3 ms·

> but it absolutely requires public key crypto to be done correctly It actually doesn't, have a look at how the Firefox Account Login protocol works, essentia

> but it absolutely requires public key crypto to be done correctly It actually doesn't, have a look at how the Firefox Account Login protocol works, essentially using only hashing and KDFs: https://blog.mozilla.org/warner/2014/05/23/the-new-sync-protocol/ https://blog.mozilla.org/warner/2014/05/23/the-new-sync-prot... It doesn't really achieve challenge-response without it, but it does mean at least that the server never sees the plaintext password.

crdrost 7y ago
Yeah I mean that comment is about achieving challenge/response without storing something password-like; obviously a non-challenge/response login is not going to be a counterexample. While CR does not need the full force of public key crypto it has properties which require a distinctive subset of those features in this context—I want to be able to take a password and derive two values (K, V) such that g(V, f(K, s)) = h(V, s) for some large family of s'es, but f(K, s) cannot be computed as j(V, s) efficiently. Public key crypto is more or less the case where h(V, s) = s, giving an option to maybe do something interesting when h is nontrivial.
- crdrost 7y ago
  [Just to give an example that I should have given yesterday for anyone who finds this in the future, in particular if you omit some of the safeguards of SRP then the “core” of it has h(V, s) = V^s (mod N) for some N and in some sense it is not doing full public key crypto but rather the seemingly-weaker subset that is Diffie-Hellman key exchange. But of course then ElGamal came and proved that at the core of Diffie-Hellman you can find a public key crypto algorithm so they are clearly very strongly related to each other even if this doesn't need to use the full force of it.]