0

The password of the user shall be used for client side encryption. A PBKDF and salt shall be used to derive a key from the user password.

Do I need to store this salt on the server and deliver it to each new client/device the user authenticates from? (I'm assuming here that the client can't store the salt, otherwise he could just store a strong encryption key and using a PBKDF would be a bad choice.)

If I do have to store it in some form on the server, is there a way to make it "hard" for the server to guess a weak user password? I guess the answer to this question is "no". It would always be possible for the server to try logging in as the user and brute-forcing it's way through a weak password in this way.

1
  • You might want to look at SRP protocol, which is similar to what you describe in that the user's salt is stored on the server and used for password based key derivation on the client side. See protonmail.com/blog/encrypted_email_authentication for an interesting read on how ProtonMail does this - and derives not only one key used for client side encryption, but also a second key used for authentication with the server, from a single password provided by the user.
    – mti2935
    Dec 30 '21 at 18:39
0

Do I need to store this salt on the server and deliver it to each new client/device the user authenticates from? (I'm assuming here that the client can't store the salt, otherwise he could just store a strong encryption key and using a PBKDF would be a bad choice.)

Yes. Although I would probably store some random data in the server, then let the user transform it with its password to get a different random data, which is then the one used as key by the client.

If I do have to store it in some form on the server, is there a way to make it "hard" for the server to guess a weak user password?

No. The server could always "fake" a login by the user. Moreover, it could simply log the password provided by the user to decrypt their secrets later-

I would suggest that when the client provides the password to your website for login, it is actually some salted version (e.g. with a "website" salt) different than the one it will use for their secrets. Not perfect, but a small improvement.

2
  • @mti2935 mentioned SRP. As I do not want to roll my own crypto, is SRP an algorithm that "stores some random data on the server and lets the user transform it with his password to derive the key"?
    – Gamer2015
    Dec 31 '21 at 7:47
  • @Gamer2015 SRP works in a different way. See en.wikipedia.org/wiki/Secure_Remote_Password_protocol
    – Ángel
    Jan 12 at 1:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.