I have built a simple authentication system for my web application that makes use of the open-source time-based OTP algorithm (RFC 6238). The key for each user is generated when the user is registered in the system. When the user first signs into their account, they are asked to set up their authenticator apps with the provided QR code.
Now, I've done a bit of research, and couldn't find much on the topic, so I'd like to know from you when the secret keys generated by the application need to be reset.
Is it a good idea to have the key reset if the user changes their passphrase? If so, what is the best way to present their new QR code to them? I would assume that there are two choices: the first is to present it to them the next time they sign in, and the second is to send the actual QR to them in the email that lets them know their passphrase changed. For me, the latter is more secure, but I guess it wouldn't make much of a difference if email is used to reset the passphrase anyway.
Your thoughts and insights on this topic would be most appreciated.