Fix excessive key length recommendations.

Author: jchambers

README.md

@@ -32,8 +32,9 @@ final Key key;
 {
     final KeyGenerator keyGenerator = KeyGenerator.getInstance(totp.getAlgorithm());
 
-    // SHA-1 and SHA-256 prefer 64-byte (512-bit) keys; SHA512 prefers 128-byte (1024-bit) keys
-    keyGenerator.init(512);
+    // Key length should match the length of the HMAC output (160 bits for SHA-1, 256 bits
+    // for SHA-256, and 512 bits for SHA-512).
+    keyGenerator.init(160);
 
     key = keyGenerator.generateKey();
 }

src/main/java/overview.html

@@ -39,7 +39,7 @@ <h2>Usage</h2>
         <pre>final Key secretKey;
 {
     final KeyGenerator keyGenerator = KeyGenerator.getInstance(totp.getAlgorithm());
-    keyGenerator.init(20);
+    keyGenerator.init(160);
 
     secretKey = keyGenerator.generateKey();
 }</pre>

src/test/java/com/eatthepath/otp/ExampleApp.java

@@ -34,8 +34,9 @@ public static void main(final String[] args) throws NoSuchAlgorithmException, In
         {
             final KeyGenerator keyGenerator = KeyGenerator.getInstance(totp.getAlgorithm());
 
-            // SHA-1 and SHA-256 prefer 64-byte (512-bit) keys; SHA512 prefers 128-byte (1024-bit) keys
-            keyGenerator.init(512);
+            // Key length should match the length of the HMAC output (160 bits for SHA-1, 256 bits
+            // for SHA-256, and 512 bits for SHA-512).
+            keyGenerator.init(160);
 
             key = keyGenerator.generateKey();
         }