It seems like the algorithm is actually fairly simple, according to the wikipedia page: http://en.wikipedia.org/wiki/Google_Authenticator