2

I'm currently developing two factor authentication based on totp. For this you have to generate a secret and save it on the server side and on the client-side (usually through the QR code).

My Question: How do I store it in the database? My requirements are that it's saved secure, preferably encrypted. Hashed doesn't work because I need to be able to have the plain-text value in order to calculate the totp secret code. When I encrypt it, with what key? Should I use a general key? Should I use the password from the user as the key? This would have the disadvantage that when a password reset is done, I can't Decrypt the totp secret key anymore.

Any ideas?

Rhalp Darren Cabrera
  • 926
  • 14
  • 23
Dev0r
  • 193
  • 2
  • 13
  • See also: https://security.stackexchange.com/questions/42795/storing-seed-for-totp?rq=1 – David Mar 23 '18 at 20:05
  • imho you can have a master key or user specific key (indeed the passwords are not the best choice). – gusto2 Mar 24 '18 at 11:08

0 Answers0