[andOTP] cannot import, file corrupted or password wrong

[SuperSandro2000]

I wanted to import an encrypted andOTP backup and I get this error:

I copied the file from one of my backups and from my phone directly and the password from my password manager. I get no other error in the console. It could be that the password it the long as I have a 100+ char one.

Importing plain text works like a charm.

[calisro]

Doesn't work for me plain or encrypted. I think the new andotp for android uses RSA?

[paolostivanin]

@SuperSandro2000 are u using the latest version? (should be 0.6.3)
I'm asking because andOTP changed the encryption algo some time ago, so now OTPClient only supports the latest version.

@calisro what error are u getting? It's weird that both plain and encrypted do not work

[SuperSandro2000]

@SuperSandro2000 are u using the latest version? (should be 0.6.3)

Yes, 0.6.3.1.

[paolostivanin]

For me it works. I can import both encrypted and plain backup 🤔
I'd need you to provide me with a sample backup file that triggers the issue, because I can't reproduce it :(

[SuperSandro2000]

Did you try it with BattelNet Authenticator and Twitch included in the backup?

[paolostivanin]

Nope because I don't have either of them. What's so particular about them? 🤔

[SuperSandro2000]

They have a different length. Battle.net is 8 numbers and twitch 7. Also the timeouts vary. See https://github.com/andOTP/andOTP/wiki/Shared-secrets

[paolostivanin]

I was actually able to import andOTP data with a battle net account in it 🤔 will try with twitch, but it would be faster if you could send me a reproducer 👍

[hwoarang]

I do have the same problem using 0.6.3.1 and otpclient 2.1.0. The strange thing is that the application is asking for 'decryption password' even when I try to import a plain json file.

Edit: OK my problem was basically 'wrong usage'. When I opened the app for the first time I was asked to create or import a DB. So I naturally assumed that I could just import the andOTP json file. What I needed to do was to create a brand new DB and then import the andOTP file :)

[paolostivanin]

@hwoarang glad you solved :) but good point, that's currently not very clear. I'll fix it with the next release 👍

[paolostivanin]

I'm closing this until someone is able to provide me a reproducer!

[SuperSandro2000]

When I import the backup in plain text nothing crashes but when I import the encrypted one it has an error. I am not sure how to strip private information or edit the encrypted backup so I sadly can't provide you with a working example.

[paolostivanin]

@SuperSandro2000 if you're willing to help me debug this issue, I can work on it, no problem :) I really would like to find and fix this bug.
What about we do the following:

1. I will develop a cli that will export your data in the andotp encrypted format
2. the export operation will replace only the secret with some random chars
3. all the other fields will remain the same
4. you send me via email the exported backup

If you agree with that, I'll proceed with developing a simple CLI for that. What do you think?

[SuperSandro2000]

I did some further testing and it has nothing todo with the content of the backup. My password is just to long and somewhere it is overflowing I guess.

Here is a dummy backup with the password 111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111
otp_accounts.json.aes.zip

[paolostivanin]

nice, thanks! Imma look into it asap :)

[paolostivanin]

Using a python script:

Iterations: 3210
Salt: (12) 0xff6e45cdd4e25fbbdbb0f19d
Pbkdf2 key: (32) 0x31836a3c670ddda59c65e43e34a67bc2ee314bb21d2c159bf8ca9168489ddc67
IV: (12) 0x1c220cf9a608217ecb82ab30
Auth tag: (16) 0x747087753ee3b8b7cfb979b695335771

with otpclient:

Iterations: 3210
SALT: ff6e45cdd4e25fbbdbb0f19d
PBKDF2 Key: 20d5368b3af99bb2f3eb40a3d35d3a94e9ea0c74d74636457a0f8b3c967
IV: 1c22cf9a68217ecb82ab30
Auth tag: 747087753ee3b8b7cfb979b695335771

Some weird thing is happening when otpclient derives a long password...

[paolostivanin]

Found the error and fixed it :) thanks a lot @SuperSandro2000 for your help!
It was weird because, for some reasons, this bug was happening only with very long backup password.
But now it's gone. Forever (hopefully). 🥳

[paolostivanin]

If you confirm me it's fixed, I'll publish a new release :)

[SuperSandro2000]

Worked with the example and my real backup! Thank you very much!

[paolostivanin]

Niceeeee :D
I'll prepare a release later today!