ganesh47/totp-basic

A totp library in ts

totp-basic's Issues

Security consideration

Hey,

Thanks for writing a totp implementation using webcrypto 👍

Just wanted to let you know in the verifyTOTP function you should use crypto.subtle.verify to guard against timing attacks.
Right now because of the string comparison it will return false as soon as a mismatching character is found.

This behavior can be exploited in a timing attack, where an attacker makes multiple verification attempts and measures the time each attempt takes, using the timing information to gradually determine the correct OTP.

Let me know if you need help / input fixing this.