TPMTOTP HOTP code to be extended to 40 bytes (vs 20)
Nobody has claimed this yet.
- Dominant language
- Makefile
- Stars
- 1.6k
- Forks
- 211
- Avg merge
- 4d 21h
- Merged PRs (30d)
- 6
Description
This is to track changes needed inside tpmtotp so that secret can be extended to use full 40 bytes available in HOTP in firmware
@tlaurion Firmware supports it per your notes, but
hotpfrom tpmtotp still requires exactly 20 bytes: https://github.com/osresearch/tpmtotp/blob/master/hotp.c#L26The secret does not have to be printable, so I can use 20 binary bytes from the hash and get 160 bits of entropy, up from 80 currently (20 hex chars).
tpmtotp can be extended but I feel like this is going down a rabbit hole to go from 160 bits to 256 bits. Can we track that for an improvement later?
Originally posted by @JonathonHall-Purism in https://github.com/osresearch/heads/pull/1419#discussion_r1251276346
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with tpmtotp's hotp.c at the referenced line, where the secret is currently limited to 20 bytes, and trace how firmware passes the secret into it. Confirm the expected HOTP behavior for a 40-byte binary secret and check the affected firmware integration. Done means tpmtotp accepts the full 40-byte secret without breaking existing HOTP use.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- embedded-iot, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100