I am building yet another website which requires user and session authentication. This time I want to be complete security paranoid and actually care if the passwords or sessions are stolen.

I have few requirements for the security of password authentication:

  1. The passwords are not stored in the server as clear text.
  2. Brute Force and Dictionary attack offline becomes impossible and inefficient online.
  3. Secure against Man in the Middle attack.
  4. Secure against replay attack.

I am not certain if the following system in the picture I have specified fills the requirements I have. So I am asking you is this enough to stop those attacks?

enter image description here

I know this is not secure against Man in the Browser attack or keylogging, but as far as I know it is secure against Man in the Middle attack and I think the nonce takes care of replay attack. I think the password must be checked online if it is correct and online brute forcing can be slowed down with request time limits.

Does this pretty much eliminate possible hacking of user passwords over the wire and in the server? Should stronger hashing algorithm be used for storage of the passwords?

Once the authentication has been done the server can read and replace this RSA encrypted session key whenever it wants. I think the client can not decrypt it nor man in the middle, because they do not know the server private key. Of course the session key also requires nonce to stop replay attacks, but I just didn't write it to the picture.

I know SSL/TLS can be pretty damn secure if correctly configured. I get currently A- as rating at ssllabs, because I should drop RC4 and use GCM suites. I know SSL/TLS will or should stop man in the middle attacks, but I want to add RSA on top of it. I could also add two or three-factor authentication, but sending sms is not cheap.

closed as unclear what you're asking by Adi, TildalWave, Xander, AviD Mar 11 '14 at 9:42

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

Browse other questions tagged or ask your own question.