News for hackers. Stuff that matters.

A comment on Essential security for Linux servers (2013). Parent comment

Re:Essential security for Linux servers (2013) by atoav on Wednesday December 08, 2021 @06:04AM (#29483365)
Passwords are (or rather should be) indeed stored using crypt. However at login the provided password needs to be compared to the hashed one, which means the clear text password needs to be rehashed. I am not sure this happens on the client.
[ Parent | on HN ]
Re:Essential security for Linux servers (2013) by wang_li on Wednesday December 08, 2021 @06:30AM (#29483536)
It definitely doesn’t happen on the client. If it did then the server’s password file would effectively be plaintext.
[ Parent | on HN ]
Re:Essential security for Linux servers (2013) by zinekeller on Wednesday December 08, 2021 @06:51AM (#29483668)
> If it did then the server’s password file would effectively be plaintext.

Send seed and hashing parameters to the client, then client does hashing, client sends hash, server compares hashes. It's vulnerable to replay attacks, but it's the same with client sending plaintext password to server (assuming that you're not using SSH or similar).

[ Parent | on HN ]
Re:Essential security for Linux servers (2013) by dsr_ on Wednesday December 08, 2021 @08:41AM (#29484549)
You two are working your ways towards defining a zero-knowledge password proof:

https://en.wikipedia.org/wiki/Zero-knowledge_password_proof

I think SRP is the most widely implemented version. https://en.wikipedia.org/wiki/Secure_Remote_Password_protoco...

[ Parent | on HN ]
Re:Essential security for Linux servers (2013) by throw0101a on Wednesday December 08, 2021 @10:17AM (#29485733)
Note that SRP is an older protocol, and things have moved on from there. See various PAKE algorithms:

* https://en.wikipedia.org/wiki/Password-authenticated_key_agr...

[ Parent | on HN ]