search

freeotp / freeotp-android

Apache License 2.0
1.42k stars 302 forks source link

HOTP counter 0 bug #54

Closed npmccallum closed 1 year ago

npmccallum commented 8 years ago

Reported by xlynx on 9 Feb 2015 03:27 UTC FreeOTP Version 1.5 (16) Android 4.3

I had a lot of trouble adding my Ubuntu One / Launchpad account, and finally realised why.

As a simple test, add an account:

First field: anything Second field: anything Secret: DINBUGX7 Type: HOTP All other fields as default. Note that "Counter" defaults to 0.

The first password will be 969901, but where does this come from? It should be 609693:

$ oathtool -c 0 -b DINBUGX7 609693

FreeOTP gives 609693 at counter 1. In fact, Google Authenticator, Duo Mobile and oathtool all give FreeOTP's second result as their first. Therefore I believe FreeOTP's counter position 0 is erroneous, and all positions are offset by 1.

npmccallum commented 8 years ago

Comment by adelton on 8 Nov 2015 18:15 UTC Right, this seems like a bug since the behaviour differs from output in Appendix D of RFC 4226:

For key 12345678901234567890 / 0x3132333435363738393031323334353637383930 / GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ, the first two codes should be 755224 and 287082, not 094451 and 755224.

josh-cain commented 7 years ago

Doh! lost about half a day to this one. Was doing some OTP integration with Keycloak and thought it was not generating my codes properly.

Looks like it was fixed in 844d4663f7380214d2fae06873ce15aa51a371f7. Can we close this?