TOTP Secret Not Encrypted at Rest

[roshankumar0036singh]

Problem Statement

The mfa_secret field in the database is currently stored in plaintext. If an attacker gains read access to the database or a backup, they can clone the MFA seeds and bypass 2FA for all users.

Technical Approach

Utilize the existing AES encryption key from the environment config to encrypt the TOTP secret before saving it to PostgreSQL, and decrypt it during MFA verification.

Acceptance Criteria

• mfa_secret is stored as an encrypted binary/base64 string in the database.
• Existing TOTP verification flows seamlessly decrypt the secret in memory.

[Mohammedsami001]

Hi @roshankumar0036singh , I'd like to tackle this critical security issue.
I plan to implement AES-GCM encryption for the TOTP secrets at the repository/service layer, ensuring that the mfa_secret is always encrypted at rest and decrypted on the fly during validation.
Can you please assign it to me? Thank You :)

[Itsssaksham]

can you assign this issue to me ?

[arcgod-design]

Hi @roshankumar0036singh! I'd love to work on this as part of SSoC '26.

My Approach:

• Encrypt TOTP secrets using AES-256-GCM with a server-side encryption key (stored in environment variables / a secrets manager) before persisting them to the database
• Decrypt the secret on-the-fly only during TOTP validation, ensuring the plaintext secret is never stored at rest
• Write a one-time migration script to encrypt existing plaintext mfa_secret values in the database
• Add unit tests to verify that stored secrets are always ciphertext and that decryption produces the correct plaintext for validation

Could you please assign this to me (@arcgod-design)? Thank you!