So, I read somewhere that Zero Knowledge Proof based authentication is good because it makes sure that the server does not store your password and neither is your password being transmitted over the 'insecure' network.

However, all the implementations that I have come across involve the server storing some function of the password (a hash/ a graph using some permutation based on the password/ a EC point generated using the password). How does that help? AFAIK traditional systems too store the hash of the password and any rainbow table/ dictionary attack on traditional systems should also be similarly applicable for ZKP authentication servers. Where is the additional security in this case?

  • 1
    "the additional security in this case" is that learning the password requires such an attack. ​ ​ – user49075 Mar 12 '16 at 17:21

The additional security gained, is that a attacker cannot pass a previously obtained hash, to authenticate, and in same way, a complete transaction at the site cannot be replayed.

Transmitting the hash of password over the wire is as bad as passing the password itself, as the hash then becomes the password itself, which would allow a attacker to authenticate anyways.

In other words, ZKP adds challenge-response security to a password based protocol. However, ZKP is still vulnerable to client-side attacks such as keyloggers, malware and such, why the optimal is to instead use some sort of 2FA authentication, for example a challenge-response token.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.