Reverse HOTP

[szszszsz]

Add the reverse HOTP feature

• CLI: Add Oath Authenticator support over CTAPHID pynitrokey#280
• Tests: https://github.com/Nitrokey/pynitrokey/pull/280/files#diff-8fb21877f9a0cc6c88d7d4076e5e6ab211a2bb69dd9d7cfa795c3297e1f4e9e7

Tasks

• return error on the counter overflow
• discuss, if on-credential operations (get code, verify code, or both) should be limited during its registration
• integrate with embedded runner
• support LED control - done partially, see Update blinking handlers #4
• support touch button
• extension: PIN verification as an alternative to the VALIDATE command, PIN verification as an alternative to the VALIDATE command #6
• optional: finish Trussed Virt-based example and tests , Add example #7
• discuss, if the error codes should be more specific (its basically success or error now)
• use u64 as the input for the verify_code, instead of the currently string

Description

Verify the HOTP code coming from a PC host, and show visually to user, that the code is correct or not, with a green or red LED respectively. Does not need authorization by design.

See more at:

• https://github.com/Nitrokey/nitrokey-hotp-verification#verifying-hotp-code

Solution contains means to avoid desynchronization between the host's and device's counters. Device calculates up to 9 values ahead of its current counter to find the matching code (in total it calculates HOTP code for 10 subsequent counter positions). In case:

• no code would match - the on-device counter will not be changed;
• incoming code parsing would fail - the on-device counter will not be changed;
• code would match, but with some counter's offset (up to 9) - the on-device counter will be set to matched code-generated HOTP counter and incremented by 1;
• code would match, and the code matches counter without offset - the counter will be incremented by 1.

Device will stop verifying the HOTP codes in case, when the difference between the host and on-device counters will be greater or equal to 10.

cc @sosthene-nitrokey

[szszszsz]

Let's consider this being ready to review. The remaining tasks' results will be supplied in separate PRs.

[szszszsz]

Note: confirmed to work in the NK3's embedded runner (embedded-runner-lpc55):

• Nitrokey/nitrokey-3-firmware@embedded-runner-lpc55...otp-app-ctaphid
• Merge lpc55 into embedded runner nitrokey-3-firmware#97

CLI is WIP under:

• https://github.com/Nitrokey/pynitrokey/compare/reverse-hotp

[szszszsz]

Updated as suggested in the review. Remaining tasks moved to separate tickets.
Merging.