News for hackers. Stuff that matters.

A comment on CBCrypt: Encrypt from the client rather than send passwords to servers. Parent comment

Re:CBCrypt: Encrypt from the client rather than send passwor... by creshal on Tuesday October 06, 2015 @12:06PM (#10339876)
> Challenge response schemes generally require the server to have the password in a recoverable format so that both sides can generate identical hashes.

Do they? Doesn't the server just need to share the salt and algorithm parameters it stores anyway?

[ Parent | on HN ]
Re:CBCrypt: Encrypt from the client rather than send passwor... by jcranmer on Tuesday October 06, 2015 @12:39PM (#10340150)
The server can store the salt and parameters, although it gets really hairy if you decide that MD5 is too weak and now you want to upgrade to SHA-1 or SHA-256.
[ Parent | on HN ]