### What is your idea? Time based one time passwords are based on [RFC-6238](https://datatracker.ietf.org/doc/html/rfc6238) which is from 2011 and SHA1 is now considered broken, so you could try create a updated version using say Blake3 which [rbx-cryptography](https://github.com/daily3014/rbx-cryptography) supports. Of course this means it won't work with any other application but the RFC does mention support for SHA256, so could use that instead.

Quick demo (might work?)

```luau --!strict --!optimize 2 --!native local Cryptography = require(game.ReplicatedStorage.Cryptography) local Blake3 = Cryptography.Hashing.Blake3 local Base64 = Cryptography.Utilities.Base64 local CSPRNG = Cryptography.Utilities.CSPRNG local TOTP = {} export type TOTPOptions = { Digits: number?, TimeStep: number?, StartTime: number?, } export type VerifyOptions = { Digits: number?, TimeStep: number?, StartTime: number?, Tolerance: number?, } local BLAKE3_KEY_SIZE = 32 local DEFAULT_DIGITS = 6 local DEFAULT_TIME_STEP = 30 local DEFAULT_START_TIME = 0 local DIGIT_POWER = { 1, 10, 100, 1000, 10000, 100000, 1000000, 10000000, 100000000, 1000000000, } local function CounterToBuffer(Counter: number): buffer local CounterBuffer = buffer.create(8) local High = math.floor(Counter / 4294967296) local Low = Counter % 4294967296 buffer.writeu32(CounterBuffer, 0, High) buffer.writeu32(CounterBuffer, 4, Low) for Index = 0, 7, 4 do buffer.writeu32(CounterBuffer, Index, bit32.byteswap(buffer.readu32(CounterBuffer, Index))) end return CounterBuffer end local function ConstantEquals(String1: string, String2: string): boolean if #String1 ~= #String2 then return false end local Result = 0 for Index = 1, #String1 do local Byte1 = string.byte(String1, Index) local Byte2 = string.byte(String2, Index) Result = bit32.bor(Result, bit32.bxor(Byte1, Byte2)) end return Result == 0 end local function ComputeHOTP(Secret: buffer, Counter: number, Digits: number): string local CounterBuffer = CounterToBuffer(Counter) local _, Hash = Blake3.DigestKeyed(Secret, CounterBuffer, 32) for Index = 0, buffer.len(Hash) - 1, 4 do buffer.writeu32(Hash, Index, bit32.byteswap(buffer.readu32(Hash, Index))) end local Offset = bit32.band(buffer.readu8(Hash, buffer.len(Hash) - 1), 0x0F) local BinaryCode = bit32.band(buffer.readu32(Hash, Offset), 0x7FFFFFFF) local Code = BinaryCode % DIGIT_POWER[Digits] return string.format("%0" .. Digits .. "d", Code) end local function GetCurrentCounter(TimeStep: number, StartTime: number): number local CurrentTime = os.time() return math.floor((CurrentTime - StartTime) / TimeStep) end function TOTP.Generate(Secret: buffer, Options: TOTPOptions?): string if typeof(Secret) ~= "buffer" then error(`Secret must be a buffer, got {typeof(Secret)}`, 2) end local SecretLength = buffer.len(Secret) if SecretLength ~= BLAKE3_KEY_SIZE then error(`Secret must be exactly {BLAKE3_KEY_SIZE} bytes long, got {SecretLength} bytes`, 2) end local Opts = Options or {} local Digits = Opts.Digits or DEFAULT_DIGITS local TimeStep = Opts.TimeStep or DEFAULT_TIME_STEP local StartTime = Opts.StartTime or DEFAULT_START_TIME if Digits < 6 or Digits > 8 then error("Digits must be between 6 and 8", 2) end if TimeStep <= 0 then error("TimeStep must be positive", 2) end local Counter = GetCurrentCounter(TimeStep, StartTime) return ComputeHOTP(Secret, Counter, Digits) end function TOTP.GenerateAt(Secret: buffer, Timestamp: number, Options: TOTPOptions?): string if typeof(Secret) ~= "buffer" then error(`Secret