I'm currently using a login system outlined below:
- String of 1000 characters is generated on the server each time the website is opened and works for maximum of 5 minutes at which point a new string is generated which will be in memory until next login
- String is then encrypted using my public key which is stored on the server
- PGP encrypted message is then shown on the login page
- After I decrypt PGP message using my private key I copy/paste the decrypted message onto the login page
- and finally server-side script compares the decrypted message to the string generated in step 1 and after login previously generated string is no longer available
Pros of using this system:
- password is only stored in server memory for a very short time
- PGP message can only be decrypted using my private key(RSA - 4096 bits) AND my passphrase
- my implementation might be flawed
This is for educational purposes only, and won't be used on any production system.
What are some of the potential security risks of using such system?