How is ZKPP better than signing nonces?

Question

I am trying to understand the use case for zero knowledge password proofs.

Clearly, it is not ideal for a remote server to store a password hash. Then

1. I need to upload the password to the server for verification. The server knows my password.
2. I need to rely on SSL so that people can't eavesdrop the password.
3. If anyone hacks the server, they can do a dictionary attack against my password.

But what does ZKPP buy us vs uploading a public key to the server. Then, when I want to log into the server, the server generates a nonce, and I sign it with my private key?

That involves storing my private key on my machine. Someone could steal this. So it is common to encrypt the private key with a password. The password might be weak, so someone could perform a dictionary attack to try to decrypt the private key.

Is this the kind of attack that ZKPP is suppose to stop?

Answer 1

The difference is that when using ZKPP, the user's input is the password; while using public key on the server to authenticate, the user's input is her private key. There are two problems I can see:

1. When using the public key, the user have to copy the private key to the device she uses. This could be quite inconvenient.
2. The private key needs to be protected. If the private key is encrypted by a password, then an offline brute-force/dictionary attack is possible (by testing decryption with the public key). ZKPP should allow only on-line attacks.

In many systems that use public key for user authentication, the user's private key is often stored in a tamper-proof/evident device, e.g. smart card or hardware token. This can solve partially the problems mentioned above.