4 ms·
> How random are TOTP codes? Nitpicking: They are not supposed to be random as that would defeat the purpose. We should be able to deterministically generate t
by selcuka 2y ago
> How random are TOTP codes?
Nitpicking: They are not supposed to be random as that would defeat the purpose. We should be able to deterministically generate the same number on both the client and server side from the same 2 seeds (secret key and the timestamp).
They should be ideally uniformly distributed, though.
- account42 2y ago> They should be ideally uniformly distributed, though. This isn't enough as just counting from 000000 to 999999 is uniformly distributed over the whole range. You want the numbers to be pseudorandom so that someone without the seed cannot guess them even if they have seen previously generated numbers.