Yea you're right. But what about this, the client uses the password as a seed to create a public/private key pair, and sends the public key to the server. If it

Yea you're right. But what about this, the client uses the password as a seed to create a public/private key pair, and sends the public key to the server. If it is during password creation, the server stores this public key in relation to the user, otherwise verifies it. Then the server sends a challenge* and the client uses the private key to sign it and return a response. * actually the server would send the challenge ahead of time along with serving the web page