1
$\begingroup$

Companies such as Barclays use cryptographic seeds (for their PINsentry system), RSA do the same for RSA SecurID, but how do they safely secure the seeds in the database. With passwords you just hash it at and add a salt, but the server must know the original seed to verify the users code, the one-time password generated from the seed.

$\endgroup$
  • 1
    $\begingroup$ "how do they safely secure the seeds", they don't $\endgroup$ – mikeazo Feb 16 '15 at 15:25
  • $\begingroup$ They must keep them secret somehow, otherwise it's completely pointless right. If they get hacked, that's it, there done for, along with everyone who uses it $\endgroup$ – Ramonster Feb 16 '15 at 15:29
  • 1
    $\begingroup$ Did you read the article I linked to? RSA got hacked, they had to issue 40 million new tokens. $\endgroup$ – mikeazo Feb 16 '15 at 15:50
  • $\begingroup$ I've read that article before as part of my research on cryptography. It says they were compromised, but it doesn't say how it was protected, or not protected. I guess that's why they used passwords with RSA. But Barclays don't. But it's incredibly stupid not to protect credentials. But anyway, there must be a way to store them safely, instead of stupidly. Thanks for your comments though @mikeazo $\endgroup$ – Ramonster Feb 16 '15 at 16:13
  • 4
    $\begingroup$ I'm voting to close this question as off-topic because 1) it's about security rather than cryptography and 2) we don't know for sure - ask the companies involved. Answers here cannot be verified unless this is public information. $\endgroup$ – Maarten Bodewes Feb 16 '15 at 16:33
1
$\begingroup$

The best way to encrypt a seed in a db would be to use multiparty computation and heterogeneous computing (multiple core systems). The only other way would be to store them in plaintext, e.g. in a shadow password (non-public file).

$\endgroup$
  • $\begingroup$ I don't know if it is correct to say that this is the best way. Just a way. Other possible ways to do it include using a TPM or simply using secret sharing to spread out the seed to multiple machines. $\endgroup$ – mikeazo Feb 18 '15 at 12:49

Not the answer you're looking for? Browse other questions tagged or ask your own question.