Is this authentication protocol secure against both eavesdropping and server database disclosure?

Question

Consider the following protocol from the book "Network Security: Private Communication in a Public World" by Kaufman et al.

Alice knows a password. Bob, a server that will authenticate Alice, stores a hash of Alice’s password. Alice types her password (say fiddlesticks) to her workstation. The following exchange takes place:

This protocol appears to be secure against both eavesdropping (exchanging hash values of random number and password-hash) and server database disclosure (stores only hash value of password). But, my professor says that password based authentication can only be resilient to either one of these but not both. Therefore, can someone point out why this protocol is not secure against both?

Answer 1

Therefore, can someone point out why this protocol is not secure against both?

With this protocol, the 'password' is effectively the value 'hash("fiddlesticks")'. Hence, if you break into the server database (and learn hash("fiddlesticks")), it is straight-forward to create a modified workstation program that uses the value 'hash("fiddlesticks") to authenticate.

That said, I'm not certain that your professor is right when he said "password based authentication can only be resilient to either one of these but not both."; Opaque, for example, is secure against server database disclosure (database disclosure will allow the attacker to test guesses of the password, but that doesn't appear to be what your professor means), and is secure against eavesdropping (assuming that the DLog problem is hard).