Подбор паролей, перебор учёток и лимиты запросов

живой пример

import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
import java.util.Arrays;
import java.util.Map;

public class LoginLeaks {
    record User(byte[] salt, byte[] hash) {}

    static int hashCalls = 0;
    static Map<String, User> users;

    static byte[] hashPassword(String password, byte[] salt) throws Exception {
        hashCalls++;
        MessageDigest sha = MessageDigest.getInstance("SHA-256");
        byte[] h = password.getBytes(StandardCharsets.UTF_8);
        for (int i = 0; i < 10_000; i++) {
            sha.update(salt);
            h = sha.digest(h);
        }
        return h;
    }

    static String login(String email, String password) throws Exception {
        User user = users.get(email);
        if (user == null) {
            return "Пользователь не найден";
        }
        if (!Arrays.equals(hashPassword(password, user.salt()), user.hash())) {
            return "Неверный пароль";
        }
        return "Вход выполнен";
    }

    public static void main(String[] args) throws Exception {
        byte[] salt = "anna-salt".getBytes(StandardCharsets.UTF_8);
        users = Map.of("anna@shop.ru", new User(salt, hashPassword("Correct-Horse-7", salt)));

        String[] seen = new String[2];
        String[] probes = {"anna@shop.ru", "ghost@shop.ru"};
        for (int i = 0; i < probes.length; i++) {
            int before = hashCalls;
            String answer = login(probes[i], "qwerty123");
            int work = hashCalls - before;
            System.out.printf("%-13s -> «%s», вызовов хеша: %d%n", probes[i], answer, work);
            seen[i] = answer + "/" + work;
        }
        System.out.println(seen[0].equals(seen[1])
                ? "перебор учёток не прошёл: ответ и работа совпадают"
                : "перебор учёток прошёл: anna@shop.ru есть в базе, ghost@shop.ru нет");
    }
}

живой пример

package main

import (
	"bytes"
	"crypto/sha256"
	"fmt"
)

type User struct {
	Salt []byte
	Hash []byte
}

var hashCalls int
var users map[string]User

func hashPassword(password string, salt []byte) []byte {
	hashCalls++
	h := []byte(password)
	for i := 0; i < 10_000; i++ {
		sum := sha256.Sum256(append(append([]byte{}, salt...), h...))
		h = sum[:]
	}
	return h
}

func login(email, password string) string {
	user, ok := users[email]
	if !ok {
		return "Пользователь не найден"
	}
	if !bytes.Equal(hashPassword(password, user.Salt), user.Hash) {
		return "Неверный пароль"
	}
	return "Вход выполнен"
}

func main() {
	salt := []byte("anna-salt")
	users = map[string]User{"anna@shop.ru": {salt, hashPassword("Correct-Horse-7", salt)}}

	var seen []string
	for _, email := range []string{"anna@shop.ru", "ghost@shop.ru"} {
		before := hashCalls
		answer := login(email, "qwerty123")
		work := hashCalls - before
		fmt.Printf("%-13s -> «%s», вызовов хеша: %d\n", email, answer, work)
		seen = append(seen, fmt.Sprint(answer, "/", work))
	}
	if seen[0] == seen[1] {
		fmt.Println("перебор учёток не прошёл: ответ и работа совпадают")
	} else {
		fmt.Println("перебор учёток прошёл: anna@shop.ru есть в базе, ghost@shop.ru нет")
	}
}

живой пример

const crypto = require("crypto");

let hashCalls = 0;

function hashPassword(password, salt) {
  hashCalls++;
  let h = Buffer.from(password, "utf8");
  for (let i = 0; i < 10_000; i++) {
    h = crypto.createHash("sha256").update(salt).update(h).digest();
  }
  return h;
}

const salt = Buffer.from("anna-salt");
const users = new Map([["anna@shop.ru", { salt, hash: hashPassword("Correct-Horse-7", salt) }]]);

function login(email, password) {
  const user = users.get(email);
  if (!user) return "Пользователь не найден";
  if (!hashPassword(password, user.salt).equals(user.hash)) return "Неверный пароль";
  return "Вход выполнен";
}

const seen = [];
for (const email of ["anna@shop.ru", "ghost@shop.ru"]) {
  const before = hashCalls;
  const answer = login(email, "qwerty123");
  const work = hashCalls - before;
  console.log(`${email.padEnd(13)} -> «${answer}», вызовов хеша: ${work}`);
  seen.push(`${answer}/${work}`);
}
console.log(seen[0] === seen[1]
  ? "перебор учёток не прошёл: ответ и работа совпадают"
  : "перебор учёток прошёл: anna@shop.ru есть в базе, ghost@shop.ru нет");

