Use HMAC-SHA-256 or HMAC-SHA-512 with the Google Authenticator App

124 Views Asked by At

The Google Authenticator implements the one-time passcode as described in RFC 4226, HOTP: An HMAC-Based One-Time Password Algorithm and its extension RFC 6238, TOTP: Time-Based One-Time Password Algorithm.

RFC 6238 specifies the algoritm;

HOTP(K,T) = Truncate(HASH-FUNCTION(K,T))

Where K is the shared secret and T the current Unix time (i.e., the number of seconds elapsed since midnight UTC of January 1, 1970). As for HASH-FUNCTION RFC 6238 describes;

TOTP implementations MAY use HMAC-SHA-256 or HMAC-SHA-512 functions,
based on SHA-256 or SHA-512 [SHA2] hash functions, instead of the
HMAC-SHA-1 function that has been specified for the HOTP computation
in [RFC4226].

And indeed, i saw several server side implementations with these different HASH-FUNCTIONs. But what about the Google Authenticator App itself? The App defaults with HMAC-SHA-1 (i know this from tests), but can i configure the App towards HMAC-SHA-256 or HMAC-SHA-512? How?

0

There are 0 best solutions below