We have a public website for employees which has access to some sensitive company information. To make the login process more secure we want to implement TOTP. The setup and implementation has been quite straight forward. What I'm not clear on is the best way to store the seed for each user.
It obviously can't be salted and hashed as you need it to generate the time based code. MD5 type encryption seems a bit pointless given how quickly it can be decrypted, so my question is what is the best way to store the seed, and is it ok to store it in the same table as the username and password?