Base32 decode

[braindev]

Why doesn't the Base32 decode function handle padding?

This doesn't work:

2.2.0 :012 > totp = ROTP::TOTP.new Base32.encode("dntqoaxas7rvtfuf")
 => #<ROTP::TOTP:0x007fdd4d062458 @interval=30, @issuer=nil, @digits=6, @digest="sha1", @secret="MRXHI4LPMF4GC4ZXOJ3HIZTVMY======">
2.2.0 :013 > totp.now
ROTP::Base32::Base32Error: Invalid Base32 Character - '='
    from /Users/bjohnson/.rvm/gems/ruby-2.2.0/gems/rotp-2.1.0/lib/rotp/base32.rb:43:in `decode_quint'
    from /Users/bjohnson/.rvm/gems/ruby-2.2.0/gems/rotp-2.1.0/lib/rotp/base32.rb:28:in `block in decode_block'
    from /Users/bjohnson/.rvm/gems/ruby-2.2.0/gems/rotp-2.1.0/lib/rotp/base32.rb:28:in `each_char'
    from /Users/bjohnson/.rvm/gems/ruby-2.2.0/gems/rotp-2.1.0/lib/rotp/base32.rb:28:in `each'
    from /Users/bjohnson/.rvm/gems/ruby-2.2.0/gems/rotp-2.1.0/lib/rotp/base32.rb:28:in `map'
    from /Users/bjohnson/.rvm/gems/ruby-2.2.0/gems/rotp-2.1.0/lib/rotp/base32.rb:28:in `decode_block'
    from /Users/bjohnson/.rvm/gems/ruby-2.2.0/gems/rotp-2.1.0/lib/rotp/base32.rb:10:in `block in decode'
    from /Users/bjohnson/.rvm/gems/ruby-2.2.0/gems/rotp-2.1.0/lib/rotp/base32.rb:9:in `each'
    from /Users/bjohnson/.rvm/gems/ruby-2.2.0/gems/rotp-2.1.0/lib/rotp/base32.rb:9:in `decode'
    from /Users/bjohnson/.rvm/gems/ruby-2.2.0/gems/rotp-2.1.0/lib/rotp/otp.rb:52:in `byte_secret'
    from /Users/bjohnson/.rvm/gems/ruby-2.2.0/gems/rotp-2.1.0/lib/rotp/otp.rb:26:in `generate_otp'
    from /Users/bjohnson/.rvm/gems/ruby-2.2.0/gems/rotp-2.1.0/lib/rotp/totp.rb:29:in `now'

But this works?

2.2.0 :014 > totp = ROTP::TOTP.new Base32.encode("dntqoaxas7rvtfuf").gsub(/=/, '')
 => #<ROTP::TOTP:0x007fdd4d045268 @interval=30, @issuer=nil, @digits=6, @digest="sha1", @secret="MRXHI4LPMF4GC4ZXOJ3HIZTVMY">
2.2.0 :015 > totp.now
 => "907944"

P.S.

Why is the Base32 decode hand rolled? Why not use the standard library?

Thanks!

[mdp]

It's hand rolled to match Google Authenticator's ignoring padding. See #29 and https://code.google.com/p/google-authenticator/source/browse/src/com/google/android/apps/authenticator/Base32String.java?repo=android#101

Most sites stick to using a random string of base32 characters as the secret, usually 16 bytes long (Google) or 24(Dropbox).

Feel free to reopen this if you feel there's a better solution.

[mdp]

Oh, and TOTP.new expects to be passed a string of Base32 characters. Your example above would be double encoding the secret

Base32.encode("dntqoaxas7rvtfuf") #=> "MRXHI4LPMF4GC4ZXOJ3HIZTVMY======"

ROTP::TOTP.new("dntqoaxas7rvtfuf") would be the preferred instantiation in this case and would match the output of most OTP mobile apps sharing this secret.

Hope that helps.