5 ms·
So.. using 20 random bytes instead of 10 should be enough to make this pretty much infeasible?
by mfontani 8y ago
So.. using 20 random bytes instead of 10 should be enough to make this pretty much infeasible?
- haggy 8y agoYea until quantum computing is mainstream... Kidding, kidding! Im just being a troll :D
- lvh 8y ago10 bytes, or 80 bits, is cutting it, but realistically fine for now if it's actually random. The problem isn't that it's 10 bytes, but rather that it's 10 bytes of _ASCII text_. English prose is only about a bit per letter (!!!). If you randomly select 10 base32 symbols: each symbol has log2 32 = 5 bits of entropy (as opposed to the full 8 it ought to have if it was a randomly selected byte), and 10*5=50 is insufficient :) To understand why prose entropy is so low: if I tell you the sentence "Old McDonald had a" then you can predict the next word with approximately perfect accuracy. Clearly, if they were random they would be independent. If your threat model includes quantum search, you need twice as many bits. (I'm intentionally ignoring that HMAC-SHA1 only has a 160 bit output space.)
- _cs2017_ 8y agoThe minimum allowed (and the common default) is 16 bytes of ASCII text, not 10.
- lvh 8y agoSure? The article addresses this: the RFC says it's the minimum, but apparently most clients will allow less, and sometimes (allegedly) servers produce less. I'm not sure I understand your comment: it's still responsive to GP's question.
- _cs2017_ 8y agoCould you quote the sentence you're referring to?
- deleted 8y ago[deleted]
- lvh 8y agoMind you: to wit, the TOTP RFC defers to the HOTP RFC, and that insists on at least 128 bits or something, so 16 pseudorandom bytes, not 16 ASCII bytes as you said :) But if you grep the article for "10 byte", you'll see the part where it claims that confusion about byte counts of encoded or unencoded secret results in the 10 byte claim.
- _cs2017_ 8y agoActually, it says that implementations use 16 bytes of ASCII and that's only equivalent to 10 random bytes. It doesn't say implementations use 10 bytes of ASCII.
- stephenr 8y ago.. had a multi-national franchise selling barely-food?
- icebraining 8y agoNope, the MacDonalds never owned a MacDonald's outside the US.
- stephenr 8y agoI mean, it was just a joke, but perhaps you need to lookup what 'franchise' means.
- icebraining 8y agoI know it was a joke, I just decided to play it straight :) > perhaps you need to lookup what 'franchise' means. Right, but doesn't really matter; there was never any McDonald's at all outside the US before Ray Kroc bought out the McDonalds, so they never had a multinational.