живой пример

import hashlib

hash_calls = 0


def hash_password(password: str, salt: bytes) -> bytes:
    global hash_calls
    hash_calls += 1
    h = password.encode()
    for _ in range(10_000):
        h = hashlib.sha256(salt + h).digest()
    return h


salt = b"anna-salt"
users = {"anna@shop.ru": (salt, hash_password("Correct-Horse-7", salt))}


def login(email: str, password: str) -> str:
    user = users.get(email)
    if user is None:
        return "Пользователь не найден"
    user_salt, user_hash = user
    if hash_password(password, user_salt) != user_hash:
        return "Неверный пароль"
    return "Вход выполнен"


seen = []
for email in ("anna@shop.ru", "ghost@shop.ru"):
    before = hash_calls
    answer = login(email, "qwerty123")
    work = hash_calls - before
    print(f"{email:<13} -> «{answer}», вызовов хеша: {work}")
    seen.append((answer, work))
print("перебор учёток не прошёл: ответ и работа совпадают" if seen[0] == seen[1]
      else "перебор учёток прошёл: anna@shop.ru есть в базе, ghost@shop.ru нет")

живой пример

import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
import java.security.SecureRandom;
import java.util.Map;

public class LoginUniform {
    record User(byte[] salt, byte[] hash) {}

    static int hashCalls = 0;
    static Map<String, User> users;
    static User dummy;

    static byte[] hashPassword(String password, byte[] salt) throws Exception {
        hashCalls++;
        MessageDigest sha = MessageDigest.getInstance("SHA-256");
        byte[] h = password.getBytes(StandardCharsets.UTF_8);
        for (int i = 0; i < 10_000; i++) {
            sha.update(salt);
            h = sha.digest(h);
        }
        return h;
    }

    static String login(String email, String password) throws Exception {
        User user = users.get(email);
        User target = user != null ? user : dummy;
        byte[] actual = hashPassword(password, target.salt());
        boolean match = MessageDigest.isEqual(actual, target.hash());
        return user != null && match ? "Вход выполнен" : "Неверный email или пароль";
    }

    public static void main(String[] args) throws Exception {
        SecureRandom random = new SecureRandom();
        byte[] dummySalt = new byte[16];
        random.nextBytes(dummySalt);
        dummy = new User(dummySalt, hashPassword(Long.toHexString(random.nextLong()), dummySalt));
        byte[] salt = "anna-salt".getBytes(StandardCharsets.UTF_8);
        users = Map.of("anna@shop.ru", new User(salt, hashPassword("Correct-Horse-7", salt)));

        String[] seen = new String[3];
        String[][] probes = {{"anna@shop.ru", "qwerty123"}, {"ghost@shop.ru", "qwerty123"}, {"anna@shop.ru", "Correct-Horse-7"}};
        for (int i = 0; i < probes.length; i++) {
            int before = hashCalls;
            String answer = login(probes[i][0], probes[i][1]);
            int work = hashCalls - before;
            System.out.printf("%-13s / %-15s -> «%s», вызовов хеша: %d%n", probes[i][0], probes[i][1], answer, work);
            seen[i] = answer + "/" + work;
        }
        System.out.println(seen[0].equals(seen[1])
                ? "перебор учёток не прошёл: ответ и работа совпадают"
                : "перебор учёток прошёл: ответы различаются");
    }
}

