Question

Here is what I got for a webapp login scheme.
Present in database would be two salts and hmac(hmac(password, salt1), salt2).

When the user go on the login page, he gets salt1.
If he has javascript activated, instead of sending the plaintext password, it would send hmac(password, salt1).
If he does not have javascript, the plaintext password is sent.

So, on the serverside, when getting a login request, we’d first check what is sent (passwordSent) against hmac(passwordSent, salt2). If it does not work, we’d try hmac(hmac(passwordSent, salt1), salt2).

Someone getting access to the database should not be able to login with the password hashes and I don’t think (but I may be wrong) that multiples hmacs diminish the hash resistance.
Do any good crypto expert see any obvious error I may have done ?

Answer 1

This looks a little like security through obscurity, what is the point of using javascript to hash the password on the client side if you still accept plain text password from the client?

You didn’t mention if this was over https, if you aren’t using https then you may as well have no passwords at all. If you aren’t running https then any MITM can see the salt you are sending as well as the javascript used to hash the original password so you have nothing gained.

As for your concern about the possibility of hmac collisions between two salts, that is probably very unlikely (depending on your hash algorithm) and how secure you keep your salt values. Even with MD5 that has had some collision attacks discovered and has a set of rainbow tables, you will be ok if you keep your salt very very safe.

Please, everybody, please stop trying
to implement custom crypto systems
unless you have a background in
cryptography. You will screw it up.
–Aaronaught

Well said!