Care should be taken to ensure that the new default works with both Google Authenticator and FreeOTP.

FreeOTP works with all SHA variants FreeIPA currently supports (SHA-1, SHA-256, SHA-384, SHA-512) but Google Authenticator for Android supports only SHA-1 and uses SHA-1 even when other hash is specified in the URI. Google Authenticator for iOS seems to work properly.

SHA-1 for OTP is still fine. HOTP and TOTP use a truncated HMAC from a shared secret, and either a counter (HOTP) or time stamp (TOTP). Since the algorithm is using HMAC, the new SHA-1 attacks do not apply. Because OTP uses truncated HMAC, an evesdropper never learns the internal full state of the HMAC construct either.

Yes, there are attacks on HMAC, e.g. https://dankaminsky.com/2015/05/07/the-little-mac-attack/ . The little MAC attack is a collision attack on HMAC-MD5 with well-known keys. An attacker is able to construct a second message that generates the same HMAC value for a given key. This attack is irrelevant for OTP.

I agree with the general idea. It's a good thing to slowly move away from SHA-1. At the moment we have enough time to focus on compatibility. AFAIK some OTP generators do not properly support SHA-256. Before we default to SHA-256, we have to ensure compatibility with all relevant authenticators:

• FreeOTP authenticator
• Google authenticator
• Yubico authenticator and Yubi Key NFC devices
• take youre pick from https://play.google.com/store/search?q=otp%20authenticator&c=apps&rating=1

FreeIPA 4.5.1 has been released, moving to FreeIPA 4.5.2 milestone

This is blocked by:
https://github.com/google/google-authenticator-android/issues/29

If anyone finds it useful here is a survey of some of the authenticators found on the Apple App Store and the Google Play Store and what algorithms they support https://gist.github.com/gwelch-contegix/afa52c7b45693a19c198ab0bfb886fe2