Encrypt OTP secret in rests #11

New issue

Open

opened 2025-07-22 18:43:10 +00:00 by chartgerink · 0 comments

chartgerink commented

2025-07-22 18:43:10 +00:00

Owner

Currently, we store the base32 secret, used for one time password validation, in the database. This is common practice, but not necessarily best practice.

This issue tracks the work to allow for encrypting OTP secrets in rest. This requires an encryption key stored separately from the database, which is ephemerally retrieved when the base32 secret needs to be decrypted for validating an OTP code.

Implementing this is perfectly possible when specified for one installation, but I am not yet sure how to design this for self-hosting. It could be done using Hashicorp Vault, but if this is a dependency needed to do self-hosting it increases the architecture needed to self-host.

Until the design is clear and we can implement this in a reliable manner that can be deployed without additional overhead, we will rely on base32 secrets that are not encrypted at rest. When someone has access to the database, OTP secrets are not the biggest problem to deal with for our specific scenario.

Currently, we store the base32 secret, used for one time password validation, in the database. This is common practice, but not necessarily best practice. This issue tracks the work to allow for encrypting OTP secrets in rest. This requires an encryption key stored separately from the database, which is ephemerally retrieved when the base32 secret needs to be decrypted for validating an OTP code. Implementing this is perfectly possible when specified for one installation, but I am not yet sure how to design this for self-hosting. It could be done using Hashicorp Vault, but if this is a dependency needed to do self-hosting it increases the architecture needed to self-host. Until the design is clear and we can implement this in a reliable manner that can be deployed without additional overhead, we will rely on base32 secrets that are not encrypted at rest. When someone has access to the database, OTP secrets are not the biggest problem to deal with for our specific scenario.