I currently have this TOFU protocol:
- Client generates salt and inputs a password
- Client saves salt
- Client hashes password with argon2 and salt
- Client generates Ed25519 keys
- Client sends to the server: Ed25519 public key, argon2 hashed password
- Server saves received Ed25519 public key and argon2 hashed password
After first connection:
- Server sends to client a newly generated nonce
- Client receives nonce inputs a password
- Client hashes the password with argon2 (salt is retrieved from file), then the nonce is appended to it, then the result of the append is hashed with SHA-2, then the final hash is signed with a Ed25519 private key
- Client sends signature to server
- Server verifies with the Ed25519 public key (Ed25519 public key is retrieved from file) and argon2 hashed password (argon2 hashed password is retrieved from file) which also goes through the SHA-2 with the nonce which was earlier generated and sent
So my question is, is this protocol secure to verify the user has both the Ed25519 private key and the correct password? If yes is there a way to keep the same level of security while making it simpler, also is the SHA-2 necessary in after connection step 2? If not what are the flaws and how do you recommend to fix them?
Also, does a protocol like this already exist?