0

We all know what HTTP Basic Authentication is all about:

Authorization: Basic base64(login + ":" + password)

HTTP Digest is a major improvement over Basic in that it does not transmit password in clear text, but on the other hand said plain-text password is stored on the server.

My question is, are there any authentication schemes that work with server only having a hash of the password?

2
  • Salt + hash works this way. The server have only the salt+hash stored, client sends plaintext password. Server hashes salt+plaintext, compares with stored hash.
    – ThoriumBR
    Jan 17, 2017 at 13:14
  • 2
    When you say "erver only having a hash of the password", do you mean server only storing the hash of the password or do you mean that the server only receives the hash instead of the password
    – Limit
    Jan 17, 2017 at 14:29

1 Answer 1

1

What I recommend:

Hash the password on the client's side. The client then knows the hashing mechanism for the first stage of the process. Send this hashed value to the server. Now get the server to salt and hash this already hashed password. This way, an eavesdropper will only have access to the hash at any given point, and the server will never see the plaintext.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .