search

jchambers / java-otp

A one-time password (HOTP/TOTP) library for Java
MIT License
456 stars 122 forks source link

Using a secret #5

Closed arifainchtein closed 6 years ago

arifainchtein commented 6 years ago

Hello, Given that TOTP needs a shared secret string, how will you generate the code using your library starting from a string? I am planning to embed your library in an app where the user will have another TOTP compliant app to generate the user code that will be compared against the TOTP created by your library. In your example usage you start with a random key. Any chance you could create an example that starts with a string as a shared secret?

thanks

jchambers commented 6 years ago

Any chance you could create an example that starts with a string as a shared secret?

Flatly, no. Sorry. Key management is a Serious Security Topic™, and I don't want to do anything that could be construed as giving out security advice. If you're just asking "how do I turn persisted data into a key using Java," you might start your research with the SecretKeyFactory interface.