search

tadeck / onetimepass

One-time password library for HMAC-based (HOTP) and time-based (TOTP) passwords
http://otp.readthedocs.org/
MIT License
681 stars 101 forks source link

Add the ability to specify a base time and a window for TOTP #13

Closed angelosarto closed 9 years ago

angelosarto commented 9 years ago

extended the library to allow the time to be specified when requesting/verifying a TOTP time code - useful when trying to validate against a particular moment in the past/future and in testing clients. Also added a window parameter to TOTP verification - the window specifies how many intervals of tolerance to allow - a tolerence of 0 (the default) means the codes must fall in the same interval. The window extends in both directions - a window of 1 will have three valid codes: 1 interval behind, the current interval, and one interval ahead.

tadeck commented 9 years ago

@angelosarto commented:

extended the library to allow the time to be specified when requesting/verifying a TOTP time code - useful when trying to validate against a particular moment in the past/future and in testing clients. Also added a window parameter to TOTP verification - the window specifies how many intervals of tolerance to allow - a tolerence of 0 (the default) means the codes must fall in the same interval. The window extends in both directions - a window of 1 will have three valid codes: 1 interval behind, the current interval, and one interval ahead.

Aside from failing tests and the comments I have to specific lines, I disagree about semantics of window. I believe window is used not necessarily to accommodate for "skewed time" (which may look like possible intent in this pull request), but rather for the case when timers are synchronized properly, but service (server/app) receives token that user has entered second ago, and that was valid at the time user started sending it.

This just accommodates for the delays in user sending the data, not to him predicting future, so it should rather allow to check x windows in the past, but 0 windows in the future.

What do you think about that?

angelosarto commented 9 years ago

I made at least one additional mistake here -- I meant to do this pull against my fork - I was pretty sure it wasn't ready for inclusion.

Thank you for providing an awesome review. I will close this and work on this a bit more as this is nowhere near ready!

angelosarto commented 9 years ago

I think the intent of window was to cross over the feature found in liboath as found in the oath_totp_validate function which has a window parameter which functions in a similar way.