[KEYPROV] OCRA without truncation

[Simon Josefsson <[e-mail]>]

Hi,

I'm merging OCRA support into my OATH Toolkit implementation
(<http://www.nongnu.org/oath-toolkit/>) and we are discussing how OCRA
without truncation is supposed to work.

I haven't been able to figure out from the RFC what the output should be
when t=0.  There are no test vectors for that case.

A naive reader would notice this definition in section 5:

   In a nutshell,
                     OCRA = CryptoFunction(K, DataInput)

together with this from section 4.1:

   As a reminder:
                     HOTP(K,C) = Truncate(HMAC-SHA1(K,C))

and section 5.2 which specify the CryptoFunction:

   We define the HOTP family of functions as an extension to HOTP:

   1.  HOTP-H-t: these are the different possible truncated versions of
       HOTP, using the dynamic truncation method for extracting an HOTP
       value from the HMAC output

   2.  We will denote HOTP-H-t as the realization of an HOTP function
       that uses an HMAC function with the hash function H, and the
       dynamic truncation as described in [RFC4226] to extract a t-digit
       value

   3.  t=0 means that no truncation is performed and the full HMAC value
       is used for authentication purposes

so one could interpret this as when t=0, the Truncate function is not
invoked at all, and instead OCRA takes on the output value of the
HMAC-SHA1 function, which is a binary string.

Are there any implementation of OCRA with t=0?  What encoding, if any,
of the HMAC output is used?  Decimal, hex, binary?

The sample code in the RFC will always output the static code "1" as the
OCRA code for t=0, if I read the code correctly, which seems like a bug.

/Simon