I thought of this process specifically to stop "man in the middle" attacks and replay attacks:
- User types their username into the client application.
- Client application sends the username to the server.
- Server responds with a string of text (let's call it
SecretA) that is the encryption of a random string
RandomStringusing the password for the username retrieved as the encryption key!! i.e.
SecretA = encrypt( message: RandomString, key: Password)
- User types in their password and presses "sign in".
- The client application takes the user entered password and
SecretA. It decrypts
SecretAusing the user entered password to discover the
RandomString(only if the user entered the correct password). It encrypts the
RandomStringusing the user password concatenated with a timestamp (that goes down to the microseconds) as the key, producing
SecretB = encrypt(message: RandomString, key: concat(Password, TimestampInMicroseconds))
- The client sends
SecretBto the server along with the timestamp used in the encryption in step .
- The server decrypts
SecretBby concatenating the user's password with the timestamp it also received from the client. If the decryption is
RandomString, then the user gets logged in.
- The server denies access if the timestamp client sends has too big a difference with the time the server receives the message.