I have an idea for an algorithm. I don't know if I made any mistakes and need some extra thoughts/peer review on it.
This would work as an (almost)zero knowledge proof for sending passwords that can be easily implemented.
A user sends his password to the server (one time risk).
The server computes a "secure" hash of said password. This hash has to be very long, lets say 4k characters.
When a user wants to log in, he first computes said hash on his local machine. The server then tells the client to join random letters to a new one time password. The server only sends out letter positions and sends them out at random, so that there are enough permutations to never run out of combinations. There has to be a history of already used letters, so that at least one never exposed letter gets used. Else a MITM could simulate a client.
After joining all letters to a new password, said password gets "securely" hashed and send to the server for verification. the server performs the same tasks the client is doing and checks his version against the clients data.
Even if send one-time passwords are "securely" hashed, the attacker has time. So after about half of the hashed original password is revealed, a counter is increased, and said password is hashed one time on the server side and old hashed password discarded. This counter gets send to the client every time he want's to login, so he increases hashing rounds by the counter to match server data.
This is an idea that came into my head some seconds ago. It seems to be a good approach. But I would like to see your thoughts on this one, where is the flaw? Or is something similar used already?