Newly generated secrets failing to verify codes about twofactorauth

[matthewc83]

I'll dig away - I am wondering if it's somehow something to do with infrastructure that is more complex in prod/staging vs local and demo. I am pretty positive it's going to come down to "my" error somewhere - I'll report back if/when I figure it out! Cheers for the input thus far, even knowing it's not something obvious is good to know.

[matthewc83]

Hey, just to confirm this does indeed fall under "user error" - no surprises there. A change in our code meant that in actual fact 2 codes were being generated in some environments with the "wrong" one being returned to the user thus never being able to be verified.

Thanks for the suggestions, apologies for the time wasting!

[willpower232]

To confirm, you generate a secret successfully, store it in your app of choice but then cannot confirm that the codes that come out of that secret with the same code?

The most basic step is have you verified that the time is correct on all your servers?

[matthewc83]

Hi @willpower232 thanks for the reply.
I generate the code successfully yes, it's the comparison to the users 6 digits that is failing on some servers.
I am thinking down the lines of time thing - though the servers all appear to report the same time, same timezone etc.

[willpower232]

I don't think timezone should matter, it would be whether the time down to the seconds is correct.

I'd hope you would get an exception or something if a dependency were missing. I guess you could compare the output of php -i from each server to be sure the environments were appropriately similar.

[matthewc83]

A diff between the outputs of php -i. I don't THINK I see anything obvious:
diff

[matthewc83]

Just thinking, if it was a server time thing - would it be expected that users with existing secrets have no issues? Wouldn't their codes be different from what the server is expecting?

[willpower232]

The diff looks fine although they have different image libraries so that might be annoying if you're generating QR codes. Although it could be mcrypt related maybe?

I guess the users devices need to have accurate time as well.

If one users secret works on a server and another users does not then the other users device time must be wrong or they entered the secret incorrectly.

[matthewc83]

Sadly already ruled out the QR code side by using the generated code rather than the QR code.
also ruled out user device based on it being my device working against some environments and not others.
I guess I'll keep at it - probably something stupid that is escaping me.

[willpower232]

You can see that in spite of mcrypt, it still uses random_bytes where possible

TwoFactorAuth/lib/TwoFactorAuth.php

Lines 333 to 335 in e76f31e

	if (function_exists('random_bytes')) {
	return $this->rngprovider = new CSRNGProvider();
	}

You could ensure that the function is available on both servers to narrow it down.

[matthewc83]

Yeah, I had put some debugging around that before I started swapping out providers - they were all using CSRNGProvider() by default

[willpower232]

Hmm definitely a mystery. I guess you could also verify that the secret being passed to the library was absolutely identical although if it was different then that would be even weirder.

[willpower232]

No worries, glad you figured it out! Thanks for letting us know