I'm writing a little webapp that demonstrates 2 factor authentication. I'm using the TOTP protocol as described in RFC 6238. In our scheme, we are storing, in addition to a b-crypted password hash for each user, a secret key, which is used to validate one-time codes.
I'm using postgreSQL for a database backend. Let's pretend my database is compromised without my knowledge. The passwords are all safe since I'm salting and bcrypting them: there is no easy attack that will reveal all of the passwords, short of brute forcing each one.
Is there any way I can safely store the key for the TOTP though? I can't hash it, I need its plaintext for OTP validation.
Is there any way to securely store this key?