Cryptographic protection for MFA secrets at rest.
The TOTP secret is reversible — it must be recovered to compute one-time codes — so it is AES-256-GCM encrypted under a key derived from JWT_SECRET. Backup codes are one-way — only ever compared against — so they are bcrypt-hashed (constant-time verification, self-salting).
A DB read (SQL injection, backup leak, insider) therefore yields neither a usable TOTP seed nor usable recovery codes.
Cryptographic protection for MFA secrets at rest. The TOTP secret is *reversible* — it must be recovered to compute one-time codes — so it is AES-256-GCM encrypted under a key derived from JWT_SECRET. Backup codes are *one-way* — only ever compared against — so they are bcrypt-hashed (constant-time verification, self-salting). A DB read (SQL injection, backup leak, insider) therefore yields neither a usable TOTP seed nor usable recovery codes.
(backup-code-matches? code stored-hash)Constant-time check of a presented plaintext code against a stored bcrypt hash. A malformed / legacy (non-bcrypt) stored value never matches and never throws.
Constant-time check of a presented plaintext code against a stored bcrypt hash. A malformed / legacy (non-bcrypt) stored value never matches and never throws.
(decrypt-secret value)Decrypt a value produced by encrypt-secret. Returns nil for a legacy (non-encrypted) or blank value, so legacy MFA rows read as having no usable secret and must be re-enrolled.
Decrypt a value produced by encrypt-secret. Returns nil for a legacy (non-encrypted) or blank value, so legacy MFA rows read as having no usable secret and must be re-enrolled.
(encrypt-secret plaintext)Encrypt a plaintext TOTP secret. Returns "enc:v1:<base64(iv||ciphertext)>". nil in, nil out.
Encrypt a plaintext TOTP secret. Returns "enc:v1:<base64(iv||ciphertext)>". nil in, nil out.
(encrypted-secret? s)True if s is an encrypted TOTP secret produced by encrypt-secret (vs a legacy plaintext value).
True if s is an encrypted TOTP secret produced by encrypt-secret (vs a legacy plaintext value).
(hash-backup-code code)Bcrypt-hash a single plaintext backup code for storage.
Bcrypt-hash a single plaintext backup code for storage.
cljdoc builds & hosts documentation for Clojure/Script libraries
| Ctrl+k | Jump to recent docs |
| ← | Move to previous article |
| → | Move to next article |
| Ctrl+/ | Jump to the search field |