search

sec51 / twofactor

Golang two factor authentication library
ISC License
217 stars 66 forks source link

Supported Authenticators #11

Open knighthawkbro opened 6 years ago

knighthawkbro commented 6 years ago

Looks like Google Authenticator (GA) only support SHA1 URIs even though it says it support 256/512. I have tested it with a few other authenticators on iPhone:

Not working:

Working:

Is there any problem with the Base32 padding or URI encoding that could be preventing other apps from working properly?

I saw this article that GA has a potential problem and recommends using their authenticator for their Sophos firewall. Let me know what you think.

EDIT: Funny how Google helped with the SHA1 Collision Attack and Google Authenticator still only supports SHA1. Is there any problem to that?

nugget commented 6 years ago

Google Authenticator explicitly does not support SHA256 or SHA512. It only supports SHA1.

From the GA docs:

Currently, the algorithm parameter is ignored by the Google Authenticator implementations.

Similarly, Google Authenticator only supports 6 digit codes:

Currently, the digits parameter is ignored by the Google Authenticator implementations.

I have tested the function of this library using SHA512 as the algorithm using 1Password's TOTP feature and it worked fine. It also works with 8 digit codes without any problems.