Despite best efforts it is pretty clear that most users reuse their credentials, especially for what they consider non-critical sites such as forums. While TFA does mitigate the potential damage of this a bit (aside from its other benefits of course), a compromised database of one providing using TFA can still lead to another not-TFA-protected account's credentials to become cracked.

This problem would be voided by users "simply" using public key authentication instead of passwords, but let's be honest, most users won't bother with maintaining a secret key (and password authentication reset usually still means they need to access their emails which out of laziness might be protected by the same private key or still a mere password) and if they have to use Software to store their secret key they might just as well finally use a password manager...

So, what if instead of the server saltedly hashing the password to authenticate the user a client-side function would use the password to derive a PKA pair (salted and/or peppered individually per server and/or user) and the server only stores the public key (plus salt, which does not become part of the public key but part of information the user needs to recreate their private key) for use with e.g. SSH2's authentication (i.e. request a non-replayable message to be signed by the private key)?

Users would hence still need to remember only one password, but since each server's salt/pepper differs the stored public key becomes unique, as does the generated private key.

  • I was also thinking about ECC's key addition property, but that's basically just another kind of "salt" on first thought 🤔 Commented Jul 3, 2020 at 8:41
  • Authentication by PAKE and SRP offer a number of advantages over sending the user's plaintext password over an TLS connection. See security.stackexchange.com/questions/242811/… for more info. Although, I'm not sure if brute-forcing the password from the material stored by the server is any more/less difficult than modern salted hashing methods.
    – mti2935
    Commented Mar 23, 2021 at 12:00

1 Answer 1


That would have been too easy, wouldn't it? While obtaining the private key from the public key itself is still nigh impossible, the method to obtain it from the too-simple password is trivial, thus all this method does is replacing the purely server-side hashing by a hash-like algorithm that puts more of the workload to client-side. The only potential benefit might thus be slowing down online attacks, but existing methods such as limit-rating are probably still better-suited and more notably already well-established...

  • Good old rubberducking at work... Commented Jul 3, 2020 at 8:43
  • 1
    was just wondering how you could post your question and answer in the very same minute. Your comment explains it :)
    – lab9
    Commented Jul 3, 2020 at 9:22
  • Using PK authentication would provide some level of protection in the event of a server compromise where the password is intercepted before being hashed. A client-side hash can protect against compromise of plaintext passwords. Commented Jul 2, 2021 at 14:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .