Local TOTP authenticator

Proposal, not an available feature. No network permission or new data collection is enabled. These RFCs are locally prepared; remote review/merge awaits the owner repository.

Current architecture

Entries currently contain password/card/note/page fields; there is no OTP parser, authenticator view or camera permission.

Design under review

Use RFC 6238 HMAC with validated otpauth TOTP URIs, SHA-1/256/512, bounded Base32 secrets, periods and 6/8 digits. Preserve a protected interoperable otp custom field. Reveal codes only while unlocked. Camera scanning stays an explicit mobile permission; reject remote QR URLs and never upload images. Native clipboard expiry can be enforced best-effort; browser expiry must not be promised when permissions or backgrounding prevent it.

Milestones

1. M1: RFC known-answer vectors, strict URI/parser and protected KDBX round trips
2. M2: entry editor, countdown, local import and native conditional clipboard clearing
3. M3: physical mobile QR permission/denial tests; camera disabled outside scan view

Required acceptance tests

• All RFC 6238 SHA variants and boundary times match
• Malformed, duplicate or oversized URI parameters fail closed
• Lock removes seed/code and stops countdown

Limits

TOTP in the same vault as a password is convenient but does not provide an independent second factor after that vault is compromised.

Any implementation must preserve local unlock/export, add KDBX/KeePassXC regressions for crypto/format changes and update privacy disclosures before new data flows begin.

Primary references: datatracker.ietf.org

← All 41 workstreams