search

pyauth / pyotp

Python One-Time Password Library
https://pyauth.github.io/pyotp/
Other
2.95k stars 321 forks source link

Question: How do you generate password from string param #100

Closed yoshi486x closed 4 years ago

yoshi486x commented 4 years ago

I needed to generate a TOTP from the given secure secret pyotp@example.comGITHUB. So, I encoded the secure secret by base32 beforehand, and the authentication worked! But I'm not sure if this is the right approach. Could somebody tell me if this is right or not? 

secret = b'pyotp@example.comGITHUB'
secret = base64.b32encode(secret)
totp = pyotp.TOTP(secret)
totp.now() # => '199731'
kislyuk commented 4 years ago

That should not be the secret. The secret should be a random string of digits and characters that is shared between the server and the client.

Please read and understand https://en.wikipedia.org/wiki/Time-based_One-time_Password_algorithm and https://tools.ietf.org/html/rfc6238 before you continue.

yoshi486x commented 4 years ago

Yes, I understand that the secret should be random for a production environment, but this is for a mock project. And in the descriptions you shared, I recognized that the secret could be any arbitrary byte string. So I suppose that my execution process was alright in the algorithm point of view.

Please let me know if I still have any miss understanding.

kislyuk commented 4 years ago

Your approach appears fine otherwise, but you may want to consult the OWASP guides to do a broader review of your application's security.

yoshi486x commented 4 years ago

Alright! Thank you for the comment!

tilkinsc commented 4 years ago

When you generate new OTP secrets, make sure you use a cryptographically secure random.