Я могу дать вам представление о том, как работают мобильные аутентификаторы Blizzard, поскольку их код был с открытым исходным кодом. (архив)
В кратком псевдокоде это:
String GetCurrentFOBValue()
{
// Calculate the number of intervals since January 1 1970 (in UTC)
// The Blizzard authenticator rolls over every 30 seconds,
// so codeInterval is the number of 30 second intervals since January 1 1970.
// RSA tokens roll over every minute; so your counter can be the number
// of 1 minute intervals since January 1, 1970
// Int64 codeInterval = GetNumberOfIntervals();
Int64 codeInterval = (DateTime.Now - new DateTime(1970,1,1)).TotalSeconds / 30;
// Compute the HMAC_SHA1 digest of the code interval,
// using some agreed-upon 20-bytes of secret key material.
// We will generate our 20-bytes of secret key material by
// using PBKDF2 from a password.
// Blizzard's mobile authenticator is given secret key material
// when it enrolls by fetching it from the web-site.
Byte[] secret = PBKDF2("Super-secret password that our FOB knows", 20); //20 bytes
// Compute a message digest of codeInterval using our shared secret key
Byte[] hmac = HMAC(secret, codeInterval);
// Pick four bytes out of the hmac array, and convert them into a Int32.
// Use the last four bits of the digest as an index
// to which four bytes we will use to construct our Int32
int startIndex = hmac[19] & 0x0f;
Int32 value = Copy(hmac, startIndex, 4).ToUInt32 & 0x7fffffff;
// The blizzard authenticator shows 8 digits
return String.Format("%.8d", value % 100000000);
// But we could have just as easily returned 6, like RSA FOBs do
return String.Format("%.6d", value % 1000000);
}
Примечание : любой код публикуется в открытом доступе. Указание авторства не требуется.