Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

sha256 token creation #29

Closed
franc opened this issue Mar 2, 2021 · 3 comments
Closed

sha256 token creation #29

franc opened this issue Mar 2, 2021 · 3 comments

Comments

@franc
Copy link
Contributor

franc commented Mar 2, 2021

I'm trying to generate and verify totp tokens.

this works well when using [digest_method: :sha], but I need to use rfc6238 SHA256 tokens.

getting failures when trying digest_method: :sha256

opts = [window: 2, interval_length: 3600, digest_method: :sha256]
token = secret |> :pot.totp(opts)
** (MatchError) no match of right hand side value: <<221, 169, 235, 199, 207, 194, 226, 210, 209, 123, 203, 138, 78, 57, 209, 132, 19, 111, 104, 107, 2, 237, 8, 212, 246, 217, 124, 97, 13, 245, 28, 211>>
    (pot 1.0.0) /home/ubuntu/code/maya/deps/pot/src/pot.erl:94: :pot.hotp/3

which points at this:

   Digest = crypto:hmac(DigestMethod, Key, Msg),
    <<_:19/binary, Ob:8>> = Digest,`
iex(17)> :crypto.hmac(:sha, key, "3600")
<<241, 110, 101, 95, 110, 107, 142, 144, 152, 77, 206, 54, 241, 74, 120, 64, 0,
  182, 49, 236>>
iex(18)> :crypto.hmac(:sha256, key, "3600")
<<19, 219, 50, 5, 1, 39, 84, 50, 141, 123, 3, 12, 60, 31, 81, 114, 171, 189, 89,
  13, 111, 243, 53, 50, 228, 50, 173, 173, 161, 193, 179, 4>>`

SHA256 returns 32 bytes, not 20. hotp seems to assume SHA-1 - which is fine, except if it is used for totp it should also support SHA256 and SHA512

@franc
Copy link
Contributor Author

franc commented Mar 2, 2021

this seems to work:

    Digest = crypto:hmac(DigestMethod, Key, Msg),
    <<Ob:8>> = binary:part(Digest, {byte_size(Digest), -1}),
    O = Ob band 15,

@franc
Copy link
Contributor Author

franc commented Mar 2, 2021

:crypto.hmac is deprecated though

@franc
Copy link
Contributor Author

franc commented Mar 2, 2021

but there is this drop-in replacement: Digest = crypto:mac(hmac, DigestMethod, Key, Msg),

I'll see if i can get a pr up

franc added a commit to franc/pot that referenced this issue Mar 2, 2021
yuce#29

support sha256
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant