OTP Generation

var otpGenerator:OTPGenerator? = null

    // We assume that you have already provisioned a container with otp keys
    // Find keys available for the usage OTP; if several are available, we need to distinguish them with their labels
    val filter = arrayOf(
        Parameter(
            SDKConstants.KEY_PROPERTY_USAGE,
            SDKConstants.KEY_PROPERTY_USAGE_OTP
        )
    )
    var keys = arrayOf<Key>()
    try {
        keys = myContainer.findKeys(filter)
    } catch (ex: Exception) {
        when(ex) {
            is InvalidParameterException, is LostCredentialsException, is UnsupportedDeviceException, is InternalException  -> {
                ex.printStackTrace()
            }
            else -> throw ex
        }
    }

    for (i in keys.indices) {
        val otpKey = keys[i]
        try {
            //To identify the protection policy used : look at the type of the protectionPolicy.
            // ProtectionPolicy.PolicyType.BIOPASSWORD : see the protection policy documentation for usage.
            // ProtectionPolicy.PolicyType.DEVICE : no password required
            // ProtectionPolicy.PolicyType.PASSWORD : password required
            val protectionPolicyType = otpKey.protectionPolicy.type
            // Algorithm will indicate the opt algorithm for which the key is registered : HOTP / TOTP / OCRA
            val algorithm = otpKey.algorithm
            // the label the key is registered with.
            val label = otpKey.getProperty(SDKConstants.KEY_PROPERTY_LABEL)
        } catch (ex: Exception) {
            when(ex) {
                is InvalidParameterException, is LostCredentialsException, is UnsupportedDeviceException, is InternalException  -> {
                    ex.printStackTrace()
                }
                else -> throw ex
            }
        }
    }

    // In this case, we identify the key, its algorithm and its protection policy.
    // The generator is Synchronous (HOTP or TOTP algorithms) : SyncOTPGenerator
    // The key is not password protected (password null)
    val otpKey = keys[0]

    // Get default OTP generator for this key.
    try {
        otpGenerator = otpKey.defaultOTPGenerator
    } catch (e : InternalException) {
        e.printStackTrace()
    }
    // Get the next OTP.
    val password: CharArray? = null
    var nextOtp: CharArray? = null
    try {
        nextOtp = (otpGenerator as SyncOTPGenerator).getOTP(password)
    } catch (ex: Exception) {
        when(ex) {
            is PasswordExpiredException -> {
                // !!!  PasswordExpiredException if expired password is given (changePassword required). !!!
                ex.printStackTrace()
            }
            is AuthenticationException, is InternalException, is FingerprintAuthenticationRequiredException, is PasswordRequiredException,  -> {
                ex.printStackTrace()
            }
            else -> throw ex
        }
    }

// Get default OTP generator for this key.
    // Here, we assume the generator is Asynchronous (OCRA algorithm)
    var otpGenerator:AsyncOTPGenerator? = null
    try {
        otpGenerator = otpKey.defaultOTPGenerator as AsyncOTPGenerator
    } catch (e : InternalException) {
        e.printStackTrace()
    }

    // With an ocra algoritm, inputs data depends of the algorithm used.
    // You can get parameters specific to the generator and key.
    // The type of parameters depends on the generator name
    Log.d (LOG_TAG, "Generator name: " + otpGenerator?.name)
    Log.d (LOG_TAG, "Generator name: " + otpGenerator?.type)

    val ocraParameters = otpGenerator?.algorithmParameters as OCRAParameters
    // Get the authentication modes supported from parameters
    Log.d (LOG_TAG, "Generator modes: " + ocraParameters.modes )

    // We assume the challenge/response mode is supported.
    // We assume the OTP key is not password protected. ( password null )

    // Check if pin or session is required and set it in InputOCRAParameters if so
    // You can validate the server challenge against the expected format
    val ocraSuite: OCRASuite = ocraParameters.serverOcraSuite

    // Check if pin or session is required and set it in InputOCRAParameters if so
    var pin: String? = null
    var session: String? = null
    if (ocraSuite.isPinRequired) pin = "some pin"
    if (ocraSuite.isSessionRequired) session = "some session data"
    val inputOcraParameters = InputOCRAParameters(pin, session)

    // Compute the response with the provided challenge.
    // We assume the key is not password protected (password null)
    val challenge: CharArray = "Challenge_provided".toCharArray()
    var nextOtp: CharArray? = null

    try {
        nextOtp = (otpGenerator as AsyncOTPGenerator).computeResponse(null, challenge, inputOcraParameters)
    }
    catch (ex: Exception) {
        when(ex) {
            is PasswordExpiredException -> {
                // !!!  PasswordExpiredException if expired password is given (changePassword required). !!!
                ex.printStackTrace()
            }
            is InvalidParameterException, is FingerprintNotEnrolledException, is UnsupportedDeviceException, is AuthenticationException, is InternalException, is FingerprintAuthenticationRequiredException, is PasswordRequiredException, is LostCredentialsException -> {
                ex.printStackTrace()
            }
            else -> throw ex
        }
    }

// We assume the signature mode is supported.
    // We assume the OTP key is not password protected. ( password null )
    // We assume required parameter set :
    val inputOcraParameters = InputOCRAParameters(pin, session)
    // The end-user has filled the form, input strings are in inputStrings, array of char[]
    // Format the challenge
    val inputStrings = arrayOf(INPUT1, INPUT2, INPUT3)
    var challenge: CharArray? = null
    try {
        challenge = otpGenerator.formatSignatureChallenge(inputStrings)
    } catch (e: InvalidChallengeException) {
        e.printStackTrace()
    } catch (e: InvalidParameterException) {
        e.printStackTrace()
    }
    var nextOtp: CharArray? = null
    try {
        // Compute the signature for one-way or two-way signature. For one-way signature, clientChallenge is empty.
         nextOtp = otpGenerator.computeSignature(null, challenge, null, inputOcraParameters)
    } catch (ex: Exception) {
        when(ex) {
            is PasswordExpiredException -> {
                // !!!  PasswordExpiredException if expired password is given (changePassword required). !!!
                ex.printStackTrace()
            }
            is InvalidParameterException, is FingerprintNotEnrolledException, is UnsupportedDeviceException, is AuthenticationException, is InternalException, is FingerprintAuthenticationRequiredException, is PasswordRequiredException, is LostCredentialsException -> {
                ex.printStackTrace()
            }
            else -> throw ex
        }
    }