I am building a two-factor authentication system based on the TOTP/HOTP.
In order to verify the otp both server and the otp device must know the shared secret.
Since HOTP secret is quite similar to the user's password, I assumed that similar best practices should apply. Specifically it is highly recommended to never store unencrypted passwords, only keep a salted hash of the password.
Neither RFCs, nor python implementations of HOTP/TOTP seem to cover this aspect.
Is there a way to use one-way encryption of the OTP shared secret, or is it a stupid idea?
Definition: HOTP(K,C) = Truncate(HMAC(K,C)) & 0x7FFFFFFF - where Kis a secret key and C is a counter. It is designed so that hackers cannot obtain K and C if they have the HOTP string since HMAC is a one-way hash (not bidirectional encryption).
K & C needs to be protected since losing that will compromise the entire OTP system. Having said that, if K is found in a dictionary and we know C (eg: current time), we can generate the entire dictionary of HOTP/TOTP and figure out K.
Applying one way encryption to HOTP/TOTP (ie: double encryption) would mathematically make it harder to decode, although it doesn't prevent other forms of attack (eg: keystroke logging) or applying the same encryption to the dictionary list of HOTP/TOTP.
It is human nature to reuse the same set of easily-remembered-password for EVERYTHING and hence the need to hide this password on digital devices or when transmitting over the internet. 
Implementation of security procedure or protocol is also crucial, it is like choosing a good password K but leave it lying around the desk for everyone, or the server holding K (for HMAC) is not inside a private network protected by a few layers of firewall.
Is it possible to salt and or hash HOTP/TOTP secret on the server?