authentication - google authenticator vs vbscript -
i have implemented http://jacob.jkrall.net/totp/ in vbscript.
my code given same hex gives right 6-digit otp, part working.
i've verified hmac-sha-1. encoding against online generator, http://www.freeformatter.com/hmac-generator.html#ad-output, same input gives same output.
my time same http://www.currenttimestamp.com/
i've generated qrcode @ http://www.qr-koder.dk/ string otpauth://totp/$label?secret=$secret , google authenticator app reads code , starts outputting 6 digit code changing every 30 seconds.
but codes app not match 6-digit code vbscript generates!
i've tried trunc(time/30) +/-7500 steps see if timezone/daylight saving problem, no avail.
as other parts of routine generate 6 digits seem work i've come conclusion don't understand this:
the url on qr-code
otpauth://totp/$label?secret=$secret with explanation
label can used describe key in app, while secret 16-character base32-encoded shared secret, known both client , server.
so when calculate hmac-sha-1(secret, time()/30)
should secret same string given both app , calculation?
if select secret of 1234567890, base32 gezdgnbvgy3tqojq according http://emn178.github.io/online-tools/base32_encode.html.
should take
hmac-sha-1("1234567890", time()/30) or
hmac-sha-1("gezdgnbvgy3tqojq", time()/30) ?
i believe i've tried both, , neither works.
the system unix time correct.
i guess problem might secret in hmac-sha-1 function. depends on hmac-sha-1 expects.
your string "123456790" might binary string. ascii representation or utf8? i.e. string 10 bytes or 20 bytes long?
i recommend getting input string in vbscript right.
on other hand, instead of writing own vbscript, can use ready made solution privacyidea authentication server, open source , comes totp.
