Assuming SSL/TLS cannot be used in this context, is this method secure enough to authenticate someone without someone listening to be able to retrieve the password from the information transmitted.
- The client sends a login request.
- The server replies with a unique identifier for the login
- The user enters in the password
- The client hashes the password and encrypts the identifier with the hashed password(
encryption(value: identifier, key: hash(password)))
- The client sends the encrypted identifier + the username
- The server receives the encrypted message gets the decryption password from the database using the username the client provided and checks if its able to retrieve the identifier using the password.
- If the identifier is successfully retrieved by the server authentication is successful.