I am trying to create a web form, where the user can login without creating/entering a password.
Assume the following pre-requisites are met:
- The user and server have pre-generated a public/private key pair (on curve ed25519).
- The user and server both know each others public keys.
A simple protocol might look like this:
- The server generates some random text.
- User signs this text and posts the signed data to the server. (Assume this is done via a normal HTTP POST request on a SSL connection).
- The server verifies the signature, and grants access if the signature is verified.
Is this protocol secure? If not, what is a good secure protocol which guarantees similar security as using a password?