How to securely store Google Authenticator secret key?

Question

I am developing a website that will allow two factor authentication using Google Authenticator. My question is: what is the best way to store users' secret keys? If I keep it in a database and it is hacked then the attacker would be able to generate one time passwords. And I cannot encrypt it like passwords with one-way encryption because I need this secret seed to generate one-time passwords.

Answer 1

You could store it in a secure token (smart card), but then you will have to configure access to that secure token - which brings you back to your original problem. If you are able to perform an action before starting up your application then you can use Password Based Encryption to protect (wrap) the secret key. Or you could require a PIN for the smart card holding the key. USB-memory cards could also be used to permanently store the key (don't forget that backup).

Obviously it is a good idea to protect access to your application in the first place. You may still need the key in memory at some point of time, so an attacker would be able to fish it out if that memory is not protected.

Another method often used it to obfuscate the key. But a determined hacker will usually not have too much trouble retrieving the key whichever way the obfuscation is done.