Question

I have a system that needs logins, but who i’m building it for is requiring the transmission of the passwords during login to be very secure (even using SSL). So i’m using a variant of the Digest access authentication to transmit login requests. The only problem i’m having now is how to store the passwords on the database (in a secure salted hash preferably) so they can be used with the digest request, and the password at no point is in an nonhashed format, except on the clients browser for a few seconds.

So, in a nutshell, how can I store passwords securely but allow for a digest (with a different and ever changing nonce to the database’s salt) to authenticate?

Answer 1

As I understand it, this mechanism sends something like:

hash(nonce + hash(password + salt))

So on the server, you just need to store hash(password + salt) and salt.