3 ms·
I need a clarification "In ProtonMail’s one-password mode, the mailbox password is derived from the login password via a one-way cryptographic password hash. T
by esseti 10y ago
I need a clarification
"In ProtonMail’s one-password mode, the mailbox password is derived from the login password via a one-way cryptographic password hash. The input to this hash includes a salt provided by the server on login but not stored in the client. In this way, compromise of the mailbox password does not automatically lead to compromise of the login password."
This means, if my password is "123hello" then the mailbox password is hash(derived("123hello"),secret_salt) where, hash is an hash algorithm (which one?), the secret_salt is a value stored in the server and never sent to the client, and the derived("123hello") is a password computed using the SRP protocol, which should be the session key explained here https://en.wikipedia.org/wiki/Secure_Remote_Password_protocol https://en.wikipedia.org/wiki/Secure_Remote_Password_protoco..., correct?
the part of the SRP and on how to genreate the password in SRP is a bit obscure to me, just trying to understand.