Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Companies such as Barclays use cryptographic seeds (for their PINsentry system), RSA do the same for RSA SecurID, but how do they safely secure the seeds in the database. With passwords you just hash it at and add a salt, but the server must know the original seed to verify the users code, the one-time password generated from the seed.

share|improve this question

closed as off-topic by Maarten Bodewes, Henrick Hellström, poncho, DrLecter, Seth Feb 17 '15 at 21:34

  • This question does not appear to be about cryptography within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

"how do they safely secure the seeds", they don't – mikeazo Feb 16 '15 at 15:25
They must keep them secret somehow, otherwise it's completely pointless right. If they get hacked, that's it, there done for, along with everyone who uses it – Ramonster Feb 16 '15 at 15:29
Did you read the article I linked to? RSA got hacked, they had to issue 40 million new tokens. – mikeazo Feb 16 '15 at 15:50
I've read that article before as part of my research on cryptography. It says they were compromised, but it doesn't say how it was protected, or not protected. I guess that's why they used passwords with RSA. But Barclays don't. But it's incredibly stupid not to protect credentials. But anyway, there must be a way to store them safely, instead of stupidly. Thanks for your comments though @mikeazo – Ramonster Feb 16 '15 at 16:13
I'm voting to close this question as off-topic because 1) it's about security rather than cryptography and 2) we don't know for sure - ask the companies involved. Answers here cannot be verified unless this is public information. – Maarten Bodewes Feb 16 '15 at 16:33

The best way to encrypt a seed in a db would be to use multiparty computation and heterogeneous computing (multiple core systems). The only other way would be to store them in plaintext, e.g. in a shadow password (non-public file).

share|improve this answer
I don't know if it is correct to say that this is the best way. Just a way. Other possible ways to do it include using a TPM or simply using secret sharing to spread out the seed to multiple machines. – mikeazo Feb 18 '15 at 12:49

Not the answer you're looking for? Browse other questions tagged or ask your own question.