Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Adding context length configuration for 2FA to ensure better security standards #568

Merged
merged 7 commits into from
Sep 16, 2024

Conversation

MattLoyeD
Copy link
Contributor

@MattLoyeD MattLoyeD commented Sep 9, 2024

Follow up of #567

Description

We need to ensure a minimum length for 2FA secret, current secret length by default is 80-bit (16 characters), but 128-bit (26 characters) is becoming minimum in some cases and the best default is 160-bit.

It's recommended to use 128-bit or 160-bit because some Authenticator apps may have problems with non-RFC-recommended lengths (Namely https://play.google.com/store/apps/details?id=org.fedorahosted.freeotp).

Implementation

Added some contextual config via :
config('fortify-options.two-factor-authentication.secret-length', 16);

Retro compatible and define a security standard as expected by new RFC.

Added secret length option to generate secret key
Consume a new option that can be set from config files to ensure basic required length for 2FA security
Update contract to reflect new security standard in 2FA
@taylorotwell
Copy link
Member

We don't use snake case variables. We also can't change the contract on a patch release since it would break existing applications. Is there a way to just make this opinionated without breaking anything? Please mark as ready for review when the requested changes have been made.

@taylorotwell taylorotwell marked this pull request as draft September 9, 2024 14:09
@MattLoyeD
Copy link
Contributor Author

Thank you @taylorotwell for your precise review, I made the necessary change. We can probably even make less breaking change by just adding the config(...) in src/TwoFactorAuthenticationProvider.php directly.

@MattLoyeD MattLoyeD marked this pull request as ready for review September 12, 2024 15:38
@taylorotwell taylorotwell merged commit ccc5511 into laravel:1.x Sep 16, 2024
6 of 7 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants