I'm developing a program which needs users to login. The traffic is not sensitive but has to travel as fast as possible, therefore I am not securing the connection though TLS or something. The only sensitive thing is the password and probably the username (which will be the email address). I thought about either hashing the password on the clientside before transferring it or encrypting it with a RSA public key, the problem is, if an attacker can get this hash or encrypted password, he can easily just login using this hash directly if he modifies the client, so I need some sort of salting. The problem is: The server will store the password salted + hashed, so when the client hashes the password with a different salt each time,it will produce a different hash. With encryption the server can just decrypt the password+salt and strip the salt. Now I'm wondering is there a way without encryption, with only hashing, that I can transport my password securely to the server and prohibit an attacker to just reuse the hashed password?
The Server stores the password salted with
salt1, hashed. The server sends
salt1 and a random (each connection a new)
salt2 to the client. The client salts and hashs the password with
salt1, salts and hashs the hash from step 1 again with
salt2, sends this hash to the server. So to check the password the server has to salt and hash it's stored hash with
salt2 and check for equality. Is this secure?