4
$\begingroup$

Definition

${H_1}^{K_1}(X)$ means data $X$ hashed by keyed hashing algorithm $H_1$ with key $K_1$.

Short question

Is $H_1^{K_1}(H_2^{K_2}(X))$ equal to $H_2^{K_2}(H_1^{K_1}(X))$?
Is $H_1^{K_1}(H_1^{K_2}(X))$ equal to $H_1^{K_2}(H_1^{K_1}(X))$?

Long question

My web application is storing a hashed password in a database. A web service requests for authentication that the user types a password, which is hashed with a random key and then sent to the server. The server thus only sees $H_1^{K_1}(X)$ where $X$ is the password, not the password itself.

I have to compare the client-side hash with the original password. How can I do that?

Improve this question
$\endgroup$
3
  • $\begingroup$ You are rolling your own crypto. Please stop. Use a purpose-designed password hashing algorithm like bcrypt. $\endgroup$
    – Stephen Touset
    Feb 2, 2013 at 5:50
  • $\begingroup$ Normal hash functions don't have this property, though there are some constructions which might have them intentionally. (Note that you should use the password in the key position and hash random data with it, not the other way around.) But as said, use an existing password authentication protocol. $\endgroup$
    – Paŭlo Ebermann
    Feb 2, 2013 at 12:42
  • $\begingroup$ I guess I done something wrong. $\endgroup$
    – TIKSN
    Feb 4, 2013 at 5:48

2 Answers 2

Reset to default
4
$\begingroup$

For H1=H2 there are one-way functions with that property: $y = g^x \mod p$.

$ (g^{k_1})^{k_2} = g^{k_1 \cdot k_2} = (g^{k_2})^{k_1}$

This property is exploited by the Diffie-Hellman key exchange. One variation of DH used for password based authentication is SRP.

I strongly recommend to use an existing protocol, and not write your own. Implementing SRP is quite easy to get wrong. I'd just use SSL, either with a normal suite (such as ECDHE_RSA) sending the password in plain over that connection, or using a SRP suite(only supported by a few libs, such as GnuTLS).

Improve this answer
$\endgroup$
0
0
$\begingroup$

No, I don't know of any hash functions that maintain that property. The defacto way to securely store user's passwords is to use adaptive hash algorithms like bcrypt. Take a look at this question for more details.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.