I am making a chat program for fun, and I decided to add in encryption. However, I am new to this, so what I was wondering is, is this cryptographically secure, and is this a good way to do things?
This is logging in:
Start:
Client sends username
If the user exists, the server sends the stored salt for the user
The client then sends SHA-2 hashed (Salt + Plaintext password)
The server compares it to the stored hashed result of the salt + the password, and if it’s the same then the user has logged in sucessfully, and from there on the encryption is AES.
End
Any faults? I don’t think there is, but I’d hate to go along and make the program only to be told that the encryption doesn’t work! Also, anyone got any good links to further reading on cryptography?
This isn’t secure against attacks on your database/servers, and actually seems to defeat the purpose of using salted hashes. If the client sends back a salted hash in place of their password, then that is essentially the same as their password.
If an attacker compromises your database, they don’t have to brute force anyone’s password to log in, they just use the salted hash and they can be anyone they want to be.
If you are using SSL, you can send the plaintext password over the encrypted wire, and hash at the server. Then an attacker has to brute force the hash or attack the SSL channel.
also, use PBKDF2, bcrypt or scrypt as your password hashing algorithm, instead of SHA-2. You want something that resists brute force attacks.