Salted Hash Authentication Protocol Resists Dictionary Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional challenge-response authentication protocols are vulnerable to dictionary attacks and brute-force attacks, even when using password hashes, and may require trade-offs between security and usability by limiting access to services.
Innovation Solution
Implementing a salted hash system where the server stores salted hashes generated from user passwords, with the client decrypting a challenge using the provided salt to authenticate, thereby increasing the difficulty of attacks and enhancing security without compromising usability.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Object-affected harmful factors
If the server stores a hash of the user's password instead of the password itself, then security against eavesdroppers is improved, but the system remains vulnerable to dictionary attacks and brute-force attacks
Solution Approach 1:
The authentication process is segmented into multiple independent challenge-response exchanges. Instead of a single authentication step, the protocol performs multiple rounds where the server sends challenges and the client responds with cryptographic proofs. This segmentation increases the computational effort required for attacks while maintaining security.
Solution Approach 2:
The server performs preliminary actions by pre-computing and storing only the necessary cryptographic material (hashes of passwords combined with random salts) rather than storing passwords directly. This preliminary preparation enables efficient verification while resisting various attack vectors including dictionary and brute-force attacks.
2Object-affected harmful factors
If the server is hardened by limiting access to services and files, then security is improved, but usability deteriorates due to restricted access
Solution Approach 1:
The patent introduces an intermediary authentication mechanism that operates at the protocol level rather than requiring physical or administrative hardening of the server. The challenge-response protocol with salted hashes acts as an intermediary layer that provides security without interfering with service accessibility or requiring restrictive server configurations.
3Object-affected harmful factors
If physical security measures are implemented to protect the server, then security is improved, but the complexity and cost of the system increases
Solution Approach 1:
The patent replaces mechanical/physical security measures with a cryptographic software-based authentication system. Instead of relying on physical server hardening, locked rooms, or hardware security modules, the solution uses mathematical cryptography (challenge-response protocols with salted hashes) to provide equivalent or superior security with lower complexity and cost.
Data Source
AI summary
A salt transmitted by a second node is received at a first node. The received salt is used to decrypt encrypted data. Optionally, authorization to access a service provided by the second node is received by the first node. In some cases the service includes access to one or more files.