In a web-based auth system I do the following:
- Client: Ask the server for a "nonce".
- Client: Generate a "cnonce".
- Client: hash(nonce + cnonce + password)
Client: Send cnonce and the hash from point 3 to the server.
Server: hash(nonce + cnonce + password)
- Server: Compare the hashes.
This would require me to save passwords in plaintext/encrypted as the server needs "password" to calculate the hash to compare with.
Of course I don't want to do this and therefore I hash all passwords saved on the server with hash(password, salt). But now I can't compare with the hash the client sends me as I don't have the password component.
One way to solve this would be to provide the client with the unique user salt so that the client could calculate hash(nonce + cnonce + hash(password, salt)) and send it to the server, allowing the server to compare the hashes. But according to How to store salt? the salt should never be shared.
The reason to why I use nonce on a HTTPS connection is described in: Should I hash the password before sending it to the server side?
So my question is how to get out of this infinite loop of "don'ts"?