mirror of
https://github.com/antonioribeiro/google2fa.git
synced 2026-04-27 09:05:49 +03:00
[GH-ISSUE #41] Use a more secure Base32 encoding algorithm #251
Labels
No labels
bug
pull-request
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
starred/google2fa#251
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @cwt137 on GitHub (Jul 28, 2016).
Original GitHub issue: https://github.com/antonioribeiro/google2fa/issues/41
Please use the paragonie/constant_time_encoding Composer package for doing Base32 encoding. It helps to prevent cache-timing attacks.
@aik099 commented on GitHub (Jul 28, 2016):
@cwt137 , please explain how base32 operations can be used to compromise library?
@aik099 commented on GitHub (Jul 28, 2016):
Currently base32 is used to generate 5 OTP codes, that are compared with user provided OTP code using
hash_equals(timing attack safe) function. If I'm not mistaken, then time how long it takes to generate these 5 OTP codes can't be used to perform Timing Attack (I guess that's what you're worried about).@cwt137 commented on GitHub (Jul 29, 2016):
It is the generation of the secret key that is susceptible to a timing attack and should use constant time base32 encoding
@antonioribeiro commented on GitHub (Jun 17, 2017):
Done.
Sorry for the huge delay.
Thank you!