TL;DR: Is it necessary to generate a 'random' key from a shared token secret string before putting it into a TOTP algorithm that follows the RFC 6238 specification? Or is it okay for me to put the token secret directly into the TOTP algoritm (of course with proper base32 or hex format depending on the algorithm used)?
Hello, currently I am trying to solve a challenge that relates to me generating the correct 10-digit TOTP based on my userid and certain string combinations. However, currently I cannot seem to generate the correct output, even though I have followed the RFC 6238 specification correctly (as can be seen here: https://www.rfc-editor.org/rfc/rfc6238#section-1.2), and even borrowed the code provided in the RFC to generate the TOTP.
As some background, the task provider has given me a sample input and output like specified below:
Shared key: "[email protected]" (without double quotes)
Hash function used: HMAC-SHA-512
T0 = 0, Timestep = 30 seconds (as per specified in RFC6238)
Expected TOTP of 10 digits
Successful TOTP generated: 1773133250, for time of Mon, 17 Mar 2014 15:20:51 GMT
base64 encoded POST Authorization username/password request: bmluamFAZXhhbXBsZS5jb206MTc3MzEzMzI1MA==
(I have decoded the sample POST authorization to be '[email protected]:1773133250' hence why I can say that the sample TOTP output is 1773133250)
In an attempt to replicate this result, I inputted the shared key "[email protected]" into the totp algorithms that I used with a hex representation of the key, i.e. 6E696E6A61406578616D706C652E636F6D4844454348414C4C454E4745303033, especially for the TOTP algorithm that is shown in the RFC 6238. Unfortunately it seems that I cannot get the correct result and instead got the output like this:
Hex encoded seed for HMAC512: "6E696E6A61406578616D706C652E636F6D4844454348414C4C454E4745303033" + "6E696E6A61406578616D706C652E636F6D4844454348414C4C454E4745303033";
Time inputted (the message that is going to be hashed) is 1395069651L, representing the time received in sample output
Result of attempt (same output from custom script, other Python modules, and the Java implementation given in RFC6238 documentation):
Generated TOTP: 0490867067
After some more reading though, I have noticed that it seems that the token shared key/secret that is entered into the TOTP main function (i.e. the one that is going to be encoded into SHA-512) derived from a random generator or a key derivation function, according to the RFC 6238. With this in mind, my main question then would be (sorry after a long explanation haha):
Is it possible and actually necessary for me to first input the shared token to a key derivation function first, before then inputting it into the TOTP algorithm (i.e. do the Key Derivation first, then input into the SHA portion of the TOTP)? If so, should I then use the same shared key as he salt of the key derivation function?