3

Here : Help understanding basic user authentication with salts and hashing

They explain it pretty well, but i'm still struggling to understand this one part...

Now, when a user comes to log in again they submit their username and password in the form. You then want to see if they are in the table so you then:

1) Look up the supplied username in your database and return the hash and the salt

2) Take the provided username and rerun the hashing function using the salt obtained in 1 to do somehting like hash(salt+password submit on form)

3) If the hash generated in 2, matches the on retrieved from the database in 1 then you know they provided the correct password

Does the client side of the application make the stored hash(pw+salt), send it over ssl/tls to the server and then check if it matches the one stroed on server ? if so , how do we get the salt ? Is it okay to send it from server to client in plain text over ssl/tls ?

Or do we send the password from client-side to server in plain text over ssl/tls and then generate the hash(pw+salt) on server-side whereafter we'd check if it matches ?

Improve this question

1 Answer 1

Reset to default
1

The client send the password to the server.

On registration the server creates the salt and stores it. It then computes and stores the password hash.

On login the client send the password again, the server looks up the salt in its own database, and computes the password hash for verification.

Improve this answer
5
  • In addition to @Natanael answer, you may want to read this guide "The RIGHT Way: How to Hash Properly" in crackstation.net/hashing-security.htm.
    – Dr. mattle
    Oct 11, 2015 at 22:24
  • Yes, I have. But they don't make it clear where the hash generation from the client's given password should happend. On client side or server ?
    – Koen Demonie
    Oct 11, 2015 at 22:27
  • While both is possible, server side is the most common
    – Natanael
    Oct 11, 2015 at 22:42
  • Never do hashing on client!
    – Neil Smithline
    Oct 12, 2015 at 0:18
  • @NeilSmithline *exclusively. Layering it is fine
    – Natanael
    Oct 12, 2015 at 0:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .