4 ms·
Mind you: to wit, the TOTP RFC defers to the HOTP RFC, and that insists on at least 128 bits or something, so 16 pseudorandom bytes, not 16 ASCII bytes as you s
by lvh 8y ago
Mind you: to wit, the TOTP RFC defers to the HOTP RFC, and that insists on at least 128 bits or something, so 16 pseudorandom bytes, not 16 ASCII bytes as you said :) But if you grep the article for "10 byte", you'll see the part where it claims that confusion about byte counts of encoded or unencoded secret results in the 10 byte claim.
- _cs2017_ 8y agoActually, it says that implementations use 16 bytes of ASCII and that's only equivalent to 10 random bytes. It doesn't say implementations use 10 bytes of ASCII.