1
$\begingroup$

Is it safe to re-use my username and password as information for the 2nd-factor?

For instance:

  • the first factor is the username and password;
  • the second factor is $H(H(username) \oplus H(password \| SK))$ where $SK$ is the private key.

Would this scheme be secure?

$\endgroup$
  • 1
    $\begingroup$ Please avoid editing your question in such a way that (likely) invalidates existing answers (your latest edit looks like a border-line case for this). $\endgroup$ – SEJPM Aug 21 '18 at 11:35
4
$\begingroup$

As originally described, the system of having the two factors be [password, H(username || password)] is no more secure than the password alone.

The intent of Two-Factor Authentication is that you are improving security by requiring two independent factors for authentication. In the proposed model your second factor is fundamentally the same as the first. Assuming the hash function is publicly known as part of the protocol, then once your password is compromised then both factors are compromised.

Adding a key to the hash (i.e. a keyed hash) could potentially improve security depending on how that key was generated/shared. You would need to describe the whole system of course.

Nevertheless, There are a number of rigorously analyzed 2FA methods. Something like a TOTP token or U2F hardware key does add significant independent security to a password. You would be well served to investigate existing constructions and analysis.

$\endgroup$
  • $\begingroup$ what if add a private key inside $\endgroup$ – Wei Wen Aug 20 '18 at 23:19
  • $\begingroup$ Is it as long as the is no random unique value. it cannot be safe $\endgroup$ – Wei Wen Aug 20 '18 at 23:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.