I'm writing two applications that are intended for execution on two separate devices. It is similar to a remote desktop solution such as TeamViewer.
What follows below is my proposal for an authentication process between two devices A and B, where A is the authority. It may be a little verbose, but I just want to be thorough:
1) User inputs a password to A 2) A generates public and private key from password 3) A saves private key to memory 4) A saves private key to file 5) A appends salt to password in memory 6) A digests password + salt with SHA128. 7) A saves the hash to file. 8) B connects to A through TCP 9) A sends public key to B 10) User inputs (the same) password to B 11) B encrypts password with the public key obtained from A 12) B sends the encrypted password to A 13) A decrypts the password with private key 14) A applies steps 5 and 6 15) A compares the hash of the obtained password with the stored hash.
This process doesn't involve sending the password in plain text over the network so that part is secure, so my questions are:
Should symmetric-key cryptography be used instead? If so, how would this be done without the plain-text password being transmitted?
It seems that storing both the hash of the password and the private key generated from the password is excessive. Is it?
On a side note, this all takes place over a LAN.