 8 while (count($binaryArray) % 8 !== 0) { $binaryArray[] = null; } $base32String = ''; // Encode in base32 foreach ($binaryArray as $bin) { $char = 32; if (!is_null($bin)) { // Pad the binary strings $bin = str_pad($bin, 5, 0, STR_PAD_RIGHT); $char = bindec($bin); } // Base32 character $base32String .= self::$alphabet[$char]; } return $base32String; } /** * Decodes base32 * * @param string $base32String Base32 encoded string * @return string Clear text string */ public static function decode($base32String) { // Only work in upper cases $base32String = strtoupper($base32String); // Remove anything that is not base32 alphabet $pattern = '/[^A-Z2-7]/'; $base32String = preg_replace($pattern, '', $base32String); if (strlen($base32String) == 0) { // Gives an empty string return ''; } $base32Array = str_split($base32String); $string = ''; foreach ($base32Array as $str) { $char = strpos(self::$alphabet, $str); // Ignore the padding character if ($char !== 32) { $string .= sprintf('%05b', $char); } } while (strlen($string) %8 !== 0) { $string = substr($string, 0, strlen($string)-1); } $binaryArray = self::chunk($string, 8); $realString = ''; foreach ($binaryArray as $bin) { // Pad each value to 8 bits $bin = str_pad($bin, 8, 0, STR_PAD_RIGHT); // Convert binary strings to ASCII $realString .= chr(bindec($bin)); } return $realString; } } ?>
將這兩個檔案放到Thinkphp框架的ThinkPHPLibraryVendoroath目錄下,oath目錄是自己建立的。
2、新增資料庫欄位
用戶表格新增以下欄位:
auth_type(0-靜態密碼,1-動態口令)
seed(種子金鑰)
temp_seed(暫時種子金鑰)
last_logintime(上次登入成功時間)
last_otp(上次使用密碼)
其中auth_type是為了標示使用者使用的哪種認證方式,seed為使用者的種子金鑰,temp_seed為使用者未開通前暫時儲存的一個種子金鑰,如果使用者開通動態口令認證成功,則該欄位內容會填入seed字段。 last_logintime和last_otp為上次認證成功的時間和動態口令,用於避免使用者同一個口令重複使用。
3、程式碼整合
1)、開通動態口令
在原有系統的修改密碼頁面,加上認證方式的選擇,例如:
如果使用者選擇動態口令方式,則會產生一張二維碼顯示在頁面,用於使用者開啟動態口令。為了相容於google authtication,其二維碼格式與Google一樣。產生二維碼的方法請參考我的另一篇《Thinkphp3.2.3整合phpqrcode產生帶有logo的二維碼》。
產生金鑰二維碼代碼如下:
public function qrcode() { Vendor('oath.base32'); $base32 = new \Base32(); $rand = random(16);//生成随机种子 $rand = $base32->encode($rand); $rand=str_replace('=','',$rand);//去除填充的‘=' $errorCorrectionLevel =intval(3) ;//容错级别 $matrixPointSize = intval(8);//生成图片大小 //生成二维码图片 Vendor('phpqrcode.phpqrcode'); $object = new \QRcode(); $text = sprintf("otpauth://totp/%s?secret=%s", $user, $rand); $object->png($text, false, $errorCorrectionLevel, $matrixPointSize, 2); 生成的种子$rand保存到数据库的temp_seed字段 }
random是產生隨機字串函數。 $rand=str_replace('=','',$rand)這句程式碼是因為Google手機令牌中base32解碼演算法並沒有填入的‘='號。
驗證使用者動態口令的程式碼如下:
从数据库读取temp_seed Vendor('oath.oath'); $object = new \Google2FA(); if($object->verify_key($temp_seed, $otp)){ 验证成功,将数据库更新seed为temp_seed,auth_type为1,last_otp为otp }
2)、動態口令登入
用戶動態口令登入驗證的程式碼:
從資料庫讀取auth_type,seed,last_otp欄位。
if($auth_type==1){//动态口令 //防止重复认证 if($lat_otp == $otp) { 动态口令重复使用返回 } Vendor('oath.oath'); $object = new \Google2FA(); if(!$object->verify_key($seed, $otp)) { 动态口令不正确 } else { 登录成功,将数据库更新last_otp为$otp,last_logintime为time() } }
4、測試驗證
下載google authtication,使用靜態密碼登入系統,進入修改密碼頁面。
開啟google authtication,掃描二維碼,會顯示動態口令。
保存內容,開通動態口令成功!
然後你就可以用高大上的動態口令登入系統了!
以上就是本文的全部內容,希望對大家的學習有所幫助,也希望大家多多支持腳本之家。

熱AI工具

Undresser.AI Undress
人工智慧驅動的應用程序,用於創建逼真的裸體照片

AI Clothes Remover
用於從照片中去除衣服的線上人工智慧工具。

Undress AI Tool
免費脫衣圖片

Clothoff.io
AI脫衣器

AI Hentai Generator
免費產生 AI 無盡。

熱門文章

熱工具

記事本++7.3.1
好用且免費的程式碼編輯器

SublimeText3漢化版
中文版,非常好用

禪工作室 13.0.1
強大的PHP整合開發環境

Dreamweaver CS6
視覺化網頁開發工具

SublimeText3 Mac版
神級程式碼編輯軟體(SublimeText3)