живой пример

package main

import (
	"crypto/rand"
	"crypto/sha256"
	"crypto/subtle"
	"fmt"
)

type User struct {
	Salt []byte
	Hash []byte
}

var hashCalls int
var users map[string]User
var dummy User

func hashPassword(password string, salt []byte) []byte {
	hashCalls++
	h := []byte(password)
	for i := 0; i < 10_000; i++ {
		sum := sha256.Sum256(append(append([]byte{}, salt...), h...))
		h = sum[:]
	}
	return h
}

func login(email, password string) string {
	user, ok := users[email]
	target := user
	if !ok {
		target = dummy
	}
	actual := hashPassword(password, target.Salt)
	match := subtle.ConstantTimeCompare(actual, target.Hash) == 1
	if ok && match {
		return "Вход выполнен"
	}
	return "Неверный email или пароль"
}

func main() {
	dummySalt, dummySecret := make([]byte, 16), make([]byte, 16)
	rand.Read(dummySalt)
	rand.Read(dummySecret)
	dummy = User{dummySalt, hashPassword(fmt.Sprintf("%x", dummySecret), dummySalt)}
	salt := []byte("anna-salt")
	users = map[string]User{"anna@shop.ru": {salt, hashPassword("Correct-Horse-7", salt)}}

	var seen []string
	for _, p := range [][2]string{{"anna@shop.ru", "qwerty123"}, {"ghost@shop.ru", "qwerty123"}, {"anna@shop.ru", "Correct-Horse-7"}} {
		before := hashCalls
		answer := login(p[0], p[1])
		work := hashCalls - before
		fmt.Printf("%-13s / %-15s -> «%s», вызовов хеша: %d\n", p[0], p[1], answer, work)
		seen = append(seen, fmt.Sprint(answer, "/", work))
	}
	if seen[0] == seen[1] {
		fmt.Println("перебор учёток не прошёл: ответ и работа совпадают")
	} else {
		fmt.Println("перебор учёток прошёл: ответы различаются")
	}
}

живой пример

const crypto = require("crypto");

let hashCalls = 0;

function hashPassword(password, salt) {
  hashCalls++;
  let h = Buffer.from(password, "utf8");
  for (let i = 0; i < 10_000; i++) {
    h = crypto.createHash("sha256").update(salt).update(h).digest();
  }
  return h;
}

const dummySalt = crypto.randomBytes(16);
const dummy = { salt: dummySalt, hash: hashPassword(crypto.randomBytes(16).toString("hex"), dummySalt) };
const salt = Buffer.from("anna-salt");
const users = new Map([["anna@shop.ru", { salt, hash: hashPassword("Correct-Horse-7", salt) }]]);

function login(email, password) {
  const user = users.get(email);
  const target = user ?? dummy;
  const actual = hashPassword(password, target.salt);
  const match = crypto.timingSafeEqual(actual, target.hash);
  return user && match ? "Вход выполнен" : "Неверный email или пароль";
}

const seen = [];
for (const [email, password] of [["anna@shop.ru", "qwerty123"], ["ghost@shop.ru", "qwerty123"], ["anna@shop.ru", "Correct-Horse-7"]]) {
  const before = hashCalls;
  const answer = login(email, password);
  const work = hashCalls - before;
  console.log(`${email.padEnd(13)} / ${password.padEnd(15)} -> «${answer}», вызовов хеша: ${work}`);
  seen.push(`${answer}/${work}`);
}
console.log(seen[0] === seen[1]
  ? "перебор учёток не прошёл: ответ и работа совпадают"
  : "перебор учёток прошёл: ответы различаются");

живой пример

import hashlib
import hmac
import secrets

hash_calls = 0


def hash_password(password: str, salt: bytes) -> bytes:
    global hash_calls
    hash_calls += 1
    h = password.encode()
    for _ in range(10_000):
        h = hashlib.sha256(salt + h).digest()
    return h


dummy_salt = secrets.token_bytes(16)
DUMMY = (dummy_salt, hash_password(secrets.token_hex(16), dummy_salt))
salt = b"anna-salt"
users = {"anna@shop.ru": (salt, hash_password("Correct-Horse-7", salt))}


def login(email: str, password: str) -> str:
    user = users.get(email)
    target_salt, target_hash = user if user is not None else DUMMY
    actual = hash_password(password, target_salt)
    match = hmac.compare_digest(actual, target_hash)
    return "Вход выполнен" if user is not None and match else "Неверный email или пароль"


seen = []
for email, password in (("anna@shop.ru", "qwerty123"), ("ghost@shop.ru", "qwerty123"), ("anna@shop.ru", "Correct-Horse-7")):
    before = hash_calls
    answer = login(email, password)
    work = hash_calls - before
    print(f"{email:<13} / {password:<15} -> «{answer}», вызовов хеша: {work}")
    seen.append((answer, work))
print("перебор учёток не прошёл: ответ и работа совпадают" if seen[0] == seen[1]
      else "перебор учёток прошёл: ответы различаются")

