3 ms·
> TOTP systems are supposed to implement a sliding window to account for reasonable clock differences, usually within 5 minutes. The default is 30 seconds, as
by nfoz 5y ago
> TOTP systems are supposed to implement a sliding window to account for reasonable clock differences, usually within 5 minutes.
The default is 30 seconds, as per the RFC: https://datatracker.ietf.org/doc/html/rfc6238 https://datatracker.ietf.org/doc/html/rfc6238
(not sure that meaningfully changes what you were saying, but just fyi.)
- orev 5y ago30 seconds is the default “time step” (4.2), but in talking about the transmission delay window (5.2), which the RFC recommends “at most 1 time step”, but also says that validation should occur for both the previous and next time step window. However in practical implementations, 5 minutes on both sides is typically used.