Make generate more constant time

Author: mdp

CHANGELOG.md

@@ -1,5 +1,9 @@
 ### Changelog
 
+### 6.2.2
+
+- Removed `rjust` from `generate_otp` in favor of more time constant version
+
 ### 6.2.1
 
 - Removed old rdoc folder that was triggering a security warning due to an

lib/rotp/otp.rb

@@ -32,7 +32,8 @@ def generate_otp(input)
              (hmac[offset + 1].ord & 0xff) << 16 |
              (hmac[offset + 2].ord & 0xff) << 8 |
              (hmac[offset + 3].ord & 0xff)
-      (code % 10**digits).to_s.rjust(digits, '0')
+      code_str = (10 ** digits + (code % 10 ** digits)).to_s
+      code_str[-digits..-1]
     end
 
     private

lib/rotp/version.rb

@@ -1,3 +1,3 @@
 module ROTP
-  VERSION = '6.2.1'.freeze
+  VERSION = '6.2.2'.freeze
 end