I am trying to think of a scheme that would allow a user to authenticate to a server, whithout sending the password to the server, and to also derive a symetric key on the client (that also never gets sent to the server), the sym key would be used to encrypt and decrypt data on the client,that gets saved encrypted on the server.

The question is: how robust is the following scheme ?

The client is implemented in javascript, runs in a browser that is assumed to produce good random seed data, and the connection is through TLS.

  1. authenticate without sending the password to the server
  2. derive a symetric key from the password, that never gets sent to the server
  3. store data on the server encrypted with

On the client:

symKey = scrypt(password, salt)
authKey = scrypt(symKey, salt)

On the server:

// when the account is created, the server hashes authKey 
// again, and saves it with its salt

authHash = scrypt(authKey, salt2)

database.save([userId, authHash, salt2])

the user then encrypts data using symKey, that gets saved on the database:

userRowInDatabase[id, authHash, salt2, dataEncryptedWith(symKey)]
  • hasing would be done with Scrypt
  • Symetric encryption would be done with TweetNACL Secretbox (Based on XSalsa20 stream cipher and Poly1305 one-time authenticator)
  • $\begingroup$ Did you forget to put a question? On the client-side use two different salts. Also, you can use the password to derive different keys with different salts. $\endgroup$
    – kelalaka
    Jul 28 '19 at 19:02
  • $\begingroup$ What is your question? What kind of help you expect here? $\endgroup$
    – mentallurg
    Jul 28 '19 at 19:03
  • $\begingroup$ @kelalaka, the question is "how good is the scheme". I added it to the text, the title is already pretty long $\endgroup$
    – Max L.
    Jul 28 '19 at 20:16
  • $\begingroup$ The OPAQUE protocol may be a solution for you. $\endgroup$
    – SEJPM
    Jul 29 '19 at 14:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.