otplib API Documentation / @otplib/totp / CryptoPlugin

Type Alias: CryptoPlugin

CryptoPlugin = object

Defined in: core/src/types.ts:82

Cryptographic plugin type for abstracting HMAC and random byte generation across different runtime environments (Node.js, browser, edge, etc.)

Properties

algorithms?

readonly optional algorithms?: readonly HashAlgorithm[]

Defined in: core/src/types.ts:104

The algorithms this plugin can compute, when it supports fewer than all of HASH_ALGORITHMS

Omit it unless the backing implementation is genuinely restricted - an absent value means the full set. CryptoContext reads this to reject an unsupported algorithm before delegating, rather than leaving the plugin to discover it.

This can only narrow. The value is intersected with HASH_ALGORITHMS, so listing a digest outside that set does not enable it.

Derive it from the plugin's own dispatch map (Object.keys(HASH_FNS)) rather than writing a parallel array, so the two cannot disagree about what the plugin actually handles.

---

name

readonly name: string

Defined in: core/src/types.ts:86

The name of the crypto plugin (e.g., 'node', 'web', 'js')

Methods

constantTimeEqual()

constantTimeEqual(a, b): boolean

Defined in: core/src/types.ts:149

Constant-time comparison to prevent timing side-channel attacks

Compares two values in a way that takes constant time regardless of whether they match or differ. This prevents timing attacks where an attacker could determine the secret by measuring comparison time.

Parameters

a

string | Uint8Array<ArrayBufferLike>

First value to compare (string or Uint8Array)

b

string | Uint8Array<ArrayBufferLike>

Second value to compare (string or Uint8Array)

Returns

boolean

true if values are equal, false otherwise

---

hmac()

hmac(algorithm, key, data): Uint8Array<ArrayBufferLike> | Promise<Uint8Array<ArrayBufferLike>>

Defined in: core/src/types.ts:124

Compute HMAC using the specified hash algorithm

Implementations must match the algorithm ignoring case, with an optional - or _ before the digest size ('SHA1', 'Sha1' and 'SHA-1' all mean 'sha1'), and throw AlgorithmUnsupportedError for anything else, rather than falling back to a default. Use normalizeHashAlgorithm from this package to get that behaviour for free. If the underlying implementation spells algorithms differently (for example Web Crypto's SHA-1), map the canonical name inside the plugin.

Parameters

algorithm

HashAlgorithm

The hash algorithm to use

key

Uint8Array

The secret key as a byte array

data

Uint8Array

The data to authenticate as a byte array

Returns

Uint8Array<ArrayBufferLike> | Promise<Uint8Array<ArrayBufferLike>>

HMAC digest as a byte array

Throws

If the algorithm is not supported

---

randomBytes()

randomBytes(length): Uint8Array

Defined in: core/src/types.ts:136

Generate cryptographically secure random bytes

Parameters

length

number

Number of random bytes to generate

Returns

Uint8Array

Random bytes