BastiaanJansen / otp-java

A small and easy-to-use one-time password generator library for Java implementing RFC 4226 (HOTP) and RFC 6238 (TOTP).
MIT License
186 stars 30 forks source link

TOTPGenerator .withPeriod() question #43

Closed ohaya closed 3 years ago

ohaya commented 3 years ago

If we create a TOTPGenerator with ".withPeriod()" of less than a second (e.g., ".withPeriod(Duration.ofMillis(1))" ), we get an exception:

java.lang.ArithmeticException: / by zero at com.bastiaanjansen.otp.TOTPGenerator.calculateCounter(TOTPGenerator.java:164) at com.bastiaanjansen.otp.TOTPGenerator.generate(TOTPGenerator.java:49) . .

The reason we are trying this is that, from our testing, it appears that when the TOTPGenerator .generate() method is called, it will generate the same/identical code if the calls are within that Duration.ofSeconds(), i.e., if the the generator is created with .withPeriod(DurationofSeconds(10)), all calls to .generate(), within a 10 second period, return the same code.

We are looking at OTP-Java to generate OTP email codes, so that would mean that if we had requests (from different users) for several OTP email codes within a period of time, then the OTP-Java .generate() method would potentially provide us with the same code for several users.

Am I misinterpreting how this works?

Thanks, Jim