Google Authenticator and Authy App generating invalid codes

It appears that neither the Google Authenticator nor the Authy app generate valid codes, whereas other TOTP apps such as iPhone's built-in 2FA/password manager and the FreeOTP+ app on Android work fine.

My suspicion is that Google and/or Authy updated something in their codebases so that they're no longer compatible with the way the google2fa library generates either the secret or the valid auth-codes.

I tested both by scanning QR codes and by manually entering the secrets.

I also ensured that NTP is running on the server and that the date/time match up. Just in case I even tried passing an extremely large $window (100) to $google2fa->verifyKey() but that doesn't seem to be the issue.

Example Code:

<?

use PragmaRX\Google2FA\Google2FA;
use BaconQrCode\Renderer\ImageRenderer;
use BaconQrCode\Renderer\Image\ImagickImageBackEnd;
use BaconQrCode\Renderer\RendererStyle\RendererStyle;
use BaconQrCode\Writer;

$google2fa = new Google2FA;
$google2fa->setAlgorithm('sha512');
$google2fa->setEnforceGoogleAuthenticatorCompatibility(true);

$user = array(
    "username" => "tucker",
    "secret" => "2HJTI6WHCC362T5Y" // a previously generated secret
);

if (isset($_GET["generate"])) {
    // to generate a new secret and thus QR code below too
    $user["secret"] = $google2fa->generateSecretKey();
}

$realCode = $google2fa->getCurrentOtp($user["secret"]); // get current valid code to compare

if ($_SERVER["REQUEST_METHOD"] == "POST") {
    // verify the code
    $window = 4;
    $valid = $google2fa->verifyKey($user["secret"], $_POST["code"], $window);
    if (!$valid) {
        print "INVALID CODE";
    } else {
        print "VALID CODE";
    }
}

// now to generate and print the QR code
$g2faUrl = $google2fa->getQRCodeUrl(
    'Google2fa Test',
    $user["email"],
    $user["secret"]
);

$writer = new Writer(
    new ImageRenderer(
        new RendererStyle(400),
        new ImagickImageBackEnd()
    )
);

$qrcode_image = base64_encode($writer->writeString($g2faUrl));

print "
<div style='text-align:center'>
    <h2>2FA Test using google2fa</h2>
    <b>Secret:</b> " . $user["secret"] . "<br>
    <b>QR Code:</b><br>
    <img src='data:image/png;base64, " . $qrcode_image . " '/>
    <form method='post'>
        <label for='code'>2FA Code</label>
        <input name='code'>
        <button type='submit'>Submit</button>
        <br><b>Current Valid Code:</b> " . $realCode . "<br>
    </form>
</div>";

PHP Version

PHP 7.2.20

antonioribeiro / google2fa

Google Authenticator and Authy App generating invalid codes #170