Timeline for Two Factor Authentication Secret Storage
Current License: CC BY-SA 4.0
5 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Apr 29, 2021 at 6:53 | comment | added | Soroush Falahati | @brynk Yeah, but we have the salt to add entropy. so a dictionary attack won't help; they actually need to do the search. In any case tho, this is just an example and you can bcrypt it 20 times or something and use the hash of that for encryption. I just used SHA256 since the output hash is 256bit and is ideal to be used as the AES256 key. | |
| Apr 28, 2021 at 20:24 | comment | added | brynk | This is an interesting idea, however, I encourage you to consider the method by which the key is derived to encrypt the secret. In the solution as it is presented, all that needs to happen is for an instance of the TOTP code and time of use to leak along with the database, and now the user's password (and OTP-secret) are exposed to an exhaustive search for a SHA2 hash. This could happen via an audit log? Even though the OTP secret is (should be) high-entropy, the user's password most likely won't be, which introduces the possibility of highly parallel dictionary searches. | |
| Apr 28, 2021 at 12:48 | history | edited | Soroush Falahati | CC BY-SA 4.0 |
added 89 characters in body
|
| Apr 28, 2021 at 12:25 | review | First posts | |||
| Apr 28, 2021 at 17:22 | |||||
| Apr 28, 2021 at 12:25 | history | answered | Soroush Falahati | CC BY-SA 4.0 |