In my database, I have a PBKDF2 hash + salt for every user. My objective is for the user to be able to log in without stating the user's password (in case somebody is logging the network traffic somehow).
I was wondering if the following scheme is secure, or if there are any fallacies.
- Client starts the login process by stating the username
- Server returns the salt together with a string of non-pseudo random bytes (a challenge)
- Client uses the salt to derive the hash. The challenge bytes are hashed together with the derived password hash and sent back to the server. (should I use some random salt during this process?)
- Server verifies that the challenge hashed together with the hash in the database matches what the client sent.
- Success! Server has implicitly verified the password without the client stating the password, and the input is never the same (cannot be reused by an attacker).
Is this a good idea? Are there any security issues with giving up the salt? In case the user doesn't exist and I don't want to give up that information, I could invent some fake salt based on some hash of the username.
