{"action":"created","issue":{"url":"https://api.github.com/repos/usnistgov/ACVP/issues/297","repository_url":"https://api.github.com/repos/usnistgov/ACVP","labels_url":"https://api.github.com/repos/usnistgov/ACVP/issues/297/labels{/name}","comments_url":"https://api.github.com/repos/usnistgov/ACVP/issues/297/comments","events_url":"https://api.github.com/repos/usnistgov/ACVP/issues/297/events","html_url":"https://github.com/usnistgov/ACVP/issues/297","id":310102849,"number":297,"title":"TOTP specification","user":{"login":"smuellerDD","id":4526319,"avatar_url":"https://avatars1.githubusercontent.com/u/4526319?v=4","gravatar_id":"","url":"https://api.github.com/users/smuellerDD","html_url":"https://github.com/smuellerDD","followers_url":"https://api.github.com/users/smuellerDD/followers","following_url":"https://api.github.com/users/smuellerDD/following{/other_user}","gists_url":"https://api.github.com/users/smuellerDD/gists{/gist_id}","starred_url":"https://api.github.com/users/smuellerDD/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/smuellerDD/subscriptions","organizations_url":"https://api.github.com/users/smuellerDD/orgs","repos_url":"https://api.github.com/users/smuellerDD/repos","events_url":"https://api.github.com/users/smuellerDD/events{/privacy}","received_events_url":"https://api.github.com/users/smuellerDD/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2018-03-30T16:03:07Z","updated_at":"2018-03-30T20:33:39Z","closed_at":null,"author_association":"NONE","body":"Jason informed me about the following TOTP implementation details:\r\n\r\n- step size: 30 seconds\r\n- digit size: 6 digits\r\n\r\nI would assume that HMAC SHA-1 is used for the HOTP algorithm. Can you please confirm that we use HMAC-SHA1?\r\n\r\nNow, the issue is the seed value. It seems to be a base64 encoded string. When decoding it with base64 I get a 24 byte binary value that I would use for the TOTP. However, the server rejects the password with 401. Note, my base64 decoder passes all tests from RFC4648 and generates the same output as other base64 decoders.\r\n\r\nJason mentioned that developers on your side indicated that the seed value is a base32 encoded value. However, I would not be sure how to decode that value because base32 as specified in RFC4648 only defines upper case ASCII characters. However, my seed file contains lower case and upper case ASCII characters. When using the base32 implementation from the Linux coreutils package, it says it cannot decode the seed data. Thus, if it is base32, may I ask for a pointer to the specification used for the base32 algorithm?\r\n\r\nAs a side note, I also tried to use the seed data file straight as a TOTP seed value without any conversion. That returned a 401 error as well.\r\n\r\nThanks"},"comment":{"url":"https://api.github.com/repos/usnistgov/ACVP/issues/comments/377616598","html_url":"https://github.com/usnistgov/ACVP/issues/297#issuecomment-377616598","issue_url":"https://api.github.com/repos/usnistgov/ACVP/issues/297","id":377616598,"user":{"login":"locksmithone","id":930858,"avatar_url":"https://avatars1.githubusercontent.com/u/930858?v=4","gravatar_id":"","url":"https://api.github.com/users/locksmithone","html_url":"https://github.com/locksmithone","followers_url":"https://api.github.com/users/locksmithone/followers","following_url":"https://api.github.com/users/locksmithone/following{/other_user}","gists_url":"https://api.github.com/users/locksmithone/gists{/gist_id}","starred_url":"https://api.github.com/users/locksmithone/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/locksmithone/subscriptions","organizations_url":"https://api.github.com/users/locksmithone/orgs","repos_url":"https://api.github.com/users/locksmithone/repos","events_url":"https://api.github.com/users/locksmithone/events{/privacy}","received_events_url":"https://api.github.com/users/locksmithone/received_events","type":"User","site_admin":false},"created_at":"2018-03-30T20:33:39Z","updated_at":"2018-03-30T20:33:39Z","author_association":"NONE","body":"Python has one that seems to correctly implement TOTP/HOTP per the RFCs\n(onetimepass), but, well, it's python.\n\nMP\n\nOn Fri, Mar 30, 2018 at 3:09 PM, Barry Fussell <notifications@github.com>\nwrote:\n\n> @smuellerDD <https://github.com/smuellerDD> @hbooth\n> <https://github.com/hbooth> I had an email exchange with Harold yesterday\n> after I encountered exactly what you described. He said \"I can work with\n> you on Monday to get you some incremental examples or even better I will\n> work with the developer to find a library that better implements the TOTP\n> and HOTP RFCs.\"\n>\n> —\n> You are receiving this because you are subscribed to this thread.\n> Reply to this email directly, view it on GitHub\n> <https://github.com/usnistgov/ACVP/issues/297#issuecomment-377611393>, or mute\n> the thread\n> <https://github.com/notifications/unsubscribe-auth/AA40Kp4PhaJnViAjJ1k4jZsWaV4dVGmhks5tjpECgaJpZM4TB2fN>\n> .\n>\n"}}
{"actor":{"display_login":"locksmithone"}}