fix(2fa): widen recovery code entropy to 80 bits (BUNYIP-202)

Claude-Run commented

2026-06-26 06:27:02 +02:00

Member

Recovery codes were drawn from only 4 random bytes (32 bits) and rendered
as an 8-hex-char XXXX-XXXX string. With 8 live codes per account and a 2FA
verify rate limit an attacker can sidestep by rotating source IPs, the
~2^32/8 search to hit any valid code was brute-forceable against the 2FA
challenge endpoint, bypassing the second factor.

Generate recovery codes from 10 CSPRNG bytes (80 bits) base32-encoded into
16 characters, grouped as XXXX-XXXX-XXXX-XXXX for readability. 80 bits
clears the OWASP >=64-bit bar for backup codes. Hyphens stay display-only:
generation and verify_recovery_code both normalise by stripping hyphens
and upper-casing before Argon2id hashing, so existing stored codes and the
verify path are unaffected by the format change.

The per-account failed-attempt lockout the audit also called for (key the
rate limit on user_id, not just source IP) already landed in BUNYIP-201, so
this change covers the remaining weak-entropy acceptance criterion.

#BUNYIP-202

Recovery codes were drawn from only 4 random bytes (32 bits) and rendered as an 8-hex-char XXXX-XXXX string. With 8 live codes per account and a 2FA verify rate limit an attacker can sidestep by rotating source IPs, the ~2^32/8 search to hit any valid code was brute-forceable against the 2FA challenge endpoint, bypassing the second factor. Generate recovery codes from 10 CSPRNG bytes (80 bits) base32-encoded into 16 characters, grouped as XXXX-XXXX-XXXX-XXXX for readability. 80 bits clears the OWASP >=64-bit bar for backup codes. Hyphens stay display-only: generation and verify_recovery_code both normalise by stripping hyphens and upper-casing before Argon2id hashing, so existing stored codes and the verify path are unaffected by the format change. The per-account failed-attempt lockout the audit also called for (key the rate limit on user_id, not just source IP) already landed in BUNYIP-201, so this change covers the remaining weak-entropy acceptance criterion. #BUNYIP-202

Claude-Run added 1 commit

2026-06-26 06:27:02 +02:00

fix(2fa): widen recovery code entropy to 80 bits (BUNYIP-202)

E2E / Playwright against deployment (pull_request) Successful in 1m10s

Details

Check / fmt + clippy + build + tests (pull_request) Failing after 38m42s

Details

9a82d78eb2

Recovery codes were drawn from only 4 random bytes (32 bits) and rendered
as an 8-hex-char XXXX-XXXX string. With 8 live codes per account and a 2FA
verify rate limit an attacker can sidestep by rotating source IPs, the
~2^32/8 search to hit any valid code was brute-forceable against the 2FA
challenge endpoint, bypassing the second factor.

Generate recovery codes from 10 CSPRNG bytes (80 bits) base32-encoded into
16 characters, grouped as XXXX-XXXX-XXXX-XXXX for readability. 80 bits
clears the OWASP >=64-bit bar for backup codes. Hyphens stay display-only:
generation and verify_recovery_code both normalise by stripping hyphens
and upper-casing before Argon2id hashing, so existing stored codes and the
verify path are unaffected by the format change.

The per-account failed-attempt lockout the audit also called for (key the
rate limit on user_id, not just source IP) already landed in BUNYIP-201, so
this change covers the remaining weak-entropy acceptance criterion.

#BUNYIP-202

David added 1 commit

2026-06-26 12:06:17 +02:00

Merge branch 'main' into fix/bunyip-202-recovery-code-entropy

E2E / Playwright against deployment (pull_request) Successful in 21s

Details

Check / fmt + clippy + build + tests (pull_request) Successful in 21m30s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

8e001eadc9