must be a buffer, got {typeof(Secret)}`, 2) end if typeof(Timestamp) ~= "number" then error(`Timestamp must be a number, got {typeof(Timestamp)}`, 2) end local SecretLength = buffer.len(Secret) if SecretLength ~= BLAKE3_KEY_SIZE then error(`Secret must be exactly {BLAKE3_KEY_SIZE} bytes long, got {SecretLength} bytes`, 2) end local Opts = Options or {} local Digits = Opts.Digits or DEFAULT_DIGITS local TimeStep = Opts.TimeStep or DEFAULT_TIME_STEP local StartTime = Opts.StartTime or DEFAULT_START_TIME if Digits < 6 or Digits > 8 then error("Digits must be between 6 and 8", 2) end if TimeStep <= 0 then error("TimeStep must be positive", 2) end local Counter = math.floor((Timestamp - StartTime) / TimeStep) return ComputeHOTP(Secret, Counter, Digits) end function TOTP.Verify(Secret: buffer, Code: string, Options: VerifyOptions?): boolean if typeof(Secret) ~= "buffer" then error(`Secret must be a buffer, got {typeof(Secret)}`, 2) end if typeof(Code) ~= "string" then error(`Code must be a string, got {typeof(Code)}`, 2) end local SecretLength = buffer.len(Secret) if SecretLength ~= BLAKE3_KEY_SIZE then error(`Secret must be exactly {BLAKE3_KEY_SIZE} bytes long, got {SecretLength} bytes`, 2) end local Opts = Options or {} local Digits = Opts.Digits or DEFAULT_DIGITS local TimeStep = Opts.TimeStep or DEFAULT_TIME_STEP local StartTime = Opts.StartTime or DEFAULT_START_TIME local Tolerance = Opts.Tolerance or 0 if Digits < 6 or Digits > 8 then error("Digits must be between 6 and 8", 2) end if TimeStep <= 0 then error("TimeStep must be positive", 2) end if Tolerance < 0 then error("Tolerance must be non-negative", 2) end local CurrentCounter = GetCurrentCounter(TimeStep, StartTime) local IsValid = false for Offset = -Tolerance, Tolerance do local Counter = CurrentCounter + Offset local ExpectedCode = ComputeHOTP(Secret, Counter, Digits) if ConstantEquals(ExpectedCode, Code) then IsValid = true end end return IsValid end function TOTP.GetRemainingSeconds(Options: TOTPOptions?): number local Opts = Options or {} local TimeStep = Opts.TimeStep or DEFAULT_TIME_STEP local StartTime = Opts.StartTime or DEFAULT_START_TIME local CurrentTime = os.time() local ElapsedTime = (CurrentTime - StartTime) % TimeStep return TimeStep - ElapsedTime end function TOTP.GenerateSecret(): buffer return CSPRNG.RandomBytes(BLAKE3_KEY_SIZE) end function TOTP.ExportSecret(Secret: buffer): string if typeof(Secret) ~= "buffer" then error(`Secret must be a buffer, got {typeof(Secret)}`, 2) end local SecretLength = buffer.len(Secret) if SecretLength ~= BLAKE3_KEY_SIZE then error(`Secret must be exactly {BLAKE3_KEY_SIZE} bytes long, got {SecretLength} bytes`, 2) end local EncodedBuffer = Base64.Encode(Secret) return buffer.tostring(EncodedBuffer) end function TOTP.ImportSecret(EncodedSecret: string): string if typeof(EncodedSecret) ~= "string" then error(`EncodedSecret must be a string, got {typeof(EncodedSecret)}`, 2) end local DecodedString = Base64.Decode(buffer.fromstring(EncodedSecret)) local SecretLength = #DecodedString if SecretLength ~= BLAKE3_KEY_SIZE then error(`Decoded secret must be exactly {BLAKE3_KEY_SIZE} bytes long, got {SecretLength} bytes`, 2) end return DecodedString end return TOTP ```

### Why should we add this? Speed! ### What impact would this have? - [ ] Improves user experience - [x] Boosts performance - [x] Adds new functionality - [ ] Other

GitHub Explorer

Securo

Score Breakdown

Issues Activity: Last 6 months

Top Labels

Hottest Issues