From d996779182fb50d9424c10d4702ac3320d6418b1 Mon Sep 17 00:00:00 2001 From: Matthijs Date: Fri, 17 Nov 2023 13:53:13 +0100 Subject: [PATCH] Changed default secret bits from 80 to 160 as recommended by RFC4226 https://www.ietf.org/rfc/rfc4226.txt (and TOTP refers to RFC4226, see https://www.ietf.org/rfc/rfc6238.txt) --- lib/TwoFactorAuth.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/TwoFactorAuth.php b/lib/TwoFactorAuth.php index f3f867e..6517e6e 100644 --- a/lib/TwoFactorAuth.php +++ b/lib/TwoFactorAuth.php @@ -51,7 +51,7 @@ class TwoFactorAuth /** * Create a new secret */ - public function createSecret(int $bits = 80, bool $requirecryptosecure = true): string + public function createSecret(int $bits = 160, bool $requirecryptosecure = true): string { $secret = ''; $bytes = (int)ceil($bits / 5); // We use 5 bits of each byte (since we have a 32-character 'alphabet' / BASE32)