I need to store third party credentials in a database for a web application. The third party supports OAUTH and I plan on getting a long-lived token to allow my app to access the third party, but I would like to protect the OAUTH token stored in my database by encrypting it with the user's login password (using PBKDF2 or bcrypt).

Since users routinely pick very bad passwords, I am requiring two-factor authentication to my application using TOTP (RFC 6238).

Is there any way to incorporate the TOTP token into a scheme to encrypt the third-party OAUTH token?


1 Answer 1


This makes no sense. There is an interesting basic difference between passwords and TOTP/HOTP. TOTP is a symmetric algorithm. The server and the client share the same information. They share the OTP secret key, the synchronized time and the last timecounter to avoid replay.

In contrast the password authentication mechanism does not share information. The user knows the password, but the server does not know the password. It only knows the salted and maybe peppered hash of the password. I.e. the server does not have all necessary components to get to know, what the user knows - i.e. the password!

Again, in the case of TOTP the server has all information. The user does not have any additional information. This means if you want to use TOTP to encrypt something on the server, the server will also have all information to encrypt/decrypt this. And this means that the encrypted data and the encryption key (or the information you use to create the encryption key) are located on the server.

The question is, which threats you want to mitigate.

Mitigating the threat of sql injections and stealing the database can be faced by using an application level encryption key, that is not stored in the database. In this case this is even better than creating an encryption key from any TOTP material, which is probably also stored in the database, since the attacker would get the encrypted data and the information to create the encrpytion key when he stole the database.

  • Saying that the question "makes no sense" is is equivalent to saying that it is a "stupid question". Although your explanation for why it will not work is sound, there was no reason to down vote it. The purpose of this forum is to allow people who do not know something to increase their knowledge.
    – Ralph
    Commented May 22, 2016 at 10:15
  • I did not say, that your question does make no sense. Your question is totally legit. I ment that the idea, to protect the data by using TOTP makes no sense. And then I think I explained it fairly good. The important thing is, that you get an idea what to do or what not do do. I do not know, why this was down voted.
    – cornelinux
    Commented May 22, 2016 at 14:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .