[saag] Re: Errata 5129 -

Simon Josefsson <[email protected]> Fri, 07 Mar 2025 19:09:53 +0100

Newsgroups	gmane.ietf.saag
Message-ID	<[email protected]>

Michael StJohns <[email protected]> writes:

> https://www.rfc-editor.org/errata/eid5129
>
>
>        RFC 4226 <https://www.rfc-editor.org/rfc/rfc4226>, "HOTP: An
>        HMAC-Based One-Time Password Algorithm", December 2005
>
> Recommend:  Hold for Document Update
>
> At the very least, the referenced section should explain what
> parameters it is using to get the results and doesn't.
>
> I'm not sure whether the values are incorrect or whether the reporter
> picked the different parameters from those used by the author. The
> fact that this wasn't reported until now suggests either that what's
> in the wild is working or that its so lightly deployed that
> conflicting versions haven't met in the wild.
>
> The errata should note that the referenced section is unreliable
> without more information.

I don't believe this errata is correct.  The values in the RFC seems
correct, and I've used the test vectors from the RFC in multiple
succesful interops of OATH Toolkit.

jas@kaka:~$ oathtool --verbose --hotp --counter=1 3132333435363738393031323334353637383930
Hex secret: 3132333435363738393031323334353637383930
Base32 secret: GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ
Digits: 6
Window size: 0
Start counter: 0x1 (1)

287082
jas@kaka:~$ 

/Simon

_______________________________________________
saag mailing list -- [email protected]
To unsubscribe send an email to [email protected]

signature.asc (application/pgp-signature, 1.2 KB)