Re: [OATH-Toolkit-help] Aladdin eToken OTP secret length

[Simon Josefsson]

Mitya <address@hidden> writes:

> Hi,
>
> Aladdin eToken OTP uses HOTP with 192-bit (24-byte) seed.
> Attempts to use such a seed in /etc/users.oath make PAM authentication
> fail, since secret length is hard-coded to 20 bytes
> (liboath/usersfile.c:67) and pam_sm_authenticate() returns
> OATH_TOO_SMALL_BUFFER.
>
> Please consider increasing secret length to 24 bytes. Thank you!

I have increased it to 32 bytes, and added some self tests to catch
regression in this area.  Please confirm whether the next release works
with the Aladdin eToken!

256 bits is enough for anyone. :-)

/Simon