But then you need to have the original password in cleartext somewhere, so I would say that is not the way you do it. I think the way this is more likely to be

But then you need to have the original password in cleartext somewhere, so I would say that is not the way you do it. I think the way this is more likely to be done is by generating a random token that is broken up into pieces using XOR magic. Each factor in the auth process gives you access to one piece of that token. You combine those pieces back together using more XOR magic and, if your token matches the original token, you can proceed.