I was wondering recently how to create secure mechanism for sending password while log in to the system. Then i had wicked thought why to send password at all.
Let's imagine mechanism where client sends user id who wants to be logged in, server "welcomes with bread and salt" by sending challenge and random salt.
Client calculate hash of concatenated salt and password, and then uses it as shared secret to calculate HMAC of challenge, and sends it back to server.
In this case login details are never shared across the network, and login message cannot be replayed.
But are they any downside of this which i didn't thought about? And why it's bad idea (I'm assuming is bad, as nobody is doing in this way)