I've created a custom credential provider (for Windows) that allows logon just by inserting a YubiKey.
The user's Windows password is protected as follows:
securedPassword = AES(PBKDF2(YubiKeyOTP(rnd), salt), password)
saltcryptographic random values,
- and are stored along with
securedPasswordin clear-text on the computer (in way that they can be read by all authenticated users).
Now I'd like to introduce multi-factor authentication in the form of an additional PIN code.
I thought that I'd use the same
salt to derive another key from the PIN code to encrypt the
securedPassword again and store the result instead:
securedPassword2 = AES(PBKDF2(pin, salt), securedPassword)
Is this a safe approach?
If I understand correctly, double-encryption is secure when using different keys.
Can you think of a better one?
(For example, one alternative I thought of was using
PBKDF2(PBKDF2(YubiKeyOTP(rnd), salt), PBKDF2(pin, salt))