3 ms·
The hash is not constant. With public key crypto you can implement a challenge response. Server generates random garbage, send to client, client signs the garb
by Too 5y ago
The hash is not constant.
With public key crypto you can implement a challenge response. Server generates random garbage, send to client, client signs the garbage using priv key, sends it back as a hash that the server can verify using pub key.
Another version of this is with shared secrets instead of public/private, by replacing the signature with simply HMAC(secret, garbage) and keep rest of flow same as above.
- staticassertion 5y agoYeah, once you get to the ZKP approach, which is what you're describing, the benefits are more significant.
- u801e 5y ago> With public key crypto you can implement a challenge response. Or just use a client side TLS certificate to authenticate instead of or in addition to the username and password.