Re: public key password authentication

Hallvard B Furuseth <h.b.furuseth@xxxxxxxxxxx> wrote:
Are there useful and efficient password auth methods where the server
admin, possessing a user's server-side secret and a log of his auth
sessions, will not learn how to authenticate as the user?

Sure, that's what identification protocols are all about. Usually,
things like zero knowledge make an appearance.

In particular, are there methods that do not use a lot of server CPU
time compared to a hash-based challenge/response method like DIGEST-MD5?

I think most zero-knowledge stuff is based on number theoretic
constructions, and tend to require significant computational resources.

You can never prevent the server from doing an exhaustive search for the
user's secret (the server must have a yes-no oracle for this secret in
order to do identification). If you just want to prevent him from easily
impersonating the user towards other servers, you can compute the server's
secret as hash(server name || user's secret). With reasonable hash
functions, this won't give the server the value of hash(2nd server name
|| user's secret). Then you use any one of a number of identification
protocols based on shared secrets.

--
Kristian Gjøsteen
.

Relevant Pages