It's not the same. The main point of asymmetric ciphers is that it's a very good way to prove I know something without ever revealing the thing I know.

Instead of sending the public key every time, the server sends a challenge, which only the private key holder can answer. This is a pretty basic usage of keypairs and an extremely brief perusal of their source code suggests to me they've thought of it.

So no, the public key is not the password, unlike hash based systems which do suffer from the problem you're concerned about. The hash IS in fact now your password in those systems.

Yes, there's a challenge/response scheme (like in SRP), so the communication part is slightly improved, but what I'm talking about is that the server stores public key, and this public key is deterministically derived from password, thus stealing the database of public keys from the server is equal to stealing the database of password hashes (like in SRP).

I haven't read their code or critiques of it, so I can't say if that's the case for this algorithm.

But for this class of algorithms, that doesn't have to be the case. Starting with a cryptographic hash could keep the key from being reversed to the input. There are probably other things that could help as well, like maybe not using the password in the public key at all.

How exactly does "starting with a cryptographic hash" solve this problem?

Remember, the attack is: start with "aardvark", run the deterministic key-generation process, hash, scrypt, elliptic curve and all, and check to see if you get the same result. If you don't, move on to "apple", then "ataxia" and so on.

The attacker has every piece of information in the system except the password string, which they can substitute with a dictionary.

I haven't had a chance to look at the code yet, but riddle me this: Are they eschewing salts entirely?

Yes. The same [password,name,host] tuple should produce the same keypair.

It's not a question of reversing the hash, it's a question of what is the 'password validator' and what are the inputs to the algorithm which get you from 'candidate password' to 'compare result to the password validator and return true or false'.

Can you explain in more detail why you believe the public key "isn't the password" the way it is in a "hash based system"? I don't think this is true, but I'm not totally clear on what you're arguing.

Hey I got pulled away from this conversation and didn't continue.

In most systems where the server never sees your password, they store a hash that is generated from the password.

Then the login code on the client takes the password, performs the same operation and then sends either that same hash to the server, or one that's simple to calculate from it.

So if I steal your password file, I can log in as everybody without even knowing what their passwords are. I just change the code in the client to skip the hash generation part of the authentication algorithm and use the one I supply.

The idea with asymmetric ciphers (at least the ones that interest us) is that one party HAS to know the secret, and the other has no way to get it.

I'm even more confused now.

I think you're saying that this system is better because, since it uses public key pairs, an attacker who steals the password file doesn't know enough to log in as a different user.

Leaving aside that an attacker who steals your password file has probably mooted login security altogether, the attacker in this system seems to have exactly the same leverage as an attacker who steals a password file full of scrypt hashes.

It looks like the client generates:

    S <- scrypt(zeroes, 
           SHA2(name, pw, host))

    secureSrand(s)

    keypair <- keygen(ecdh, secureRandom)

The client sends the pubkey to the server, the sever sends nonce challenges to the client.

I don't understand the second line of your pseudocode -- I read the description as not having any ("external") random bytes, just the PRNG initialized from the seed derived from scrypt:

"CBcrypt combines publicly known authentication factors (typically username and server id) with secret factors (password), applies a rate-limiting work function such as scrypt or pbkdf2, to deterministically generate a random seed. This seed is then used in a pseudo-random number generator (prng), and the prng is used as the basis for generating a public/private keypair."

EDIT: ah, got it (libc! :), secureSrand means "initialize PRNG with seed", so we're talking about the same thing.

Yes, "srand" was my shorthand for that, but since I just invented that shorthand, I'm not surprised it was confusing.

Also: is it safe to use a secret-seeded DRBG as a CSPRNG for ECDH keygen? The time it will take to generate the ECDH key will be secret-dependent, right?

(I'm sure it doesn't matter in this case. Just curious about the general case.)

I think it's safe, but we need real cryptographers to figure this out (does Matthew Green approving miniLock count?). With proper Curve25519 implementations key generation timing shouldn't be secret-depended: it's the same scalar multiplication (crypto_scalarmult_base).

The difference here though, is that the private key is not being sent verbatim to the server.

The benefit here is you don't have to trust the server to actually store an scrypt hash properly.

And it's been pretty obvious that most service providers have no idea what they're doing and can't be trusted to do that.

Yes, you do have to trust the server.

Specifically, to deliver the Javascript in the first place.

No, I mean, you have to trust it to store password hashes, just like in any other scheme. The ECDH public key is generated deterministically from the password. If you have it, you can crack it to recover the password.

His underlying assumption is that given an ECDH public-key it is computationally infeasible to derive the private key / seed that went into creating it (via brute force). I suppose that's a fair assumption if your password has high enough entropy or is stretched sufficiently?

No. The security of the password storage in this system has nothing to do with that of ECDH.

This sounds worse than I imagined when I was reading through it earlier. Sorry if I muddied the waters earlier.

Not quite - a malicious server would receive the plaintext password in the current status quo.

If a server just wants a hash, then that hash becomes the password. MITM attacks still work as long as all server credentials are public. EX: A fake wifi hotspot wants to MITM a connection and can fake any public information (public key's, IP's, DNS, etc.)

Further, a fake website can sidestep this by not using a secured connection and just faking the UI.

If you read the mechanism, you'll see that this involves more than a site faking the UI - it requires browser integration. This mechanism does not protect a single site, but rather the ability to pivot from one site to another with the same password or key. You also breeze over "can fake any public information" - I have no idea what you are trying to say by the ability to fake public keys - that is not really a thing. HTTPS rides on having a trusted intermediary and so even a malicious MITM couldn't simply fake a public key.

You run into the question, is this the 'magic' UI or a PNG send from HAXORU.

Windows reserves CTRL + ALT + DEL for this reason, but doing that on a tablet / phone that's already in production quickly runs into issues. Also, windows had plenty of issues with fake login screens.

PS: I suspect protecting people from such things ends up requiring fairly strong AI or significant compromises.

You could scrypt on the client.

You're still passing the output to the server, which can be repeated. Certainly better than just a password, but not as good as public key crypto.

In the end, I'd probably prefer something like SRP

> You're still passing the output to the server, which can be repeated.

Not if the server generates a unique ID for each attempt, and that ID must be used in hashing. It can be as simple as a timestamp.

Which is then going beyond just using scrypt on the client. What you explain is simply challenge-response authentication.