79298681

Date: 2024-12-21 00:39:35
Score: 0.5
Natty:
Report link

I've recently implemented TOTP and came across this issue as well.

Here's Google's documentation on this (also linked to by Emin above): https://github.com/google/google-authenticator/wiki/Key-Uri-Format

It has zero references to key length, but does refer to https://datatracker.ietf.org/doc/html/rfc3548. You have to read this closely to find that section 5 is what might be important, and it is the case laid out in (1), the first subpoint that Google Authenticator on iOS appears to expect:

(1) ... the final unit of encoded output will be an integral multiple of 8 characters with no "=" padding

In other words, your key consisting of valid BASE32 characters must have no padding and a length of a multiple of 8 characters. I tried them all from 8, 16, ... to 64 and they seem to work consistently.

Now a crazy thing: I randomly tested a few lengths that were not a multiple of 8, and actually found a pair of keys of 39 characters length where one doesn't work but the other one does:

3D7CDFEV3ILV42QM74T2L42MHNY3462V7HYDG4I 39 chars, works 3FNI63QCKC4DX2QSP7DF443OABC7JOAIOIMDPWO 39 chars does not work

Go figure!

Reasons:
  • Long answer (-1):
  • No code block (0.5):
  • Low reputation (1):
Posted by: Johannes Weber