search

pyauth / pyotp

Python One-Time Password Library
https://pyauth.github.io/pyotp/
Other
3.03k stars 326 forks source link

Modify OTP generation to run in constant time #148

Closed Changaco closed 1 year ago

Changaco commented 1 year ago

This commit fixes the OTP.generate_otp() method to run in constant time.

kislyuk commented 1 year ago

Thanks. The original implementation was modeled after the Java reference implementation in the RFC, which did not incorporate any constant time considerations. While I don't think it's possible to leverage this into a successful attack if the implementer follows the security guidance in the RFC and in PyOTP documentation (in particular, implements throttling), if that's not followed it may be feasible to do better-than-brute-force (though I still can't imagine building an attack from this with TOTP... maybe with HOTP if you can increment the oracle's counter at will - which implies violating other parts of the security guidance as well).

kislyuk commented 1 year ago

Released in v2.8.0, please test

Changaco commented 1 year ago

You're right that the problem comes from the reference implementation in the RFC. I've submitted an errata: https://www.rfc-editor.org/errata/eid7271