How to store MFA secret

Question

I have an online application that I'm adding MFA to, using the Google / Microsoft Authenticator apps for mobile phones. I've tried to adopt a security focussed approach to storing the MFA secret and at the moment, that secret is being encrypted using the users password within a database field. We don't store the password itself but the hash of the password and use it to compare to the users submitted password at run time for comparison.

I'm now realizing that there's a flaw in this methodology and that's when the user forgets their password and requests a password change. At that point, we've no way of decrypting the users secret (using their old password) so that we can re-store the secret using the submitted new password.

I was wondering how others deal with this? To my mind we have the following choices:

1. We force the user to set up their mobile app again with a new secret
2. We encrypt the secret, not to the users password, but to another form using another encryption string

I guess that (1) is the easiest but not the best for the user - they'd have to remove their (former) account from the app before scanning a QR code (or equivalent) to set up a new account.

(2) I like the idea of, but wonder how we should go about that. I thought of perhaps taking a hash of the users email address and using that as the encryption string as we can programmatically restore everything without the users password, but not sure that's secure enough?

Can anyone give me some guidance here as to where to look for possible solutions?

Answer 1

I guess it all depends on your thread model and szenario. I am reading between the lines that you are afraid of what will happen if an attacker gets access to the table containing the 2FA secrets, for example by a leaked backup or SQL injection.

If this is the case, you can encrypt the secrets with a systemwide key, that is loaded into your application from some key vault. This decouples where the key is stored and where the encryped secrets are stored. But your application needs to have access to both.

If the key is derived from the user, there is always the danger that an attacker could do the same.

In my last project we decided to create dedicated MfaService, written in a different language and using a different datastorage compared to the rest of the Application. The service was written in a way that it can store the secret and check a code for validity, but never reveal the secrat again. The User Service only stored a reference to the MFA Credentials. Thus, an attacker would need to access both services, which was good enough for our usecase.

Answer 2

I ended up storing the MFA secret encrypted according to the user's password as I believe that's the most secure way of doing so. When the user comes to change their password (which they have to every 90 days) I have to decrypt the secret using their old/existing password and then re-encrypt using their new password - it was a little more work than I had intended on doing, but I'm comfortable that the security is in line with other security factors that I'm working to.