живой пример

import java.util.HashMap;
import java.util.Map;

public class LoginRateLimit {
    static class TokenBucket {
        final long capacity;
        final long refillMillis;
        long tokens;
        long lastRefill;

        TokenBucket(long capacity, long refillMillis, long now) {
            this.capacity = capacity;
            this.refillMillis = refillMillis;
            this.tokens = capacity;
            this.lastRefill = now;
        }

        void refill(long now) {
            long added = (now - lastRefill) / refillMillis;
            tokens = Math.min(capacity, tokens + added);
            lastRefill = tokens == capacity ? now : lastRefill + added * refillMillis;
        }

        boolean tryConsume(long now) {
            refill(now);
            if (tokens == 0) {
                return false;
            }
            tokens--;
            return true;
        }

        long retryAfterSeconds(long now) {
            return (lastRefill + refillMillis - now + 999) / 1000;
        }
    }

    static final Map<String, TokenBucket> buckets = new HashMap<>();

    static String attempt(String email, long now) {
        TokenBucket bucket = buckets.computeIfAbsent("login:" + email, k -> new TokenBucket(5, 12_000, now));
        return bucket.tryConsume(now) ? "пропущен" : "429, Retry-After: " + bucket.retryAfterSeconds(now);
    }

    public static void main(String[] args) {
        for (int i = 1; i <= 7; i++) {
            System.out.println("t=0s  anna попытка " + i + ": " + attempt("anna@shop.ru", 0));
        }
        System.out.println("t=0s  boris попытка 1: " + attempt("boris@shop.ru", 0));
        for (int i = 8; i <= 10; i++) {
            System.out.println("t=30s anna попытка " + i + ": " + attempt("anna@shop.ru", 30_000));
        }
    }
}

живой пример

package main

import (
	"fmt"
	"time"
)

type TokenBucket struct {
	capacity   int
	refillEach time.Duration
	tokens     int
	lastRefill time.Duration
}

func (b *TokenBucket) refill(now time.Duration) {
	added := int((now - b.lastRefill) / b.refillEach)
	b.tokens = min(b.capacity, b.tokens+added)
	if b.tokens == b.capacity {
		b.lastRefill = now
	} else {
		b.lastRefill += time.Duration(added) * b.refillEach
	}
}

func (b *TokenBucket) TryConsume(now time.Duration) bool {
	b.refill(now)
	if b.tokens == 0 {
		return false
	}
	b.tokens--
	return true
}

func (b *TokenBucket) RetryAfterSeconds(now time.Duration) int {
	wait := b.lastRefill + b.refillEach - now
	return int((wait + time.Second - 1) / time.Second)
}

var buckets = map[string]*TokenBucket{}

func attempt(email string, now time.Duration) string {
	key := "login:" + email
	b, ok := buckets[key]
	if !ok {
		b = &TokenBucket{capacity: 5, refillEach: 12 * time.Second, tokens: 5, lastRefill: now}
		buckets[key] = b
	}
	if b.TryConsume(now) {
		return "пропущен"
	}
	return fmt.Sprintf("429, Retry-After: %d", b.RetryAfterSeconds(now))
}

func main() {
	for i := 1; i <= 7; i++ {
		fmt.Printf("t=0s  anna попытка %d: %s\n", i, attempt("anna@shop.ru", 0))
	}
	fmt.Printf("t=0s  boris попытка 1: %s\n", attempt("boris@shop.ru", 0))
	for i := 8; i <= 10; i++ {
		fmt.Printf("t=30s anna попытка %d: %s\n", i, attempt("anna@shop.ru", 30*time.Second))
	}
}

