7

I'm looking to setup my website (C#/SQL 2008) to allow two factor authentication using Google Authenticator. I have the site working, from getting the QR code to generating the previous/current/next key (I'm happy to accept 3 in case clocks are out of sync).

Obviously we need to generate a secret key for each user, otherwise every user would have the same one time password.

My question is what is the best practice for storing this key? Can I store it as plain text in the users table, or should it be encrypted?

1 Answer 1

3

why not varchar ? as far as i know the qr code from google is an alphanumeric string ( that you could write by hand in case you couldn't bother installing a qr code scanner )

on my personal project for college, I generate a 128 character-long alphanumeric strings that I send to my custom TOTP app, my database stores this info as VARCHAR(128) ,

i think a best practice answer depends on how big the key is and how is your key-space defined, instead of 62 alphanumerical digits, why not use the whole ascii table ? you'd need to store your keys as varbyte right ?

8
  • 1
    as long as your server is secure, there is no need to encrypt the key, TOTP systems should simply protect the keys from public access, this means that as long as your key is stored in private memory of android phone and your android phone isn't rooted, your app is safe. as long as your server isn't hacked, your system is safe. even if you try to encrypt your keys, where will you store your encryption key? mind the fact that there isn't such a thing as absolute security.
    – cristi _b
    Commented Jan 14, 2013 at 18:53
  • 7
    "As long as your server is secure, there is no need to encrypt the key". That doesn't sound quite right to me. Isn't that the same as saying if your server doesn't get hacked then you don't need to hash a users password? Of course you protect the server as much as you can, but you still hash and salt a users password just in case.
    – Greg
    Commented Jan 14, 2013 at 19:00
  • 2
    i was expecting this : yes , you hash and salt user passwords, but if you want to do the same for the TOTP key, then your TOTP client instead of a secret key parameter will have to manage a key and a hash to calculate another key , so you can't avoid the fact that your TOTP client will store a clear version of the key
    – cristi _b
    Commented Jan 14, 2013 at 19:37
  • 1
    bear in mind that the whole point of TOTP is that the key used to calculate the OTP value as in RFC 6238 should be stored in a tamper resistant medium and should be protected against unauthorized access, this is achieved by making this value private. you can't really achieve all the security recommendations in the RFC because this would mean creating a hardware token instead of a software one. read more here tools.ietf.org/html/rfc6238
    – cristi _b
    Commented Jan 14, 2013 at 19:43
  • 1
    also, you shouldn't bother with the generation of multiple keys when you could increase the time period from 1 minute to two minutes or accept a 1 minute-old key or a 2-minute one, also, google authenticator should be able to request server time , most android phones shouldn't have issues with time sync since they all run on linux time
    – cristi _b
    Commented Jan 14, 2013 at 20:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.