Function DecryptTOTPSecret

internal/crypto/totp.go:44–49

DecryptTOTPSecret decrypts a value previously written by EncryptTOTPSecret. It is strict: the stored value MUST carry the TOTPCipherPrefix marker. Callers handling a row written by an older release should detect ErrTOTPSecretNotEncrypted and treat the raw stored value as a legacy base32 secret.

(stored, key string)

// release should detect ErrTOTPSecretNotEncrypted and treat the raw
// stored value as a legacy base32 secret.
func DecryptTOTPSecret(stored, key string) (string, error) {
	if !strings.HasPrefix(stored, TOTPCipherPrefix) {
		return "", ErrTOTPSecretNotEncrypted
	}
	return DecryptAES(key, strings.TrimPrefix(stored, TOTPCipherPrefix))
}

// IsEncryptedTOTPSecret reports whether the stored value carries the
// TOTPCipherPrefix marker. Used by the totp authenticator's lazy