RFC and freeOTP require at least 128 bit, better 160bit and more. newer freeOTP versions show warnings if the length is less than 128 bit.