Guest User!

You are not Sophos Staff.

Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 5 replies
  • Subscribers 5 subscribers
  • Views 3551 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Change OTP tokens from SHA-1 to SHA-256

Vhince Chua

Hi Everyone,

I want to know if there will be effect on existing users or connection using SHA1 generated tokens if it is change to a more secured Hash algorithm (SHA256 and SHA512)?

Setup s in production and it is applied to OTP facilities for User Portal, IPsec Remote Access, SSL VPN Remote Access and Hotspot

Regards



This thread was automatically locked due to age.
Parents
  • FormerMember
    +1 FormerMember

    Hi ,

    Thank you for reaching out to Sophos Community.

    Changing the Hash algorithm to SHA256 or SHA512 would not affect existing OTP users as their tokens were generated using the SHA1 algorithm. New OTP tokens will be generated with new configured Hash algorithm. Here is a snapshot for reference.

  • 0 in reply to FormerMember

    Hello 

    Thanks for the screenshot you provided. Does it work with Microsoft Authenticator as  mentioned in this thread?

    Regards

  • 0 in reply to Vhince Chua

    Hi. I edited my post, because the link of labanskoller blog didn't work.

    The functions of the different APPs are shown very well -> have a look!

    The problem can only be seen at second glance when the offered OTPs do not work.
    Most APPs import the key, but do not notice that they are not allowed to calculate SHA1 with them.
    Result: No error message from the APP when scanning the barcode - but the OTP is incorrect.

    Cheers, Janbo

Reply
  • 0 in reply to Vhince Chua

    Hi. I edited my post, because the link of labanskoller blog didn't work.

    The functions of the different APPs are shown very well -> have a look!

    The problem can only be seen at second glance when the offered OTPs do not work.
    Most APPs import the key, but do not notice that they are not allowed to calculate SHA1 with them.
    Result: No error message from the APP when scanning the barcode - but the OTP is incorrect.

    Cheers, Janbo

Children
No Data