Local TOTP authenticator

Partly implemented in 0.4.0. Manual setup-key/otpauth entry, protected interoperable otp field, RFC 6238 codes with countdown/reveal, existing clipboard integration and lock cleanup. Remaining: Camera QR scanning, signed physical-device testing and independent security review remain pending.

Architecture and scope

Before 0.4, Vault had no authenticator view. The 0.4 source adds manual TOTP setup and protected KDBX fields without adding camera permission or a network service. QR scanning remains a separate unimplemented milestone.

Design under review

Use RFC 6238 HMAC with validated otpauth TOTP URIs, SHA-1/256/512, bounded Base32 secrets, periods and 6/8 digits. Preserve a protected interoperable otp custom field. Reveal codes only while unlocked. Camera scanning stays an explicit mobile permission; reject remote QR URLs and never upload images. Native clipboard expiry can be enforced best-effort; browser expiry must not be promised when permissions or backgrounding prevent it.

Milestones

1. M1: RFC known-answer vectors, strict URI/parser and protected KDBX round trips
2. M2: entry editor, countdown, local import and native conditional clipboard clearing
3. M3: physical mobile QR permission/denial tests; camera disabled outside scan view

Required acceptance tests

• All RFC 6238 SHA variants and boundary times match
• Malformed, duplicate or oversized URI parameters fail closed
• Lock removes seed/code and stops countdown

Limits

TOTP in the same vault as a password is convenient but does not provide an independent second factor after that vault is compromised.

Any implementation must preserve local unlock/export, add KDBX/KeePassXC regressions for crypto/format changes and update privacy disclosures before new data flows begin.

Primary references: datatracker.ietf.org

← All 41 workstreams