Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

We have a public website for employees which has access to some sensitive company information. To make the login process more secure we want to implement TOTP. The setup and implementation has been quite straight forward. What I'm not clear on is the best way to store the seed for each user.

It obviously can't be salted and hashed as you need it to generate the time based code. MD5 type encryption seems a bit pointless given how quickly it can be decrypted, so my question is what is the best way to store the seed, and is it ok to store it in the same table as the username and password?

share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

MD5 type encryption seems a bit pointless given how quickly it can be decrypted,

Don't get your terminology mixed up. MD5 is a hash algorithm, not an encryption algorithm. There is a world of a difference between the two.

To answer your question, I don't see an issue with storing the seed unencrypted together with the username and password in a database. A TOTP seed is easy enough to reset if you ever get compromised. You need the seed in cleartext for the algorithm to work anyway.

share|improve this answer
1  
Resetting the seed when using Google Authenticator as TOTP provider may be easy but will be impossible when using a hardware token with the seed 'burnt in'. –  Jeff Sep 23 '13 at 18:24
    
@Jeff You are right of course. I did not consider that scenario. –  Terry Chia Sep 24 '13 at 0:48
    
@Jeff, not a problem for us in the case as we're using mobile phone applications, but I see your point –  Greg Sep 25 '13 at 2:45
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.