> But am I correct that they still pass the derived master-key to server side in a plain form? No. Master key doesn't leave client machine, only its hash is tr

> But am I correct that they still pass the derived master-key to server side in a plain form? No. Master key doesn't leave client machine, only its hash is transmitted over the network. See dchest's link above.