I am really confused and need help on this problem related to TOTP as specified in RFC6238 here: https://tools.ietf.org/html/rfc6238#section-1.2.
So I am now given a task to implement the RFC6238 to generate a 10-digit TOTP password, which will be used in a POST request later on. The sample input and output for the TOTP is supposed to be like this:
Sample Input:
Shared key: "ninja@example.comHDECHALLENGE003" (without double quotes)
Hash function used: HMAC-SHA-512
T0 = 0, Timestep = 30 seconds (as per specified in RFC6238)
Expected TOTP of 10 digits
Sample Output:
Successful TOTP generated: 1773133250, for time of Mon, 17 Mar 2014 15:20:51 GMT
base64 encoded POST Authorization username/password request: bmluamFAZXhhbXBsZS5jb206MTc3MzEzMzI1MA==
(I have decoded the sample POST authorization to be 'ninja@example.com:1773133250' hence why I can say that the sample TOTP output is 1773133250)
Now the problem that I have is after attempting to make my own script according to the rfc6238 specification I cannot get the same output for the sample input as above. I then tried using other available online TOTP modules that area available online (mostly in Python), to find that they generate the same output as the script that I have created. Finally, I then tried to outright copy and run the Java code given in the example of RFC6238 and came up with the same result as my script, i.e.:
Attempted input:
Hex Encoded seed for HMAC512: "6E696E6A61406578616D706C652E636F6D4844454348414C4C454E4745303033" + "6E696E6A61406578616D706C652E636F6D4844454348414C4C454E4745303033";
Time inputted is 1395069651L, representing the time received in sample output
Result of attempt (same output from custom script, other Python modules, and the Java implementation given in RFC6238 documentation):
Generated TOTP: 0490867067
I am really confused now as I believe that I have followed the instructions given by the task, and even used the actual RFC given Java code to only then find that they are not generating the same ouput as the one given in the task. I have then contacted the provider of the task to know if there is any bug, but they say that it is already correct.
Perhaps I am missing something here, such as the way the task provider actually encrypts the shared key? I am very new to this and any knowledge on any caveats such as different key encryptions resulting in different TOTP would be really appreciated.
Really appreciate any help related to this, and to give me better understanding on this TOTP manner! Thank you :)
ninja@example.com:1773133250
although I'd assume something that is ASCII compatible if you're already used several implementations, so that is less likely. Maybe post your code on StackOverflow then we can see what could be wrong. Note that a few protocols also confuse hexadecimals and binary, but those are fortunately not that common. $\endgroup$ – Maarten - reinstate Monica♦ Mar 3 '17 at 8:24