OPENAM-6768 FR-880

Author: jonthomas108

openam-authentication/openam-auth-fr-oath/src/main/java/org/forgerock/openam/authentication/modules/fr/oath/AuthenticatorOATH.java

@@ -40,6 +40,7 @@
 import com.sun.identity.shared.debug.Debug;
 import com.sun.identity.sm.SMSException;
 import java.io.IOException;
+import java.security.MessageDigest;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Collections;
@@ -599,7 +600,7 @@ private boolean checkOTP(String otp, AMIdentity id, OathDeviceSettings settings)
                 for (int i = 0; i <= windowSize; i++) {
                     otpGen = HOTPAlgorithm.generateOTP(secretKeyBytes, counter + i, passLen, checksum,
                             truncationOffset);
-                    if (otpGen.equals(otp)) {
+                    if (isEqual(otpGen, otp)) {
                         //OTP is correct set the counter value to counter+i (+1 for having been successful)
                         setCounterAttr(id, counter + i + 1, settings);
                         return true;
@@ -633,6 +634,11 @@ private boolean checkOTP(String otp, AMIdentity id, OathDeviceSettings settings)
                 //get Time Step
                 long localTime = (time / totpTimeStep) + (settings.getClockDriftSeconds() / totpTimeStep);
 
+                if(lastLoginTimeStep == localTime){
+                    debug.error("OATH.checkOTP(): Login failed attempting to use the same OTP in same Time Step: " + localTime);
+                    throw new InvalidPasswordException(amAuthOATH, "authFailed", null, userName, null);
+                }
+
                 boolean sameWindow = false;
 
                 //check if we are in the time window to prevent 2 logins within the window using the same OTP
@@ -648,7 +654,7 @@ private boolean checkOTP(String otp, AMIdentity id, OathDeviceSettings settings)
                 String passLenStr = Integer.toString(passLen);
                 otpGen = TOTPAlgorithm.generateTOTP(secretKey, Long.toHexString(localTime), passLenStr);
 
-                if (otpGen.equals(otp)) {
+                if (isEqual(otpGen, otp)) {
                     setLoginTime(id, localTime, settings);
                     return true;
                 }
@@ -660,19 +666,19 @@ private boolean checkOTP(String otp, AMIdentity id, OathDeviceSettings settings)
                     //check time step after current time
                     otpGen = TOTPAlgorithm.generateTOTP(secretKey, Long.toHexString(time1), passLenStr);
 
-                    if (otpGen.equals(otp)) {
+                    if (isEqual(otpGen, otp)) {
                         setLoginTime(id, time1, settings);
                         return true;
                     }
 
                     //check time step before current time
                     otpGen = TOTPAlgorithm.generateTOTP(secretKey, Long.toHexString(time2), passLenStr);
 
-                    if (otpGen.equals(otp) && sameWindow) {
+                    if (isEqual(otpGen, otp) && sameWindow) {
                         debug.error("OATH.checkOTP() : Logging in in the same window with a OTP that is older " +
                                 "than the current times OTP");
                         return false;
-                    } else if (otpGen.equals(otp) && !sameWindow) {
+                    } else if (isEqual(otpGen, otp) && !sameWindow) {
                         setLoginTime(id, time2, settings);
                         return true;
                     }
@@ -790,4 +796,16 @@ private void setLoginTime(AMIdentity id, long time, OathDeviceSettings settings)
         devicesDao.saveDeviceProfiles(id.getName(), id.getRealm(),
                 Collections.singletonList(JsonConversionUtils.toJsonValue(settings)));
     }
+
+    /**
+     * Perform time constant equality check.
+     * Both values should not be null.
+     *
+     * @param str1 first value
+     * @param str2 second vale
+     * @return true if values are equal
+     */
+    private boolean isEqual(String str1, String str2)   {
+        return MessageDigest.isEqual(str1.getBytes(), str2.getBytes());
+    }
 }

openam-authentication/openam-auth-oath/src/main/java/org/forgerock/openam/authentication/modules/oath/OATH.java

