title: Is it possible to salt and or hash HOTP/TOTP secret on the server?
body: <p>I am building a two-factor authentication system based on the TOTP/HOTP.
  In order to verify the otp both server and the otp device must know the shared secret.</p>
  
  <p>Since HOTP secret is quite similar to the user's password, I assumed that similar best practices should apply. Specifically it is highly recommended to never store unencrypted passwords, only keep a salted hash of the password.</p>
  
  <p>Neither RFCs, nor python implementations of HOTP/TOTP seem to cover this aspect.</p>
  
  <p>Is there a way to use one-way encryption of the OTP shared secret, or is it a stupid idea?</p>