I was reading this question about ssh authentication and there's a good discussion about authentication schemes. First, there's the answer that yes, ssh sends the full password to the server (but inside the encrypted tunnel). Second, there's talk about alternatives.
They talk a lot about the idea of sending the hash of the password instead of the password itself, but I haven't found anyone mention the following scheme:
- The server sends a nonce to the client.
- The client encrypts the nonce with a key derived from the password.
- The client sends the result back to the server.
- The server encrypts the nonce with the same key and compares its result to what the client sent.
This fulfills the objective of having a password-based authentication scheme where the password is never sent to the server during authentication, not even as a hash. (It does have to be sent once, when setting up the account.)
My questions are:
a) does this work?
b) does anyone do this?
c) is this any better than sending a hash?
I include the last question because I realized that having seen the nonce and its encrypted result, you could brute-force the password just like you could brute-force the hash. Is this the Achilles heel of this scheme?