3 ms·
> Challenge response schemes generally require the server to have the password in a recoverable format so that both sides can generate identical hashes. Do the
by creshal 11y ago
> Challenge response schemes generally require the server to have the password in a recoverable format so that both sides can generate identical hashes.
Do they? Doesn't the server just need to share the salt and algorithm parameters it stores anyway?
- jcranmer 11y agoThe server can store the salt and parameters, although it gets really hairy if you decide that MD5 is too weak and now you want to upgrade to SHA-1 or SHA-256.