kspearrin / kspearrin/Otp.NET

RemainingSeconds is the same for all codes in same time step.

Open
#59 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
C#
Stars
1.3k
Forks
179
PR merge metrics
No merged PRs in 30d

Description

Why does generating a new code within the same time step but with a different key not have a new RemainingSeconds?

If I call GetTotp two times with a step of 9 minutes, the second call has a RemainingSeconds of the first call.

GetTotp takes a byte[] and count, 1, 2, 3, etc. the byte[] key is a hashed salt and count which generates a new code. I found that I had to make the key more unique than the previous call to GetTotp because calling GetTotp again (like when user wants a new key) within the 9 minute step just returned the same code.

Example. time step is 540 seconds.

>GetTotp(salt, 1);
> "309960"
> RemainingSeconds 539

wait some seconds and call again...

>GetTotp(salt, 2);
> "718933"
> RemainingSeconds 460

I expected RemainingSeconds to be closer to 539

```
internal string GetTotp(byte[] salt, int count)
{
string saltedKey = HashSomeStringWithSalt(salt, count.ToString());
byte[] key = Convert.FromBase64String(saltedKey);

var totp = new Totp(key, step: 540, mode: OtpHashMode.Sha256, totpSize: 6);

var dateTimeNow = DateTime.UtcNow;
var totpCode = totp.ComputeTotp(dateTimeNow);
return totpCode;
}

internal int GetOTPRemainingSeconds(byte[] salt, int count)
{
string saltedKey = HashSomeStringWithSalt(salt, count.ToString());
byte[] key = Convert.FromBase64String(key);
var totp = new Totp(key, step: 540, mode: OtpHashMode.Sha256, totpSize: 6);

return totp.RemainingSeconds();
}

```

Contributor guide

No contributing guide indexed for this repository

Research direction

Reproduce the two GetTotp calls using the same salt, a 540-second step, and counts 1 and 2, then compare their values with GetOTPRemainingSeconds. Inspect how the Totp instance calculates RemainingSeconds versus ComputeTotp; done means confirming whether the shared time-step result is expected and resolving the reported mismatch.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
authentication, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.