@@ -50,10 +50,11 @@
 import java.util.Collections;
 import java.util.ResourceBundle;
 
+import java.security.MessageDigest;
+
 import javax.security.auth.Subject;
 import javax.security.auth.callback.Callback;
 import javax.security.auth.callback.PasswordCallback;
-import javax.xml.bind.DatatypeConverter;
 
 import org.forgerock.openam.authentication.modules.oath.plugins.DefaultSharedSecretProvider;
 import org.forgerock.openam.authentication.modules.oath.plugins.SharedSecretProvider;
@@ -419,7 +420,7 @@ private boolean checkOTP(String otp) throws AuthLoginException {
                             passLen,
                             checksum,
                             truncationOffset);
-                    if (otpGen.equals(otp)) {
+                    if (isEqual(otpGen, otp)) {
                         //OTP is correct set the counter value to counter+i
                         setCounterAttr(id, counter + i);
                         return true;
@@ -478,8 +479,13 @@ private boolean checkOTP(String otp) throws AuthLoginException {
                 long lastLoginTimeStep = lastLoginTimeInSeconds / totpTimeStep;
                 // get the current time step based on arrival time of OTP
                 long currentTimeStep = (timeInSeconds / totpTimeStep) + (lastClockDriftInSeconds / totpTimeStep);
-                boolean sameWindow = false;
 
+                if(lastLoginTimeStep == currentTimeStep){
+                    debug.error("OATH.checkOTP(): Login failed attempting to use the same OTP in same Time Step: " + currentTimeStep);
+                    throw new InvalidPasswordException(amAuthOATH, "authFailed", null, userName, null);
+                }
+
+                boolean sameWindow = false;
                 // check if we are in the time window to prevent 2
                 // logins within the window using the same OTP
                 if (lastLoginTimeStep >= (currentTimeStep - totpStepsInWindow)
@@ -499,7 +505,7 @@ private boolean checkOTP(String otp) throws AuthLoginException {
 
                 String passLenStr = Integer.toString(passLen);
                 otpGen = TOTPAlgorithm.generateTOTP(secretKeyBytes, Long.toHexString(currentTimeStep), passLenStr);
-                if (otpGen.equals(otp)) {
+                if (isEqual(otpGen, otp)) {
                     setLoginTime(id, currentTimeStep);
                     return true;
                 }
@@ -510,18 +516,18 @@ private boolean checkOTP(String otp) throws AuthLoginException {
 
                     // check time step after current time
                     otpGen = TOTPAlgorithm.generateTOTP(secretKeyBytes, Long.toHexString(timeInFutureStep), passLenStr);
-                    if (otpGen.equals(otp)) {
+                    if (isEqual(otpGen, otp)) {
                         setLoginTime(id, timeInFutureStep);
                         return true;
                     }
 
                     // check time step before current time
                     otpGen = TOTPAlgorithm.generateTOTP(secretKeyBytes, Long.toHexString(timeInPastStep), passLenStr);
-                    if (otpGen.equals(otp) && sameWindow) {
+                    if (isEqual(otpGen, otp) && sameWindow) {
                         debug.error("OATH.checkOTP(): "
-                                + "Logging in in the same window with a OTP that is older than the current OTP");
+                                + "Login the same window with a OTP that is older than the current OTP");
                         return false;
-                    } else if (otpGen.equals(otp) && !sameWindow) {
+                    } else if (isEqual(otpGen, otp) && !sameWindow) {
                         setLoginTime(id, timeInPastStep);
                         return true;
                     }
@@ -749,4 +755,16 @@ private void validateTOTPParameters() throws AuthLoginException {
             throw new AuthLoginException(amAuthOATH, "authFailed", null);
         }
     }
+
+    /**
+     * Perform time constant equality check.
+     * Both values should not be null.
+     *
+     * @param str1 first value
+     * @param str2 second vale
+     * @return true if values are equal
+     */
+    private boolean isEqual(String str1, String str2)   {
+         return MessageDigest.isEqual(str1.getBytes(), str2.getBytes());
+    }
 }