recaptime.dev / phorge
@recaptime-dev's working patches + fork for Phorge, a community fork of Phabricator. (Upstream dev and stable branches are at upstream/main and upstream/stable respectively.) hq.recaptime.dev/wiki/Phorge
phorge phabricator
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

Use 160-bit TOTP keys rather than 80-bit TOTP keys

Summary:
See <https://hackerone.com/reports/435648>. We currently use 80-bit TOTP keys. The RFC suggests 128 as a minimum and recommends 160.

The math suggests that doing the hashing for an 80-bit key is hard (slightly beyond the reach of a highly motivated state actor, today) but there's no reason not to use 160 bits instead to put this completely out of reach.

See some additional discussion on the HackerOne report about enormous key sizes, number of required observations, etc.

Test Plan: Added a new 160-bit TOTP factor to Google Authenticator without issue.

Reviewers: amckinley

Reviewed By: amckinley

Differential Revision: https://secure.phabricator.com/D19792

epriestley 8a4bf386 1f6a4cff

+1 -1
+1 -1
src/applications/auth/factor/PhabricatorTOTPAuthFactor.php
··· 185 185 186 186 187 187 public static function generateNewTOTPKey() { 188 - return strtoupper(Filesystem::readRandomCharacters(16)); 188 + return strtoupper(Filesystem::readRandomCharacters(32)); 189 189 } 190 190 191 191 public static function verifyTOTPCode(