Hi!
I would like to propose improving the implementation of 2FA with TOTP: Would it be possible to implement an algorithm that uses a secret length of more than 128 bits?
Currently, the secret length is 80 bits (16 characters x 5 bits), and this triggers a warning in authentication apps (FreeOTP warning: TOKEN IS UNSAFE! The token you are attempting to add contains weak cryptographic parameters. Use of this token is strongly discouraged! Please alert your token provider.)
The RFC 4226 (https://datatracker.ietf.org/doc/html/rfc4226#autoid-4 ) states "The algorithm MUST use a strong shared secret. The length of the shared secret MUST be at least 128 bits. This document RECOMMENDs a shared secret length of 160 bits."
Do you think this could be implemented in future releases? I don't know if it would involve a lot of work, but if it doesn't, I think it could really help improve the tool's security standards!
Thank you very much for maintaining this powerful open-source tool!
I would like to propose improving the implementation of 2FA with TOTP: Would it be possible to implement an algorithm that uses a secret length of more than 128 bits?
Currently, the secret length is 80 bits (16 characters x 5 bits), and this triggers a warning in authentication apps (FreeOTP warning: TOKEN IS UNSAFE! The token you are attempting to add contains weak cryptographic parameters. Use of this token is strongly discouraged! Please alert your token provider.)
The RFC 4226 (https://datatracker.ietf.org/doc/html/rfc4226#autoid-4 ) states "The algorithm MUST use a strong shared secret. The length of the shared secret MUST be at least 128 bits. This document RECOMMENDs a shared secret length of 160 bits."
Do you think this could be implemented in future releases? I don't know if it would involve a lot of work, but if it doesn't, I think it could really help improve the tool's security standards!
Thank you very much for maintaining this powerful open-source tool!
Comment