search

BrandonPotter / GoogleAuthenticator

Simple, easy to use server-side two-factor authentication library for .NET that works with Google Authenticator and Authy.
Apache License 2.0
373 stars 126 forks source link

Update HMAC SHA #197

Closed capegreg closed 10 months ago

capegreg commented 10 months ago

Can SHA in GenerateHashedCode be updated from HMACSHA1 to HMACSHA256?

ahwm commented 10 months ago

This is in progress, but as noted on #198 a number of popular OTP apps don't support SHA256 including: Microsoft Authenticator and Authy so it's probably not recommended unless you can control the apps being used to some extent.

Given the location where the HMAC is generated there doesn't appear to be a big push or concern (it's only used to generate the time codes).

capegreg commented 10 months ago

Understood and agree with you regarding its isolated use. Interesting that some OTP apps don't support SHA256 yet. Microsoft Authenticator is one of my supported OTP apps. Thank you, Adam.

capegreg commented 10 months ago

Closing issue.

flytzen commented 9 months ago

@capegreg FYI: @ahwm made the change and v 3.2 is on its way to Nuget with this added.

Thank you both.