Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have implemented the login/verification aspect of a two factor auth system as per RFC 6238.

It works fine with Google Authenticator, which is great.

Now I am turning my attention to the backup codes, that are provided by services implementing 2FA such as Google and GitHub.

I notice they are of a different length and/or format to the usual 6 digit direct authentication code.

So, do I:

  • Generate an arbitrary number of codes when a user sets up 2FA
  • Store them in the DB alongside the user
  • Make use of the fact they are a different length or format in order to decide how to check them?

Are they supposed to be random, or generated based on some hash of the user?

share|improve this question
    
Because Google can regenerate new codes for you on command, one would think they're randomly generated. –  eric_lagergren Jul 7 at 19:16

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.