живой пример

class TokenBucket {
  constructor(capacity, refillMs, now) {
    this.capacity = capacity;
    this.refillMs = refillMs;
    this.tokens = capacity;
    this.lastRefill = now;
  }

  refill(now) {
    const added = Math.floor((now - this.lastRefill) / this.refillMs);
    this.tokens = Math.min(this.capacity, this.tokens + added);
    this.lastRefill = this.tokens === this.capacity ? now : this.lastRefill + added * this.refillMs;
  }

  tryConsume(now) {
    this.refill(now);
    if (this.tokens === 0) return false;
    this.tokens--;
    return true;
  }

  retryAfterSeconds(now) {
    return Math.ceil((this.lastRefill + this.refillMs - now) / 1000);
  }
}

const buckets = new Map();

function attempt(email, now) {
  const key = `login:${email}`;
  if (!buckets.has(key)) buckets.set(key, new TokenBucket(5, 12_000, now));
  const bucket = buckets.get(key);
  return bucket.tryConsume(now) ? "пропущен" : `429, Retry-After: ${bucket.retryAfterSeconds(now)}`;
}

for (let i = 1; i <= 7; i++) console.log(`t=0s  anna попытка ${i}: ${attempt("anna@shop.ru", 0)}`);
console.log(`t=0s  boris попытка 1: ${attempt("boris@shop.ru", 0)}`);
for (let i = 8; i <= 10; i++) console.log(`t=30s anna попытка ${i}: ${attempt("anna@shop.ru", 30_000)}`);

живой пример

class TokenBucket:
    def __init__(self, capacity: int, refill_ms: int, now: int):
        self.capacity = capacity
        self.refill_ms = refill_ms
        self.tokens = capacity
        self.last_refill = now

    def refill(self, now: int) -> None:
        added = (now - self.last_refill) // self.refill_ms
        self.tokens = min(self.capacity, self.tokens + added)
        self.last_refill = now if self.tokens == self.capacity else self.last_refill + added * self.refill_ms

    def try_consume(self, now: int) -> bool:
        self.refill(now)
        if self.tokens == 0:
            return False
        self.tokens -= 1
        return True

    def retry_after_seconds(self, now: int) -> int:
        return -(-(self.last_refill + self.refill_ms - now) // 1000)


buckets: dict[str, TokenBucket] = {}


def attempt(email: str, now: int) -> str:
    key = f"login:{email}"
    if key not in buckets:
        buckets[key] = TokenBucket(5, 12_000, now)
    bucket = buckets[key]
    return "пропущен" if bucket.try_consume(now) else f"429, Retry-After: {bucket.retry_after_seconds(now)}"


for i in range(1, 8):
    print(f"t=0s  anna попытка {i}: {attempt('anna@shop.ru', 0)}")
print(f"t=0s  boris попытка 1: {attempt('boris@shop.ru', 0)}")
for i in range(8, 11):
    print(f"t=30s anna попытка {i}: {attempt('anna@shop.ru', 30_000)}")

import io.github.bucket4j.Bucket;
import io.github.bucket4j.ConsumptionProbe;
import jakarta.servlet.FilterChain;
import jakarta.servlet.ServletException;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.time.Duration;
import java.util.concurrent.ConcurrentHashMap;
import org.springframework.stereotype.Component;
import org.springframework.web.filter.OncePerRequestFilter;

@Component
public class LoginRateLimitFilter extends OncePerRequestFilter {
    private final ConcurrentHashMap<String, Bucket> bucketsByIp = new ConcurrentHashMap<>();

    @Override
    protected boolean shouldNotFilter(HttpServletRequest request) {
        return !("POST".equals(request.getMethod()) && "/api/login".equals(request.getRequestURI()));
    }

    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
            throws ServletException, IOException {
        Bucket bucket = bucketsByIp.computeIfAbsent(request.getRemoteAddr(), ip -> Bucket.builder()
                .addLimit(limit -> limit.capacity(20).refillGreedy(20, Duration.ofMinutes(1)))
                .build());
        ConsumptionProbe probe = bucket.tryConsumeAndReturnRemaining(1);
        if (probe.isConsumed()) {
            chain.doFilter(request, response);
            return;
        }
        long retryAfterSeconds = (probe.getNanosToWaitForRefill() + 999_999_999) / 1_000_000_000;
        response.setHeader("Retry-After", String.valueOf(retryAfterSeconds));
        response.sendError(429, "Too Many Requests");
    }
}

package api

import (
	"math"
	"net"
	"net/http"
	"strconv"
	"sync"
	"time"

