RFC 6238 TOTP worked by hand: one code, 18 test vectors, and the 32-byte key trap

·1 views

A developer walks through computing a single TOTP code from the RFC 6238 test key at Unix time 59, showing each step from the time counter to the final eight digits. The article explains how TOTP differs from HOTP in its counter source and why the counter must always be encoded as an 8-byte big-endian value. It notes that the RFC's SHA-256 and SHA-512 test vectors require 32- and 64-byte keys, so using the 20-byte SHA-1 key silently produces wrong codes without raising an error. The piece also covers common user-entry problems with Base32 seeds and how clock offsets can be mistaken for key mismatches.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Feed Claude Code axe-core's Violation List, Not a Vague Accessibility Request

A February 2026 WebAIM scan of a million home pages found that 82.7% used ARIA, yet pages with ARIA averaged more detected errors than those without. The author notes that ARIA pages were also more complex, so the link is not established as causal. Asking a coding agent to simply make a page accessible tends to produce large, hard-to-verify diffs, such as blanket aria-label additions that can override existing semantics. The recommended approach is to run axe-core to list violations by rule ID and CSS selector, and to use that list as the agent's task. A Playwright test running the same rules then serves as verification, and it should be written by the developer before the agent begins.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Guide Compares Eight AI Knowledge Tools for Air-Gapped Teams

An outdated procedure can keep circulating on air-gapped networks when the current answer is buried in wiki pages or files. A useful knowledge tool must surface trusted material without sending data beyond the security boundary. The guide recommends first deciding whether the source material is maintained wiki pages, a document collection, or both. It then checks whether the application, models, identity setup, updates, and supporting services can run fully offline. Eight options are assessed on shared retrieval, isolated deployment fit, knowledge structure, and offline operating effort.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

ScriptMasterLabs shares lessons from listing 24 MCP servers on icon handling

ScriptMasterLabs runs 24 MCP servers offering 182 tools, listed across the Official MCP Registry, Glama, Smithery, the CDP Bazaar, and its own hub. The company notes that most directories never run a server and instead display whatever icon and metadata are in the published source, so a faulty icon can fail silently across listings. It advises downloading official brand assets from the modelcontextprotocol GitHub organization and committing them locally rather than scraping or hotlinking. The guide recommends treating SVG as the master file, exporting fixed-size PNGs at 16, 32, 128, and 512 pixels, and testing small sizes against light and dark backgrounds. It also recommends using light and dark icon variants selected by media query, so the mark stays visible on any registry theme.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Mercury 2.5 Ranks Near Top for LLM Output Speed, Raising Agent and RAG Design Questions

Artificial Analysis lists Inception's Mercury 2.5 at roughly 1,178 output tokens per second, placing it second among 146 models on speed. The page does not report an Intelligence Index score, so the model's quality remains unverified, and the speed figure varies by provider and measurement snapshot. Most production LLMs generate one token at a time, while Inception is known for diffusion-style models that refine many positions in parallel, reducing sequential steps. The author argues that faster decoding shifts engineering priorities, making extra reasoning, candidate voting, and LLM-based reranking more practical in agent loops and RAG pipelines. The piece also cautions that generation is often not the main latency bottleneck, so teams should profile end-to-end task time before changing models.

0 comments Read more at DEV Community