{"action":"created","issue":{"url":"https://api.github.com/repos/Bouke/django-two-factor-auth/issues/96","labels_url":"https://api.github.com/repos/Bouke/django-two-factor-auth/issues/96/labels{/name}","comments_url":"https://api.github.com/repos/Bouke/django-two-factor-auth/issues/96/comments","events_url":"https://api.github.com/repos/Bouke/django-two-factor-auth/issues/96/events","html_url":"https://github.com/Bouke/django-two-factor-auth/issues/96","id":80953743,"number":96,"title":"Encrypt secrets in DB","user":{"login":"vilda","id":664251,"avatar_url":"https://avatars.githubusercontent.com/u/664251?v=3","gravatar_id":"","url":"https://api.github.com/users/vilda","html_url":"https://github.com/vilda","followers_url":"https://api.github.com/users/vilda/followers","following_url":"https://api.github.com/users/vilda/following{/other_user}","gists_url":"https://api.github.com/users/vilda/gists{/gist_id}","starred_url":"https://api.github.com/users/vilda/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vilda/subscriptions","organizations_url":"https://api.github.com/users/vilda/orgs","repos_url":"https://api.github.com/users/vilda/repos","events_url":"https://api.github.com/users/vilda/events{/privacy}","received_events_url":"https://api.github.com/users/vilda/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/Bouke/django-two-factor-auth/labels/enhancement","name":"enhancement","color":"84b6eb"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-05-26T13:04:41Z","updated_at":"2015-05-29T09:46:16Z","closed_at":null,"body":"A good practice is to encrypt or hash secret keys in DB. I would suggest to implement this. (Enhancement)\r\n\r\nWhile for one-off keys one way hash functions such as scrypt/bcrypt are available, that's not the option for TOTP where the actual key value is needed. Simple encryption where the encryption key is not stored in DB suffice.\r\n\r\nEncryption of secret keys is recommended by RFC 6238."},"comment":{"url":"https://api.github.com/repos/Bouke/django-two-factor-auth/issues/comments/106760202","html_url":"https://github.com/Bouke/django-two-factor-auth/issues/96#issuecomment-106760202","issue_url":"https://api.github.com/repos/Bouke/django-two-factor-auth/issues/96","id":106760202,"user":{"login":"Bouke","id":235882,"avatar_url":"https://avatars.githubusercontent.com/u/235882?v=3","gravatar_id":"","url":"https://api.github.com/users/Bouke","html_url":"https://github.com/Bouke","followers_url":"https://api.github.com/users/Bouke/followers","following_url":"https://api.github.com/users/Bouke/following{/other_user}","gists_url":"https://api.github.com/users/Bouke/gists{/gist_id}","starred_url":"https://api.github.com/users/Bouke/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Bouke/subscriptions","organizations_url":"https://api.github.com/users/Bouke/orgs","repos_url":"https://api.github.com/users/Bouke/repos","events_url":"https://api.github.com/users/Bouke/events{/privacy}","received_events_url":"https://api.github.com/users/Bouke/received_events","type":"User","site_admin":false},"created_at":"2015-05-29T09:46:16Z","updated_at":"2015-05-29T09:46:16Z","body":"The relevant part in the specification is the following:\r\n\r\n> We also RECOMMEND storing the keys securely in the validation system,\r\nand, more specifically, encrypting them using tamper-resistant\r\nhardware encryption and exposing them only when required: for\r\nexample, the key is decrypted when needed to verify an OTP value, and\r\nre-encrypted immediately to limit exposure in the RAM to a short\r\nperiod of time.\r\n\r\n> The key store MUST be in a secure area, to avoid, as much as\r\npossible, direct attack on the validation system and secrets\r\ndatabase.  Particularly, access to the key material should be limited\r\nto programs and processes required by the validation system only.\r\n\r\nHardware encryption cannot be enforced by this package, but the encryption could be implemented."}}