[saag] Re: Errata 5129 -

Hi all,

On Fri, Mar 07, 2025 at 07:09:53PM +0100, Simon Josefsson wrote:
> Michael StJohns <[email protected]> writes:
> > 
> > https://www.rfc-editor.org/errata/eid5129
> >
> >        RFC 4226 <https://www.rfc-editor.org/rfc/rfc4226>, "HOTP: An
> >        HMAC-Based One-Time Password Algorithm", December 2005
> >
> > Recommend:  Hold for Document Update
> >
> > At the very least, the referenced section should explain what
> > parameters it is using to get the results and doesn't.
> >
> > I'm not sure whether the values are incorrect or whether the reporter
> > picked the different parameters from those used by the author. The
> > fact that this wasn't reported until now suggests either that what's
> > in the wild is working or that its so lightly deployed that
> > conflicting versions haven't met in the wild.
> >
> > The errata should note that the referenced section is unreliable
> > without more information.
> 
> I don't believe this errata is correct.  The values in the RFC seems
> correct, and I've used the test vectors from the RFC in multiple
> succesful interops of OATH Toolkit.

I have implemented HOTP based on RFC 4226 for my RFC 6238-based TOTP
[implementation][0].  I have used the test data from both RFCs to test
this implementation.  My implementation is interoperable with at least
OATH Toolkit, Matt Rubin's Authenticator app, BitWarden client TOTP
generation, and GitHub TOTP-based MFA.  As such I'd expect the RFC 4226
test data to be correct.

I would recommend to reject this errata report.

[0]: https://github.com/auerswal/sft/blob/master/thotp.py

Best regards,
Erik

_______________________________________________
saag mailing list -- [email protected]
To unsubscribe send an email to [email protected]