SHA256 and SHA512 might be failing

[tilkinsc]

I am not sure where the root cause is, but the SHA256 and SHA512 are failing in my tests with the test/main.c* programs.

Isolation necessary.

[tilkinsc]

I think I have SHA256 and SHA512 working. The problem was rooted based on the generation size. A SHA1 HMAC generates 20 bytes. A SHA256 HMAC or SHA512 HMAC generates 32 bytes. This means the library had some hardcoded logic, and additionally it had logic built directly into it due to expecting these. I have found no implementation that uses SHA256 or SHA512 to bounce my library off of them. Authy, what I used for testing, doesn't support SHA256 or SHA512 and I am chatting with their engineering team because thats just unacceptable. SHA1 hashes have been deprecated and not recommended for use, like MD5.

[freddy77]

I was looking at https://2fasolution.com/totp.html, or use Android FreeOTP application passing settings using URI output and qrencode under Linux.

[tilkinsc]

Have you tested the output against it?

Oh yeah and the result from Authy engineers was forever ago, but not planned.