How to calculate the number of seconds when a TOTP will expire in?

Question

I am generating a simple token in my node app using notp:

var notp = require('notp')
notp.totp.gen("ciao", {}) // => 345678

I want to build a visualization similar to the one that Google Authenticator gives, and I need to know the number of seconds (or datetime) when the generated otp will expire.

How can I do it?

Answer 1

I've found it how to do it, it is actually pretty simple, you just need to know the time of start used by the algorithm.

It turns out that Google Authenticator uses Unix Epoch, so in my case, to display the timer I can do:

setInterval(() => (console.log(30 - Math.round(new Date() / 1000) % 30)), 1000)

Answer 2

This should be very simple,

The code within Google Authenticator App and on the server will then refresh with a new code every 30 seconds starting at the top of the minute.

Proof here: https://github.com/google/google-authenticator/blob/bd50d15c348a978c314d2b30e586fbc562096223/mobile/blackberry/src/com/google/authenticator/blackberry/AuthenticatorScreen.java#L53

So as long as you have your server and Apps synced these 30 second intervals will always be the same as they always start at the start of the minute and at 1 min and 30 seconds.

Another factor to take into account is that Google Authenticator on the server side can be setup to allow codes to be valid for only 30 seconds OR for 4 minutes. So you need to check if your server is setup at 30 seconds OR 4 minutes and then code accordingly.

Example of this when you setup:

By default, tokens are good for 30 seconds and in order to compensate for possible time-skew between the client and the server, we allow an extra token before and after the current time. If you experience problems with poor time synchronization, you can increase the window from its default size of 1:30min to about 4min. Do you want to do so (y/n)