geckon01/TwoFactorAuth
1
0
Fork 0
mirror of https://github.com/RobThree/TwoFactorAuth.git synced 2026-08-25 07:16:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

* Minor refactoring of verifyCode.

Browse Source
This commit is contained in:
RobThree
2018-06-09 12:09:24 +02:00
parent fca87f2d09
commit c18ec155ae
2 changed files with 11 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/TwoFactorAuth.php
+7 -2
View File
@@ -83,11 +83,16 @@ class TwoFactorAuth
{
$timetamp = $this->getTime($time);
// To keep safe from timing-attachs we iterate *all* possible codes even though we already may have verified a code is correct
$timeslice = 0;
// To keep safe from timing-attacks we iterate *all* possible codes even though we already may have
// verified a code is correct. We use the timeslice variable to hold either 0 (no match) or the timeslice
// of the match. Each iteration we either set the timeslice variable to the timeslice of the match
// or set the value to itself. This is an effort to maintain constant execution time for the code.
for ($i = -$discrepancy; $i <= $discrepancy; $i++) {
$ts = $timetamp + ($i * $this->period);
$slice = $this->getTimeSlice($ts);
$timeslice += $this->codeEquals($this->getCode($secret, $ts), $code) ? $slice : 0;
$timeslice = $this->codeEquals($this->getCode($secret, $ts), $code) ? $slice : $timeslice;
}
return $timeslice > 0;