mirror of
https://github.com/antonioribeiro/google2fa.git
synced 2026-04-25 16:15:49 +03:00
[GH-ISSUE #57] Adding any prefix generates an unusable secret #495
Labels
No labels
bug
pull-request
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
starred/google2fa#495
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @melvinchia on GitHub (Mar 7, 2017).
Original GitHub issue: https://github.com/antonioribeiro/google2fa/issues/57
When I tried using no prefix:
$otp_secret = $google2fa->generateSecretKey(16);It generates a usable secret, tested by Authy on iOS (manually key in the secret, or QR code scan)
When I tried using a blank prefix:
$otp_secret = $google2fa->generateSecretKey(16, '');It generates a usable secret, tested by Authy on iOS (manually key in the secret, or QR code scan)
When I add a prefix prefix:
$otp_secret = $google2fa->generateSecretKey(16, 'm');$otp_secret = $google2fa->generateSecretKey(16, 'mel');$otp_secret = $google2fa->generateSecretKey(16, 'melvin');All 3 lines yield an error, whether manually keying in the secret, or QR code scan.
Anybody else encounter this problem?
@JC5 commented on GitHub (Apr 2, 2017):
Yes, but this is a problem I only encounter on iOS.
https://github.com/firefly-iii/firefly-iii/issues/624
@melvinchia commented on GitHub (Apr 3, 2017):
Strange, I received a suggestion thru email, but I don't see it on Github.
Is there a reason why it didn't appear?
On Mon, Mar 20, 2017 at 7:34 AM, Milan notifications@github.com wrote:
@melvinchia commented on GitHub (Apr 3, 2017):
What puzzles me is, there's also a way to generate a "more secure" secret key using:
$otp_secret = $google2fa->generateSecretKey(32);
So is it that what is passed in "must add up to 16 or 32 characters", or does subtracting number of letters in the prefix from the number passed to the generateSecretKey function matter in this case?
@melvinchia commented on GitHub (Apr 10, 2017):
@antonioribeiro , just to clarify, the purpose of the following (sub)function:
$secretKey = $google2fa->generateSecretKey(16, $userId);
Was documented as "prefixing the secret key", whereby a $userId is provided to the function, which would use the $userId to prefix the salt to generate a 16-bit key. Similarly if 32 is used, the purpose of the $userId is to prefix the salt to generate the key.
Now the explanation seems to be that I have to provide a 16/32-character (padded or full length) $userId which becomes the salt, instead of merely being just a prefix (original intention to increase security)? Am I understanding the explanation wrong here?
@antonioribeiro commented on GitHub (Jun 17, 2017):
@melvinchia, I just rewrote that part, trying to make it more clear:
You may prefix your secret keys, but you have to understand that, as your secret key must have length in power of 2, your prefix will have to have a complementary size. So if your key is 16 bytes long, if you add a prefix it must be also 16 bytes long, but as your prefixes will be converted to base 32, the max length of your prefix is 10 bytes. So, those are the sizes you can use in your prefixes:
And it can be used like so:
I've also made a demo site for it: https://pragmarx.com/google2fa.