Comments (13)
Thank you for your help, this works like a charm.
from java-totp.
Hey,
Thanks for trying out the library!
When generating the QR code, what hashing algorithm, time period, and digits are you using?
(If you can provide code sample that would be good)
Can you also provide the code you're using to verify the codes?
from java-totp.
Precisely,
I dont want to use QR code, assuming the user has the secret and the code.
Here is my code :
SystemTimeProvider timeProvider = new SystemTimeProvider();
SecretGenerator generator = new DefaultSecretGenerator();
String secret = generator.generate();
CodeGenerator codeGenerator = new DefaultCodeGenerator(HashingAlgorithm.SHA512);
String code = codeGenerator.generate(secret, timeProvider.getTime());
Thread.sleep(2000);
CodeVerifier codeVerifier = new DefaultCodeVerifier(codeGenerator, timeProvider);
boolean valid = codeVerifier.isValidCode(secret, code);
System.out.println(code);
System.out.println(secret);
System.out.println(valid);
from java-totp.
Hey,
I see what's going on here - in your specific example I assume you are "bypassing" the user-side MFA app for the purpopse of a test by calling the codeGenerator.generate()
method directly in code, but this is actually being called in an incorrect way.
The second parameter to this method isn't the current UNIX time (as is being passed in the above snippet), but the time counter, which is the current UNIX time divided by the time period (see code here: https://github.com/samdjstevens/java-totp/blob/master/src/main/java/dev/samstevens/totp/code/DefaultCodeVerifier.java#L30)
So if you changed the code generation bit in your test above to the following:
String code = codeGenerator.generate(secret, Math.floorDiv(timeProvider.getTime(), 30));
Then the generated code would be valid.
from java-totp.
Hello,
I generating a code exactly like benjaminpech and I then have the problem that the code is not reliably validated after a certain amount of time passes. My code is
CodeGenerator codeGenerator = new DefaultCodeGenerator();
TimeProvider timeProvider = new SystemTimeProvider();
DefaultCodeVerifier verifier = new DefaultCodeVerifier(codeGenerator, timeProvider);
SecretGenerator secretGenerator = new DefaultSecretGenerator();
String secret = secretGenerator.generate();
int codeTimePeriod = 30;
String code = "";
try {
code = codeGenerator.generate(secret, Math.floorDiv(timeProvider.getTime(), codeTimePeriod));
} catch (CodeGenerationException ex) {
LOGGER.error("Error when trying to generate code", ex);
}
try {
Thread.sleep(23000);
} catch (InterruptedException ex) {
Logger.getLogger(Main.class.getName()).log(Level.SEVERE, null, ex);
}
boolean isValid = verifier.isValidCode(secret, code);
The isValid value is sometimes true, sometimes false. I would expect that if the sleep is less then 30000 that the code is always valid, sometimes it is also not valid with 23000 milliseconds sleep. What am I doing wrong?
Kind regards
from java-totp.
The Floordiv means that the code generated may have less than 23 seconds of validity.
Waiting 23 seconds means that on average 23/30 attempts would fail to validate.
If you allow validation of the next/previous then it would always work.
from java-totp.
The Floordiv means that the code generated may have less than 23 seconds of validity.
Waiting 23 seconds means that on average 23/30 attempts would fail to validate.If you allow validation of the next/previous then it would always work.
Ok, thank you for the reply, then that is what I am not understanding. If the time period is 30s, I generate the code, is the code not valid for the next 30 seconds? I.E should it not always be valid after the Thread.sleep(23000) , as 23 seconds of waiting is less then 30?
To make it more specific: I generate a code at 10:00:00 with a CodeGenerator that has a time window of 30s - should not any code generated between 10:00:00 and 10:00:30 be valid until 10:00:30? And should it not become invalid at 10:00:31?
from java-totp.
This explanation is an oversimplification, but it should help you understand the concept.
Let's assume that generated codes are good for 30 seconds. The codes are locked to predefined intervals (e.g. 10:00:00.000 to 10:00:29.999, 10;00:30.000 to 10:00:59.999, 10:01:00.000 to 10:01:29.999). The actual intervals are defined by the algorithm that generates the codes.
