5 ms·
Yes, there's a challenge/response scheme (like in SRP), so the communication part is slightly improved, but what I'm talking about is that the server stores pub
by dchest 11y ago
Yes, there's a challenge/response scheme (like in SRP), so the communication part is slightly improved, but what I'm talking about is that the server stores public key, and this public key is deterministically derived from password, thus stealing the database of public keys from the server is equal to stealing the database of password hashes (like in SRP).
- hinkley 11y agoI haven't read their code or critiques of it, so I can't say if that's the case for this algorithm. But for this class of algorithms, that doesn't have to be the case. Starting with a cryptographic hash could keep the key from being reversed to the input. There are probably other things that could help as well, like maybe not using the password in the public key at all.
- zaroth 11y agoIt's not a question of reversing the hash, it's a question of what is the 'password validator' and what are the inputs to the algorithm which get you from 'candidate password' to 'compare result to the password validator and return true or false'.
- tptacek 11y agoHow exactly does "starting with a cryptographic hash" solve this problem? Remember, the attack is: start with "aardvark", run the deterministic key-generation process, hash, scrypt, elliptic curve and all, and check to see if you get the same result. If you don't, move on to "apple", then "ataxia" and so on. The attacker has every piece of information in the system except the password string, which they can substitute with a dictionary.
- sarciszewski 11y agoI haven't had a chance to look at the code yet, but riddle me this: Are they eschewing salts entirely?
- tptacek 11y agoYes. The same [password,name,host] tuple should produce the same keypair.