search

Kunzisoft / KeePassDX

Lightweight vault and password manager for Android, KeePassDX allows editing encrypted data in a single file in KeePass format and fill in the forms in a secure way.
https://www.keepassdx.com/
GNU General Public License v3.0
4.57k stars 269 forks source link

TOTP can not be generated when OTP key ends with %3d #585

Closed OLLI-S closed 3 years ago

OLLI-S commented 4 years ago

Describe the bug In KeePassXC I added OTP keys for several websites. Some of them have %3d at the end (several times, like %3d%3d%3d%3d).

KeePassXC and also KeePass2Android can generate the TOTP for these entries. KeePassDX can not generate the TOTP.

Expected behavior The TOTP should be generated for these entries (maybe you ignore the %3d)

Keepass Database

KeePassDX

Android

J-Jamet commented 4 years ago

It is not a valid ASCII character. It matches the =, and the = is used in the configuration of the otpauth URL.

I will improve the code to remove characters not supported for OTP. In any case, this character is not part of your secret key.

J-Jamet commented 4 years ago

Can you indicate the formatting of the OTP field that is problematic in your case? Without real secret key.

OLLI-S commented 4 years ago

I searched in KeePassXC for attr:%3d and found 4 entries containing "%3d" in the field "otp":

I have to admit that I was using KeePass before I switched to KeePassXC and added most OTP keys in KeePass. So It could have been my fault (but I have no idea how this could have happened). But KeePassXC can generate valid keys out of them!

Here are two keys where I replaced real data with an "x" (except the "%3d"): key=XXXXXXXXXXXXXXXXXXXXXXXXXX%3d%3d%3d%3d%3d%3d key=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX%3d%3d%3d%3d

I really don't know how this happened...