If you generate a code at 10:00:51.783, that code will only be good for 8.216 seconds (i.e. the remainder of the predefined interval). You can see this in practice when you open an authenticator app and look at a generated code. The code will be in the process of expiring. Unless you time it perfectly, it will have less than 30 seconds remaining before a new code is generated.
from java-totp.
To make it more specific: I generate a code at 10:00:00 with a CodeGenerator that has a time window of 30s - should not any code generated between 10:00:00 and 10:00:30 be valid until 10:00:30? And should it not become invalid at 10:00:31?
No thats not correct, the time periods of 30 seconds are fixed going back to the Epoch Date (midnight 1st Jan 1970) The period you generate the code in is already predefined. so you generate at 10:00:00, but the validity period could be 09:59:50 to 10:00:20, so it will only be valid for 20 seconds.
from java-totp.
To make it more specific: I generate a code at 10:00:00 with a CodeGenerator that has a time window of 30s - should not any code generated between 10:00:00 and 10:00:30 be valid until 10:00:30? And should it not become invalid at 10:00:31?
No thats not correct, the time periods of 30 seconds are fixed going back to the Epoch Date (midnight 1st Jan 1970) The period you generate the code in is already predefined. so you generate at 10:00:00, but the validity period could be 09:59:50 to 10:00:20, so it will only be valid for 20 seconds.
Ok, then I again do not understand. If the periods I am working with are 30s large how could a period start at 09:59:50 ?
from java-totp.
To make it more specific: I generate a code at 10:00:00 with a CodeGenerator that has a time window of 30s - should not any code generated between 10:00:00 and 10:00:30 be valid until 10:00:30? And should it not become invalid at 10:00:31?
No thats not correct, the time periods of 30 seconds are fixed going back to the Epoch Date (midnight 1st Jan 1970) The period you generate the code in is already predefined. so you generate at 10:00:00, but the validity period could be 09:59:50 to 10:00:20, so it will only be valid for 20 seconds.
Ok, then I again do not understand. If the periods I am working with are 30s large how could a period start at 09:59:50 ?
Sorry bad example, for 30s you are correct it will always begin at 10:00:00 and finish at 10:00:30 regardless of when you generate the code.
from java-totp.
To make it more specific: I generate a code at 10:00:00 with a CodeGenerator that has a time window of 30s - should not any code generated between 10:00:00 and 10:00:30 be valid until 10:00:30? And should it not become invalid at 10:00:31?
No thats not correct, the time periods of 30 seconds are fixed going back to the Epoch Date (midnight 1st Jan 1970) The period you generate the code in is already predefined. so you generate at 10:00:00, but the validity period could be 09:59:50 to 10:00:20, so it will only be valid for 20 seconds.
Ok, then I again do not understand. If the periods I am working with are 30s large how could a period start at 09:59:50 ?
Sorry bad example, for 30s you are correct it will always begin at 10:00:00 and finish at 10:00:30 regardless of when you generate the code.
Ok, thank you. So back to the original question - if I generate a code at 10:00:15 with a time window of 30s, the code is valid only until 10:00:30?
from java-totp.
Ok, thank you. So back to the original question - if I generate a code at 10:00:15 with a time window of 30s, the code is valid only until 10:00:30?
yes
from java-totp.
Related Issues (20)
- Add warning about apps that don't support alternative hashing algorithms HOT 5
- invalidate old otp values HOT 2
- RFE: Validate method for additional security HOT 6
- Storing 2FA status HOT 1
- NtpTimeProvider ignores NTP data HOT 4
- Basic usage help needed HOT 6
- How to confirm whether the QR code has been scanned? HOT 6
- Feature Request: Configurable QR Code color HOT 1
- Configure border size
- Improve documentation of generator regarding counter-parameter HOT 6
- Null pointer Exception while calling ZxingPngQrGenerator generate method HOT 4
- qr code doesn't work in ios google authenticator HOT 2
- Is this library suitable for production use? HOT 2
- spring.factories not working on Spring Boot 3
- TotpAutoConfiguration is not loaded automatically by Spring Boot 3 HOT 2
- Display Secret with authenticator-compatible/matching-hashing-algorithm string HOT 2
- Library Show "Attack Complexity: HIGH", "Attack Vector: NETWORK" And "Integrity Impact: HIGH" HOT 1
- Project still active??
- When will a version supporting Springboot3 be released?
- Unable to verify TOTP using google/microsoft authenticator applications HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from java-totp.