	"github.com/go-chi/chi/v5"
	"golang.org/x/time/rate"
)

type IPLimiter struct {
	mu       sync.Mutex
	limiters map[string]*rate.Limiter
}

func (l *IPLimiter) forIP(ip string) *rate.Limiter {
	l.mu.Lock()
	defer l.mu.Unlock()
	lim, ok := l.limiters[ip]
	if !ok {
		lim = rate.NewLimiter(rate.Every(3*time.Second), 20)
		l.limiters[ip] = lim
	}
	return lim
}

func (l *IPLimiter) Middleware(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		ip, _, err := net.SplitHostPort(r.RemoteAddr)
		if err != nil {
			ip = r.RemoteAddr
		}
		reservation := l.forIP(ip).Reserve()
		if delay := reservation.Delay(); delay > 0 {
			reservation.Cancel()
			w.Header().Set("Retry-After", strconv.Itoa(int(math.Ceil(delay.Seconds()))))
			http.Error(w, "Too Many Requests", http.StatusTooManyRequests)
			return
		}
		next.ServeHTTP(w, r)
	})
}

func Routes(auth *AuthHandler) http.Handler {
	r := chi.NewRouter()
	loginLimiter := &IPLimiter{limiters: map[string]*rate.Limiter{}}
	r.With(loginLimiter.Middleware).Post("/api/login", auth.Login)
	return r
}

const express = require("express");
const { rateLimit } = require("express-rate-limit");

const app = express();
app.use(express.json());

const loginByIp = rateLimit({
  windowMs: 60 * 1000,
  limit: 20,
  standardHeaders: "draft-8",
  legacyHeaders: false,
});

const loginByAccount = rateLimit({
  windowMs: 60 * 1000,
  limit: 5,
  standardHeaders: "draft-8",
  legacyHeaders: false,
  keyGenerator: (req) => `login:${String(req.body?.email ?? "").trim().toLowerCase()}`,
});

app.post("/api/login", loginByIp, loginByAccount, loginHandler);

from fastapi import FastAPI, Request, Response
from pydantic import BaseModel
from slowapi import Limiter, _rate_limit_exceeded_handler
from slowapi.errors import RateLimitExceeded
from slowapi.util import get_remote_address

limiter = Limiter(key_func=get_remote_address, headers_enabled=True)
app = FastAPI()
app.state.limiter = limiter
app.add_exception_handler(RateLimitExceeded, _rate_limit_exceeded_handler)


class LoginIn(BaseModel):
    email: str
    password: str


@app.post("/api/login")
@limiter.limit("20/minute")
async def login(request: Request, response: Response, body: LoginIn):
    return await auth_service.login(body.email.strip().lower(), body.password)

живой пример

import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;

public class OtpAttempts {
    static class OtpChallenge {
        final byte[] code;
        final long expiresAt;
        int attemptsLeft = 5;
        boolean used = false;

        OtpChallenge(String code, long now, long ttlMillis) {
            this.code = code.getBytes(StandardCharsets.UTF_8);
            this.expiresAt = now + ttlMillis;
        }

        String verify(String input, long now) {
            if (used || now >= expiresAt) {
                return "код истёк";
            }
            if (attemptsLeft == 0) {
                return "попытки кончились, запросите новый код";
            }
            attemptsLeft--;
            if (MessageDigest.isEqual(code, input.getBytes(StandardCharsets.UTF_8))) {
                used = true;
                return "код принят";
            }
            return "неверный код";
        }
    }

    public static void main(String[] args) {
        long ttl = 5 * 60_000;
        OtpChallenge challenge = new OtpChallenge("483920", 0, ttl);
        int compared = 0, accepted = 0;
        for (int i = 0; i < 1000; i++) {
            String answer = challenge.verify(String.format("%06d", i), 1_000);
            if (answer.equals("неверный код") || answer.equals("код принят")) compared++;
            if (answer.equals("код принят")) accepted++;
        }
        System.out.println("перебор 000000..000999: сравнений " + compared + ", принято " + accepted);
        System.out.println("владелец вводит верный код: " + challenge.verify("483920", 10_000));

        OtpChallenge fresh = new OtpChallenge("715204", 60_000, ttl);
        System.out.println("новый код через 6 минут: " + fresh.verify("715204", 60_000 + 6 * 60_000));
    }
}

