$ show google/google-authenticator-libpam
This repository provides a Pluggable Authentication Module (PAM) for two-factor authentication using TOTP (RFC 6238) and HOTP (RFC 4226) one-time passwords. It consists of a PAM shared library (`pam_google_authenticator.so`) that integrates with any PAM-aware service (SSH, login, etc.) to require a verification code in addition to the user's password, and a command-line tool (`google-authenticator`) for generating secret keys and configuring per-user state files. The implementation is written in C using autotools for building, and includes self-contained cryptographic primitives (Base32 encoding, HMAC-SHA1, SHA-1) that are also reused across the PAM module and the CLI tool. The code is well-structured, with careful attention to security (explicit memory zeroing, file permission checks, rate limiting, and reuse prevention). While the build system and CI (Travis CI) are somewhat dated, the core functionality is mature and actively maintained.
The LLM identified 2 files worth highlighting for reuse:
Self-contained Base32 encoding and decoding implementation conforming to RFC 4648. Handles common mistyped characters (0→O, 1→L, 8→B), ignores whitespace and hyphens, and returns the number of output bytes. Can be extracted and reused in any project requiring Base32 conversion without external dependencies.
HMAC-SHA1 implementation that automatically hashes keys longer than 64 bytes down to SHA-1 digest length, then computes inner and outer digests using XOR-padded keys. Includes explicit zeroing of all intermediate buffers (key, hash, temporary key) to prevent sensitive data leakage. Reusable for any HMAC-based authentication scheme.