Repository navigation
Replies: 2 comments 2 replies
|
You may need to recommend other OTP applications, since some applications (I think Google Authenticator is one) may only support SHA1. |
|
Great point, Thanks. So we may need to change the docs and possibly few other places if we want to change the default from SHA1. |
|
I assume most users will use the commonly recommended applications (e.g., Google Authenticator, Authy, Microsoft Authenticator, FreeOTP); having one of them not work with the default setting may cause some user issues, since users could expect any application to work. There should at least be a warning for admins in the docs about this - maybe also adding a message in the settings, similar to the field in the |
|
In 2026 MS auth app still does not support OTP hash algorithm SHA256 :) |
Uh oh!
There was an error while loading. Please reload this page.
Keycloak default OTP policy uses
OTP hash algorithmconfigured toSHA1by default. Is it ok if we change default policy toSHA256instead? TheSHA1may not be considered secured enough nowadays, especially in some environments (EG. FIPS). TheSHA1will be still available in most cases as an option in the realm policies (unless explicitly disabled for example by theSHA1algorithm unavailable due the restrictions in the Java security file on FIPS platforms).Also I think that we don't need to handle migration but just keep existing realms configured as they are. So for example if they were in the previous version with
SHA1, we will still keep it. However we can add note to migration guide that default algorithm was changed and administrators can consider changing their policies.All reactions