geckon01/TwoFactorAuth
1
0
Fork 0
mirror of https://github.com/RobThree/TwoFactorAuth.git synced 2026-08-26 20:46:50 +00:00
Code Issues Packages Projects Releases Wiki Activity

* Minor refactoring of verifyCode.

Browse Source
This commit is contained in:
RobThree
2018-06-09 12:09:24 +02:00
parent fca87f2d09
commit c18ec155ae
2 changed files with 11 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/TwoFactorAuth.php
+7 -2
View File
@@ -83,11 +83,16 @@ class TwoFactorAuth
{
$timetamp = $this->getTime($time);
// To keep safe from timing-attachs we iterate *all* possible codes even though we already may have verified a code is correct
$timeslice = 0;
// To keep safe from timing-attacks we iterate *all* possible codes even though we already may have
// verified a code is correct. We use the timeslice variable to hold either 0 (no match) or the timeslice
// of the match. Each iteration we either set the timeslice variable to the timeslice of the match
// or set the value to itself. This is an effort to maintain constant execution time for the code.
for ($i = -$discrepancy; $i <= $discrepancy; $i++) {
$ts = $timetamp + ($i * $this->period);
$slice = $this->getTimeSlice($ts);
$timeslice += $this->codeEquals($this->getCode($secret, $ts), $code) ? $slice : 0;
$timeslice = $this->codeEquals($this->getCode($secret, $ts), $code) ? $slice : $timeslice;
}
return $timeslice > 0;
tests/TwoFactorAuthTest.php
+4
View File
@@ -170,6 +170,10 @@ class TwoFactorAuthTest extends PHPUnit_Framework_TestCase
$this->assertEquals(47561575, $timeslice6);
$this->assertEquals(true, $tfa->verifyCode('VMR466AB62ZBOKHE', '170645', 3, 1426847190, $timeslice7));
$this->assertEquals(47561576, $timeslice7);
// Incorrect code should return false and a 0 timeslice
$this->assertEquals(false, $tfa->verifyCode('VMR466AB62ZBOKHE', '111111', 3, 1426847190, $timeslice8));
$this->assertEquals(0, $timeslice8);
}
public function testTotpUriIsCorrect() {