Update: it's actually hmac(secret, time). I'll leave the post as-is, in case someone is ever looking for the hash(secret+time) case (for which I provided some reasoning at least), but for TOTP tokens, this question is a duplicate of Why is HMAC-SHA1 still considered secure?.

TOTP tokens are basically hash(secret+time). Since you don't know the secret, you can't use them as prefix to compute the random "near-collision block pair", so an attack like Shattered won't work here (even if the time matched this random block pair, which it also won't).

Am I correct in thinking that Shattered does not apply to TOTP?

Are there any other attacks that do?

Of course, the recommendation is always to move away from SHA-1, but the question is whether this is a direct vulnerability that a well-funded attacker could exploit or (as far as is public knowledge) just hardening advice.

  • 1
    $\begingroup$ Actually it's HMAC-SHA1(secret,time) (the standard defines it in terms of HOTP which uses HMAC). $\endgroup$ – SEJPM Jul 30 '19 at 10:13
  • $\begingroup$ @SEJPM Ah yes, important detail that I forgot, thanks for the correction. I think this question might be closed in favor of crypto.stackexchange.com/q/26510/2512 $\endgroup$ – Luc Jul 30 '19 at 11:33
  • $\begingroup$ Even HMAC-MD5 is still secure, but don't say that out loud since MD5 needs to be sent to the historical trash can. $\endgroup$ – Natanael Aug 2 '19 at 18:29

Browse other questions tagged or ask your own question.