43 reputation
5
bio website
location
age
visits member for 1 year, 6 months
seen Feb 12 '13 at 11:48

Feb
8
awarded  Scholar
Feb
8
accepted Hashing a password with SHA256 on the client then bcrypt on the server
Feb
8
comment Hashing a password with SHA256 on the client then bcrypt on the server
that sounds pretty impressive, and anything that reduces the security burden on the server is definitely a draw so I'll give it a shot. Thanks!
Feb
8
comment Hashing a password with SHA256 on the client then bcrypt on the server
wouldn't that require a consistent hash? I suppose I could use the user's email as a salt.
Feb
8
comment Hashing a password with SHA256 on the client then bcrypt on the server
does SRP solve this problem though? Given the context that this will be a security application, users will be pushed towards choosing a longer passphrase which should resolve this problem. Another possibility is using their email address as a salt to get hash with greater entropy. Is SRP a better solution than these? I'm unfamiliar with it.
Feb
8
comment Hashing a password with SHA256 on the client then bcrypt on the server
I'm also aware of the issues of cryptography in javascript, and intend to implement code-signed source coupled with a browser plugin to verify the signatures at a later date.
Feb
8
comment Hashing a password with SHA256 on the client then bcrypt on the server
Hashing before sending is performed to give the user verifiable assurance that we do not know their password, and also to make it more difficult to gain access if a hacker accesses our servers and is able to monitor inbound traffic - they would need to know the PBKDF2 key which is generated from the original password, not the hash.
Feb
8
answered AES implementation in java that allows key of 320-bit length
Feb
8
awarded  Supporter
Feb
8
awarded  Teacher
Feb
8
comment Tell me about non-MD5/SHA1 key fingerprints
Yes I did see this when looking around for an answer for you - I'm not overly familiar with fingerprinting but is this the document you're looking for? tools.ietf.org/html/draft-ietf-smime-sha2-11#ref-SHS
Feb
8
answered Tell me about non-MD5/SHA1 key fingerprints
Feb
8
awarded  Editor
Feb
8
awarded  Student
Feb
8
comment Hashing a password with SHA256 on the client then bcrypt on the server
I've updated my original post; all communications will be secured through SSL.
Feb
8
revised Hashing a password with SHA256 on the client then bcrypt on the server
added 108 characters in body
Feb
8
asked Hashing a password with SHA256 on the client then bcrypt on the server