I am trying to understand the use case for zero knowledge password proofs.
Clearly, it is not ideal for a remote server to store a password hash. Then
- I need to upload the password to the server for verification. The server knows my password.
- I need to rely on SSL so that people can't eavesdrop the password.
- If anyone hacks the server, they can do a dictionary attack against my password.
But what does ZKPP buy us vs uploading a public key to the server. Then, when I want to log into the server, the server generates a nonce, and I sign it with my private key?
That involves storing my private key on my machine. Someone could steal this. So it is common to encrypt the private key with a password. The password might be weak, so someone could perform a dictionary attack to try to decrypt the private key.
Is this the kind of attack that ZKPP is suppose to stop?