tl;dr: I am wondering what the best way is to check a password when the client does not trust the server.
I know of two common ways servers can check if a user's password is correct:
- The server stores hash of password, the client sends the password, and the server hashes the password and compares hash with stored hash. If they match, the password is correct.
- The server stores the password in plaintext, and generates a salt which it combines with the password and hashes, and then sends the salt to the client. The client hashes the password and salt, and sends that hash back. The server compares the two hashes and if they match, the password is correct.
However, both these methods require that the client trusts the server, and the first one requires that the connection be secure (while the second one obviously doesn't).
I have thought of a way, but I don't know if it's good since I don't have a background in cryptography, I don't know what contortions can compromise security.
The method is that when the client creates an account, the client generates an RSA key pair from its password by seeding the random number generator with the hash of the password, and sends the public key to the server. Later, when the server wants to check if a user has the correct password, it can generate some data and send it to the client to sign. The client responds with the signature and the server can verify the signature, and if it's valid then the client had the correct password.
This way, the server never gets to see the client's password.
This might be a stupid way of doing it. However, I'd like to know what the common way of doing this is, and if there isn't a common one, what the security experts here think of the way I outlined. As I said, I know only of cryptography what I have learned for web development, which is laughable, so I might have missed something obvious.
I know that you can just generate an RSA key pair and store a file that contains the key on your computer, like what you can do for SSH logins, however it requires you to store your key somewhere, and if the computer is seized then your password is compromised. The method I am looking for should require just a password besides the username.