I am trying to understand the use case for zero knowledge password proofs.

Clearly, it is not ideal for a remote server to store a password hash. Then

  1. I need to upload the password to the server for verification. The server knows my password.
  2. I need to rely on SSL so that people can't eavesdrop the password.
  3. If anyone hacks the server, they can do a dictionary attack against my password.

But what does ZKPP buy us vs uploading a public key to the server. Then, when I want to log into the server, the server generates a nonce, and I sign it with my private key?

That involves storing my private key on my machine. Someone could steal this. So it is common to encrypt the private key with a password. The password might be weak, so someone could perform a dictionary attack to try to decrypt the private key.

Is this the kind of attack that ZKPP is suppose to stop?


1 Answer 1


The difference is that when using ZKPP, the user's input is the password; while using public key on the server to authenticate, the user's input is her private key. There are two problems I can see:

  1. When using the public key, the user have to copy the private key to the device she uses. This could be quite inconvenient.
  2. The private key needs to be protected. If the private key is encrypted by a password, then an offline brute-force/dictionary attack is possible (by testing decryption with the public key). ZKPP should allow only on-line attacks.

In many systems that use public key for user authentication, the user's private key is often stored in a tamper-proof/evident device, e.g. smart card or hardware token. This can solve partially the problems mentioned above.

  • 1
    $\begingroup$ Thank you for this answer. I believe I finally understand. The point is that the user truly only has a password, with no other secret material that the user needs to possess. It sounds like: (1) the remotely stored verifier must be kept secure, (2) if compromised the remote machine can do a dictionary attack, (3) but if certs get broken and someone MITMs the remote server, they can't learn the user's password, (3b) though the MITM CAN temporarily login as the client. Did I finally get it? :-) $\endgroup$ Sep 25, 2018 at 18:55
  • $\begingroup$ Yes, you are right. $\endgroup$ Sep 26, 2018 at 8:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.