I am currently working on a desktop TOTP client.

From the TOTP spec at https://tools.ietf.org/html/rfc6238#section-4.1, the 6 digit OTP is generated from counter (in this case time).

But what is "time"? The spec says that the time is in the format of a Unix time epoch (seconds that have elapsed since Jan 01 1970).

My question is,

What how do I compute this Unix time?

  • a) Do I get UTC time & convert it to Unix time epochs?
  • b) Do I get local time & convert it to Unix time epochs?


  • c) Converting both UTC & local time to Unix time gives the same value so it will not matter?

I think this simply comes down to the definition of Unix time, which is given in the Wikipedia article:

Unix time (also known as POSIX time[1][2] or UNIX Epoch time[3]) is a system for describing a point in time. It is the number of seconds that have elapsed since 00:00:00 Thursday, 1 January 1970,[2] Coordinated Universal Time (UTC), minus leap seconds. Every day is treated as if it contains exactly 86400 seconds,[2] so leap seconds are to be subtracted since the epoch.

Although I would have described it as "without taking leap seconds into account" myself. Generally you should be able to get the Unix time from some time API or old API function, but otherwise (a) seems to be most reasonable. The Wikipedia article also contains ways of converting from different time formats, specifically UTC.

| improve this answer | |
  • $\begingroup$ Thanks, I didn't know the part where Unix time is explicitly derived from UTC :) $\endgroup$ – M4X_ Aug 13 '19 at 8:30
  • $\begingroup$ Having had to implement the protocol myself, I think the protocol is really sparsely defined. Not that that is necessarily bad, but it does always feel like I have to discover things for myself and then hope that they are right... So it's definitely not just you that's left with questions. $\endgroup$ – Maarten Bodewes Aug 13 '19 at 8:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.