3

Here : Help understanding basic user authentication with salts and hashing

They explain it pretty well, but i'm still struggling to understand this one part...

Now, when a user comes to log in again they submit their username and password in the form. You then want to see if they are in the table so you then:

1) Look up the supplied username in your database and return the hash and the salt

2) Take the provided username and rerun the hashing function using the salt obtained in 1 to do somehting like hash(salt+password submit on form)

3) If the hash generated in 2, matches the on retrieved from the database in 1 then you know they provided the correct password

Does the client side of the application make the stored hash(pw+salt), send it over ssl/tls to the server and then check if it matches the one stroed on server ? if so , how do we get the salt ? Is it okay to send it from server to client in plain text over ssl/tls ?

Or do we send the password from client-side to server in plain text over ssl/tls and then generate the hash(pw+salt) on server-side whereafter we'd check if it matches ?

1

The client send the password to the server.

On registration the server creates the salt and stores it. It then computes and stores the password hash.

On login the client send the password again, the server looks up the salt in its own database, and computes the password hash for verification.

  • In addition to @Natanael answer, you may want to read this guide "The RIGHT Way: How to Hash Properly" in crackstation.net/hashing-security.htm. – Dr. mattle Oct 11 '15 at 22:24
  • Yes, I have. But they don't make it clear where the hash generation from the client's given password should happend. On client side or server ? – Koen Demonie Oct 11 '15 at 22:27
  • While both is possible, server side is the most common – Natanael Oct 11 '15 at 22:42
  • Never do hashing on client! – Neil Smithline Oct 12 '15 at 0:18
  • @NeilSmithline *exclusively. Layering it is fine – Natanael Oct 12 '15 at 0:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.