Asymmetrical scheme: insecurity concerns of saving a hash of a hash of a password

irth

10/3/23, 10:20 AM

please verify or explain how to do this properly.

I'm letting a user create keys from the client through a secure server.

I ask the user for a password on the client, then send the hashed password to the server. The server generates fresh keys and encrypts them with the password hash + the generated verification key. The encrypted keys are saved on the server. I return the verification key to the client (Probably should encrypt this with the password hash as well, right?)

When the user needs to access their address to make a transaction or sign something, they must send the verification key and their password hash.

These keys and addresses are intended to be short-lived or one-time-use. However, I'm concerned that a user may forget their password and want to let them verify correctness before choosing a key to use. So, my plan is to save a hash of their password hash on the client database to confirm their password is correct before presenting them with an address to fund.

Is this sound and secure? What extra steps could I take to harden the process? If I'm wrongly reinventing a wheel, kindly suggest a protocol to follow.

Thanks for any attention and guidance!

0 + 0

hash

public-key

symmetric

password-hashing

kelalaka

10/3/23, 11:00 AM

While this is mostly on-topic here, this kind of question is mostly asked in [security] where there are tons of Q/A for this kind. Why do the users need to trust the server?

irth

10/3/23, 12:48 PM

Thanks for the tip, @kelalaka. I'll post on security if there's not too many views here. Yes at the moment users must trust the server but not for production, as it's not going to know the decryption keys and will migrate to duplicated content held p2p via a secret sharing scheme and multiparty computation fhe

kelalaka

10/3/23, 12:50 PM

Can you delete this after posting [security.se]?

irth

10/3/23, 1:07 PM

Let's leave it up for a bit in the chance a user here has a good answer or experience to share

kelalaka

10/3/23, 1:10 PM

We don't prefer the cross-posting https://meta.stackexchange.com/questions/64068/is-cross-posting-a-question-on-multiple-stack-exchange-sites-permitted-if-the-qu

kelalaka

10/3/23, 1:35 PM

I’m voting to close this question because now cross-posted.

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Asymmetrical scheme: insecurity concerns of saving a hash of a hash of a password

TH: รูปแบบอสมมาตร: ความไม่ปลอดภัยของการบันทึกแฮชของรหัสผ่าน

RO: Schemă asimetrică: preocupări de nesiguranță legate de salvarea unui hash sau hash a unei parole

RU: Асимметричная схема: проблемы с безопасностью при сохранении хэша хэша пароля

VI: Sơ đồ bất đối xứng: lo ngại về sự không an toàn khi lưu một hàm băm của một hàm băm của mật khẩu

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.