RFC 6238
An IETF standard document for TOTP (Time-based One-Time Password). It defines an algorithm that uses a shared secret and a timestamp to generate dynamic verification codes.
Timeline (last 90 days)
In a hands-on video by a Bilibili uploader, REA analyzed an APK app and located that the verification code generation logic uses the standard RFC 6238 TOTP algorithm, padding with zeros on the left when the result is fewer than 6 digits.
TOTP is defined in RFC 6238 and is a time-dimension extension of HOTP (RFC 4226); it is computed by dividing the current Unix timestamp by the time step to obtain a counter C, then computing HMAC-SHA1(K, C), extracting a 31-bit integer via dynamic truncation, and taking the result modulo 10^6 to obtain a 6-digit verification code.
RFC 6238 allows the server to tolerate a certain degree of drift, typically one 30-second window before and after, i.e. a tolerance range of about 90 seconds.
Google Authenticator adopts the RFC 6238 standard (TOTP).
All Facts (5)
TOTP协议基于RFC 6238标准，每30秒生成一个6位动态码
95%UnverifiedTOTP is defined in RFC 6238 and is a time-dimension extension of HOTP (RFC 4226); it is computed by dividing the current Unix timestamp by the time step to obtain a counter C, then computing HMAC-SHA1(K, C), extracting a 31-bit integer via dynamic truncation, and taking the result modulo 10^6 to obtain a 6-digit verification code.
50%UnverifiedRFC 6238 allows the server to tolerate a certain degree of drift, typically one 30-second window before and after, i.e. a tolerance range of about 90 seconds.
50%UnverifiedGoogle Authenticator adopts the RFC 6238 standard (TOTP).
50%UnverifiedIn a hands-on video by a Bilibili uploader, REA analyzed an APK app and located that the verification code generation logic uses the standard RFC 6238 TOTP algorithm, padding with zeros on the left when the result is fewer than 6 digits.
50%