RFC6238 TOTP implementation in pure PostgreSQL

This is very interesting if it was done for fun. However, this is very likely unsuitable for real world usage. A couple of issues I could see with a quick glance:<p>- Using &#x27;=&#x27; for comparing TOTPs in the totp.verify function[1] is not safe from timing attacks.<p>- The function random() used in the totp.random_base32 function[2] is not a cryptographically secure random number generator.<p>[1]: <a href="https:&#x2F;&#x2F;github.com&#x2F;pyramation&#x2F;totp&#x2F;blob&#x2F;7ec3104&#x2F;packages&#x2F;totp&#x2F;sql&#x2F;launchql-totp--0.0.3.sql#L111" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;pyramation&#x2F;totp&#x2F;blob&#x2F;7ec3104&#x2F;packages&#x2F;tot...</a><p>[2]: <a href="https:&#x2F;&#x2F;github.com&#x2F;pyramation&#x2F;totp&#x2F;blob&#x2F;7ec3104&#x2F;packages&#x2F;totp&#x2F;sql&#x2F;launchql-totp--0.0.3.sql#L121" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;pyramation&#x2F;totp&#x2F;blob&#x2F;7ec3104&#x2F;packages&#x2F;tot...</a>

The author&#x27;s main SQL code seems to be in this file: <a href="https:&#x2F;&#x2F;github.com&#x2F;pyramation&#x2F;totp&#x2F;blob&#x2F;master&#x2F;packages&#x2F;totp&#x2F;deploy&#x2F;schemas&#x2F;totp&#x2F;procedures&#x2F;generate_totp.sql" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;pyramation&#x2F;totp&#x2F;blob&#x2F;master&#x2F;packages&#x2F;totp...</a><p>For comparison, these are my relatively short TOTP implementations in {TypeScript, Python, Java, Rust, C++}: <a href="https:&#x2F;&#x2F;www.nayuki.io&#x2F;page&#x2F;time-based-one-time-password-tools" rel="nofollow">https:&#x2F;&#x2F;www.nayuki.io&#x2F;page&#x2F;time-based-one-time-password-tool...</a> . I even have a 6-line Python function.

Author here. Here is the full code if anyone is interested: <a href="https:&#x2F;&#x2F;github.com&#x2F;pyramation&#x2F;totp&#x2F;blob&#x2F;master&#x2F;packages&#x2F;totp&#x2F;sql&#x2F;launchql-totp--0.0.3.sql" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;pyramation&#x2F;totp&#x2F;blob&#x2F;master&#x2F;packages&#x2F;totp...</a>

I can&#x27;t be the only [UK] person who sees &#x27;TOTP&#x27; and immediately thinks &#x27;Top of the Pops&#x27;! XD

Cool! I remember seeing a pg TOTP implementation in this gist[1] before. Seems this extension was based off that?<p>[1]: <a href="https:&#x2F;&#x2F;gist.github.com&#x2F;bwbroersma&#x2F;676d0de32263ed554584ab132434ebd9" rel="nofollow">https:&#x2F;&#x2F;gist.github.com&#x2F;bwbroersma&#x2F;676d0de32263ed554584ab132...</a>

Can someone explain where&#x2F;why this might be used? Or is it just for fun?

nice to see sqitch[1] in use here<p>1: <a href="https:&#x2F;&#x2F;sqitch.org&#x2F;" rel="nofollow">https:&#x2F;&#x2F;sqitch.org&#x2F;</a>