живой пример

package main

import (
	"crypto/subtle"
	"fmt"
	"time"
)

type OtpChallenge struct {
	code         []byte
	expiresAt    time.Duration
	attemptsLeft int
	used         bool
}

func NewChallenge(code string, now, ttl time.Duration) *OtpChallenge {
	return &OtpChallenge{code: []byte(code), expiresAt: now + ttl, attemptsLeft: 5}
}

func (c *OtpChallenge) Verify(input string, now time.Duration) string {
	if c.used || now >= c.expiresAt {
		return "код истёк"
	}
	if c.attemptsLeft == 0 {
		return "попытки кончились, запросите новый код"
	}
	c.attemptsLeft--
	if subtle.ConstantTimeCompare(c.code, []byte(input)) == 1 {
		c.used = true
		return "код принят"
	}
	return "неверный код"
}

func main() {
	ttl := 5 * time.Minute
	challenge := NewChallenge("483920", 0, ttl)
	compared, accepted := 0, 0
	for i := 0; i < 1000; i++ {
		answer := challenge.Verify(fmt.Sprintf("%06d", i), time.Second)
		if answer == "неверный код" || answer == "код принят" {
			compared++
		}
		if answer == "код принят" {
			accepted++
		}
	}
	fmt.Printf("перебор 000000..000999: сравнений %d, принято %d\n", compared, accepted)
	fmt.Println("владелец вводит верный код:", challenge.Verify("483920", 10*time.Second))

	fresh := NewChallenge("715204", time.Minute, ttl)
	fmt.Println("новый код через 6 минут:", fresh.Verify("715204", time.Minute+6*time.Minute))
}

живой пример

const crypto = require("crypto");

class OtpChallenge {
  constructor(code, now, ttlMs) {
    this.code = Buffer.from(code);
    this.expiresAt = now + ttlMs;
    this.attemptsLeft = 5;
    this.used = false;
  }

  verify(input, now) {
    if (this.used || now >= this.expiresAt) return "код истёк";
    if (this.attemptsLeft === 0) return "попытки кончились, запросите новый код";
    this.attemptsLeft--;
    const given = Buffer.from(input);
    if (given.length === this.code.length && crypto.timingSafeEqual(given, this.code)) {
      this.used = true;
      return "код принят";
    }
    return "неверный код";
  }
}

const ttl = 5 * 60_000;
const challenge = new OtpChallenge("483920", 0, ttl);
let compared = 0;
let accepted = 0;
for (let i = 0; i < 1000; i++) {
  const answer = challenge.verify(String(i).padStart(6, "0"), 1_000);
  if (answer === "неверный код" || answer === "код принят") compared++;
  if (answer === "код принят") accepted++;
}
console.log(`перебор 000000..000999: сравнений ${compared}, принято ${accepted}`);
console.log(`владелец вводит верный код: ${challenge.verify("483920", 10_000)}`);

const fresh = new OtpChallenge("715204", 60_000, ttl);
console.log(`новый код через 6 минут: ${fresh.verify("715204", 60_000 + 6 * 60_000)}`);

живой пример

import hmac


class OtpChallenge:
    def __init__(self, code: str, now: int, ttl_ms: int):
        self.code = code.encode()
        self.expires_at = now + ttl_ms
        self.attempts_left = 5
        self.used = False

    def verify(self, given: str, now: int) -> str:
        if self.used or now >= self.expires_at:
            return "код истёк"
        if self.attempts_left == 0:
            return "попытки кончились, запросите новый код"
        self.attempts_left -= 1
        if hmac.compare_digest(self.code, given.encode()):
            self.used = True
            return "код принят"
        return "неверный код"


TTL = 5 * 60_000
challenge = OtpChallenge("483920", 0, TTL)
answers = [challenge.verify(f"{i:06d}", 1_000) for i in range(1000)]
compared = sum(a in ("неверный код", "код принят") for a in answers)
accepted = answers.count("код принят")
print(f"перебор 000000..000999: сравнений {compared}, принято {accepted}")
print("владелец вводит верный код:", challenge.verify("483920", 10_000))

fresh = OtpChallenge("715204", 60_000, TTL)
print("новый код через 6 минут:", fresh.verify("715204", 60_000 + 6 * 60_000))