Re: public key password authentication

Hallvard B Furuseth <h.b.furuseth@xxxxxxxxxxx> wrote:
No, I mean the server itself - e.g. if the server's security is not
trusted. And I figure that if even the server admin can't find how to
authenticate to the server itself short of with a brute-force attack,
then it's as secure as it can get without things like a hardware black
box.

You definitely need zero knowledge. I don't know about any schemes that
satisfies such requests, but the topic has certainly been investigated.
Note that few people consider schemes attackable by exhaustive search
secure today, and passwords are almost always vulnerable to exhaustive
search.

--
Kristian Gjøsteen
.