News for hackers. Stuff that matters.

A comment on Essential security for Linux servers (2013). Parent comment

Re:Essential security for Linux servers (2013) by throw0101a on Wednesday December 08, 2021 @10:15AM (#29485699)
Anything that is not PAKE (which SSH is not) generally sends the password to the server:

* https://en.wikipedia.org/wiki/Password-authenticated_key_agr...

* https://blog.cryptographyengineering.com/2018/10/19/lets-tal...

   A Password-Authenticated Key Exchange (PAKE) attempts to address this
   issue by constructing a cryptographic key exchange that does not
   result in the password, or password-derived data, being transmitted
   across an unsecured channel.
* https://datatracker.ietf.org/doc/html/rfc8125

I'm sure there are other zero-knowledge protocols besides PAKE-like ones, but I'm not an expert here.

[ Parent | on HN ]

There are no comments on this comment yet.