This is C# source code documentation for IPWorks SSH SFTP component, specifically focusing on implementing Google Authenticator-style Two-Factor Authentication (2FA) with Time-based One-Time Passwords (TOTP) or HMAC-Based One-Time Passcodes (HOTP).

Here's a high-level breakdown of the key points:

1. The `IPWorksAuth.Totp` class is used to generate and verify TOTPs.

2. Within the SFTP client component, there are several important steps:

- Create an instance of `Totp`.

- When entering the keyboard-interactive authentication mode (indicated by setting `SSHAuthMode = PAM_AUTHENTICATION_SVR_HOST_based`), you'll need to handle the `SftpSSHKeyboardInteractiveEvent`.

3. Within this event, you can use either a TOTP or HOTP component from IPWorks Auth to retrieve and verify the one-time code.

4. To do so:

- Inspect the `Prompt` parameter of the `SFTPSSHEvents2.KeyboardInteractive` event arguments.

This will tell your application what information is being requested by the server (e.g., username, password, TOTP/HMAC secret).

5. Based on this prompt data and any other necessary details like a shared secret or challenge code provided earlier during setup:

- Use one of these components (`IPWorks.AuthComponents.Hmac`, `IPworks.AuthComponents.Totp`) to generate an HMAC (for HOTP) or TOTP signature.

This process typically involves passing in the requested parameters such as time, counter value etc. depending upon whether you're implementing HOTP or TOTP.

6. Once generated, this signature is then passed back through another parameter of `KeyboardInteractive` event handler named 'Response'.

7. Finally, when your application's implementation completes its part by returning a valid Response containing the computed HMAC/Signature - SSH server will compare it against what was expected based upon configuration settings stored somewhere else possibly within configuration files or databases.

8. If both signatures match then user has successfully authenticated otherwise they'll be prompted again until correct credentials are provided including second factor TOTP/HMAC code etc...

Google authenticator mode totp hotp