I'm looking to build an authorization system with a completely "public" server which involves two assumptions:
- The server's data is public
- The server is incorruptible and uncrackable i.e. nobody can pose as or hijack the server.
I've found SRP which is a pretty nifty concept, but even that one relies on the privacy of the server to be effective. By obtaining the verifier and salt, brute force attacks can be mounted offline without any additional input from the server. My goal is to have a system that requires interaction with the server to check for the correctness of the password, with all server-side data assumed to be visible.
I understand that may be very difficult if not outright impossible. Perhaps leveraging its other features (the server is verifiably legit, client can hold secrets) could be key? Or perhaps there is a way of securely encrypting the verifier.