37 ms·
Server stores H(pw || bFixed) Server sends bFixed, bOnce Client sends H(H(pw || bFixed) || bOnce) The server can be trusted to not save the actual password
by usrusr 7y ago
Server stores H(pw || bFixed)
Server sends bFixed, bOnce
Client sends H(H(pw || bFixed) || bOnce)
The server can be trusted to not save the actual password if setup/change is already sending H(pw || bFixed) instead of the password itself. But then bFixed becomes public knowledge knowledge and a leaked H(pw || bFixed) would be enough to do a malicious login.
- madacol 7y agoThat's Interesting!. I didn't thought it that way What I had in mind is this: Server stores H(H(pw || bFixedPub) || bFixedPriv) , bFixedPub , bFixedPriv Server sends bFixedPub Client sends H(pw || bFixedPub) bFixedPub and bFixedPriv are unique per password.
- deleted 7y ago[deleted]