Hash algorithm set to SHAxxx other than SHA1 not work about adfsmfa HOT 4 CLOSED

In short, No.

But the spécifications for HOTP only supports HMAC-SHA1, for TOTP, the specifications supports (SHA1, SHA256, SHA3384, SHA512)

But, when we push your first version, Mobile Apps like Google Authenticator, Microsoft Authenticator ONLY supports SHA1. But thers's no security problem (:sunglasses:) because the code is changing every 30 seconds.

See :
https://github.com/google/google-authenticator/wiki/Key-Uri-Format
google/google-authenticator-libpam#11
https://tools.ietf.org/html/rfc6238
https://tools.ietf.org/html/rfc4226

So we choose, to stay "compatible" with IETF and editors implementations.

We can look again, if it is desirable to implement superior hash algorithm (aka: SHA256).
But it must absolutely be functional with the majority of Google and Microsoft "Authenticator" mobile applications.

On the other hand, it is possible to have very complex keys, that' why we push an implementation with certificates (keys 2048 RSA)

from adfsmfa.

I see. I just want to know if I can use higher SHA because the algorithm textbox can be changed, now I am sure it cannot. Thanks.

from adfsmfa.

Of course, we want to use higher SHA algoritm, the textbox follow the "official" (ietf !) specification.
As we said, soon, we are going to look if we we can now support SHA256 and higher.

Regards

from adfsmfa.

Version 2.0.2966 available

We added support for iterating (downgrading) HMAC algorhytms : SHA1, SHA256 to SHA512
Remember, that it's not a bug, these algorythms are specified in rfc4226 and rfc6238. but they are not supported by many editors (Microsoft, Google, ...) To support SHA256 you must use an Authenticator like
Authy

Regards

from adfsmfa.