Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have a public website for employees which has access to some sensitive company information. To make the login process more secure we want to implement TOTP. The setup and implementation has been quite straight forward. What I'm not clear on is the best way to store the seed for each user.

It obviously can't be salted and hashed as you need it to generate the time based code. MD5 type encryption seems a bit pointless given how quickly it can be decrypted, so my question is what is the best way to store the seed, and is it ok to store it in the same table as the username and password?

share|improve this question
up vote 2 down vote accepted

MD5 type encryption seems a bit pointless given how quickly it can be decrypted,

Don't get your terminology mixed up. MD5 is a hash algorithm, not an encryption algorithm. There is a world of a difference between the two.

To answer your question, I don't see an issue with storing the seed unencrypted together with the username and password in a database. A TOTP seed is easy enough to reset if you ever get compromised. You need the seed in cleartext for the algorithm to work anyway.

share|improve this answer
Resetting the seed when using Google Authenticator as TOTP provider may be easy but will be impossible when using a hardware token with the seed 'burnt in'. – Jeff Sep 23 '13 at 18:24
@Jeff You are right of course. I did not consider that scenario. – Terry Chia Sep 24 '13 at 0:48
@Jeff, not a problem for us in the case as we're using mobile phone applications, but I see your point – Greg Sep 25 '13 at 2:45

I would highly recommending encrypting the seed. However easy it may be to re-distribute seeds for your TOTP applications, a compromise would mean that an adversary is capable of instantly computing the second factor of your 2FA login.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.