GoogleAuthenticator
GoogleAuthenticator copied to clipboard
PHPGangsta
Add support for different HMAC algorithms.
RFC 6238 (https://tools.ietf.org/html/rfc6238) states:
TOTP implementations MAY use HMAC-SHA-256 or HMAC-SHA-512 functions, based on SHA-256 or SHA-512 [SHA2] hash functions, instead of the HMAC-SHA-1 function that has been specified for the HOTP computation in [RFC4226].
This PR adds support for that.
I've also added additional tests to codeProvider() based on the code and output of the sample code in the RFC to validate the changes.
As a side effect of implementing the above, I've also fixed the case where if you change the _codeLength, verifyCode() always returned false for any value other than 6, and added some boilerplate at the top of GoogleAuthenticatorTest.php to make the tests run under phpunit 6+
Looks like #55 also fixed the verifyCode() issue, didn't see it before I did this.
Good idea, but I think this would be better if it was handled in the same way as code length, for consistency (and also for ease-of-use).
Also, it might be sensible to validate the algorithm string, to avoid errors and potential URL-injection attacks.