4 ms·
The minimum allowed (and the common default) is 16 bytes of ASCII text, not 10.
by _cs2017_ 8y ago
The minimum allowed (and the common default) is 16 bytes of ASCII text, not 10.
- lvh 8y agoSure? The article addresses this: the RFC says it's the minimum, but apparently most clients will allow less, and sometimes (allegedly) servers produce less. I'm not sure I understand your comment: it's still responsive to GP's question.
- _cs2017_ 8y agoCould you quote the sentence you're referring to?
- deleted 8y ago[deleted]
- lvh 8y agoMind you: to wit, the TOTP RFC defers to the HOTP RFC, and that insists on at least 128 bits or something, so 16 pseudorandom bytes, not 16 ASCII bytes as you said :) But if you grep the article for "10 byte", you'll see the part where it claims that confusion about byte counts of encoded or unencoded secret results in the 10 byte claim.
- _cs2017_ 8y agoActually, it says that implementations use 16 bytes of ASCII and that's only equivalent to 10 random bytes. It doesn't say implementations use 10 bytes of ASCII.