Why Do Java and Go Generate Different HOTP Values, and How Can I Fix the Discrepancy?

Java vs. Golang Implementation of HOTP (RFC-4226)

When attempting to implement HOTP in Go, users may encounter discrepancies between the generated OTPs compared to their Java counterparts. This deviation often results from the distinct ways in which these languages handle byte types.

In Java, the byte data type is signed with a range of -128 to 127, while in Go, it is unsigned with a range of 0 to 255. This difference manifests in the construction of the byte array representing the counter value.

Java Code:

final byte[] b = ByteBuffer.allocate(8).putLong(counter).array();

Go Code:

bs := make([]byte, 8)
binary.BigEndian.PutUint64(bs, counter)

The discrepancy arises when the counter value is negative in Java. Upon comparing the generated byte arrays, users may notice a disparity in the last byte of b.

To resolve this issue, it is necessary to adjust the negative Java byte values by adding 256. This shifts the negative value to its positive equivalent, ensuring alignment with the Go implementation.

Java Code (With Adjustment):

for (int i = 0; i < b.length; i++) {
    if (b[i] < 0) {
        b[i] += 256;
    }
}

Furthermore, the encoding used for the OTP result differs between the two languages. Java employs hexadecimal encoding, while Go uses Base64 by default. To achieve consistency, modify the Go code to output the result using hexadecimal encoding:

Go Code (Hexadecimal Encoding):

return hex.EncodeToString(h.Sum(nil))

With these adjustments, the HOTP implementation in Go should now align with its Java counterpart, producing identical OTP results for the given counter and key values.

The above is the detailed content of Why Do Java and Go Generate Different HOTP Values, and How Can I Fix the Discrepancy?. For more information, please follow other related articles on the PHP Chinese website!