I've created a custom credential provider (for Windows) that allows logon just by inserting a YubiKey.

The user's Windows password is protected as follows:
securedPassword = AES(PBKDF2(YubiKeyOTP(rnd), salt), password)

  • both rnd and salt cryptographic random values,
  • and are stored along with securedPassword in clear-text on the computer (in way that they can be read by all authenticated users).

Now I'd like to introduce multi-factor authentication in the form of an additional PIN code.

I thought that I'd use the same salt to derive another key from the PIN code to encrypt the securedPassword again and store the result instead:

securedPassword2 = AES(PBKDF2(pin, salt), securedPassword)

Is this a safe approach?
If I understand correctly, double-encryption is secure when using different keys.

Can you think of a better one?
(For example, one alternative I thought of was using PBKDF2(PBKDF2(YubiKeyOTP(rnd), salt), PBKDF2(pin, salt))


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.