[saag] Re: Errata 6576 - HOTP

Simon Josefsson <[email protected]> Fri, 07 Mar 2025 19:15:47 +0100

Newsgroups	gmane.ietf.saag
Message-ID	<[email protected]>

Michael StJohns <[email protected]> writes:

> https://www.rfc-editor.org/errata/eid6756
>
>
>        RFC 4226 <https://www.rfc-editor.org/rfc/rfc4226>, "HOTP: An
>        HMAC-Based One-Time Password Algorithm", December 2005
>
> Another problem with the same document.
>
> Recommend: Accept.
>
> The reference implementations cited match this described behavior and
> specifying the last byte of the HMAC makes more sense than always the
> 20th byte (correct for HMACSHA1 only).

While that is a change needed to implement RFC 6238 (HOTP SHA2), I don't
think that is a proper fix RFC 4226 which is SHA1-only.

If anything needs to be clarified, I think it should be an errata to RFC
6238 to explain that section 5.3 of RFC 4226 has to modified in this way
in order to implement SHA2.  A new bis document could be prepared that
merged RFC 4226 and RFC 6238 including clarifications.

/Simon

_______________________________________________
saag mailing list -- [email protected]
To unsubscribe send an email to [email protected]

signature.asc (application/pgp-signature, 1.2 KB)