title: Ask user for partial PIN
body: <p>I'm developing an additional security module for a web application, which asks the user to enter a PIN code randomly generated at user signup. The PIN is stored AES-128 encrypted in a db and sent by sms to the new user.</p>
  
  <p>The user will be ask to provide his PIN when certain situations occur (i.e. "strange" accesses, or unusual operations) - and i'd like the user not to enter the entire PIN code, but just 2 digit (for example: the 1st and the 6th). </p>
  
  <pre><code>2 4 6 2 9 1 8 3    -&gt; entire PIN
  ^---------^----    -&gt; digits i'm asking
  </code></pre>
  
  <p>My question is: is the a more secure way to choose which digits to ask? Should i choose them randomly (but an eventual attacker who owns part of the pin could retry until the digits he owns are requested) or should i ask each user always for the same digits - maybe storing their indexes encrypted with the PIN, or generate them with a function parametrized with the PIN itself?</p>
  
  <p>Thanks.</p>