Username-Based Authentication Protocol Using Salted Hashes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication methods over insecure channels require passwords to be transmitted in clear text, making them vulnerable to eavesdropping, and often necessitate the same encryption for all passwords, which is inefficient.
Innovation Solution
A username-based authentication protocol that uses a hashed value computed from an encrypted password and a displayed code from a hardware token, where the username is used as a salt value, allowing users to calculate their own hashed password values, and employing Message Authentication Codes (MAC) to secure the process, thereby eliminating the need for clear text password transmission.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If password is transmitted over insecure channel, then authentication can be performed remotely, but password becomes vulnerable to eavesdropping
Solution Approach 1:
The patent introduces a salt value as an intermediary element that transforms the password before transmission. The salt is combined with the password to create a salted password hash, which serves as the actual transmitted data. This intermediary mechanism allows remote authentication while preventing eavesdropping, as the salted hash cannot be reversed to obtain the original password.
Solution Approach 2:
The patent applies preliminary action by pre-computing and storing salted password hashes in the database before authentication occurs. During authentication, the system retrieves the pre-stored salted hash and compares it with the newly computed hash from the entered password. This preliminary preparation enables secure authentication without requiring transmission of the actual password.
2Reliability
If different encryption is applied to each password, then security is improved, but system complexity increases
Solution Approach 1:
The patent applies local quality by making each password entry unique through the use of individual salt values. Each user's password is salted with a unique salt value stored in the database, ensuring that even if two users have the same password, their stored hashes will be different. This localized differentiation maintains security without requiring complex encryption schemes for each password.
Solution Approach 2:
The patent changes the parameter of password storage from raw passwords to salted password hashes. By transforming the password through a deterministic function (hashing) combined with a unique salt parameter, the system achieves security without complex encryption. The salt value acts as a parameter that modifies the password's representation while maintaining reversibility through the same hashing function.
3Ease of manufacture
If clear text password is stored, then authentication is simple, but brute force attacks become easier
Solution Approach 1:
The patent substitutes the mechanical storage of clear text passwords with a cryptographic hashing mechanism. Instead of storing passwords as plain text, the system stores hashed versions of salted passwords. This substitution maintains authentication simplicity through direct comparison of hashes while providing strong protection against brute force attacks through the computational complexity of hashing.
Solution Approach 2:
The patent applies preliminary action by pre-hashing and pre-salting passwords during the registration phase, storing only the hash values in the database. During authentication, the system retrieves the pre-stored hash and compares it with a newly computed hash from the entered password. This preliminary transformation eliminates the need to store clear text passwords while maintaining simple authentication logic.
Data Source
AI summary
A hashed value is computed from an encrypted password value and a displayed code value from a hardware token at a client. The encrypted password value is based on a username, a context identifier, and a password. The client provides the username and the hashed value to a server. The encrypted password value associated with the username is retrieved at the server. An expected hashed value is computed at the server. The client is validated based on a comparison of the hashed value and the expected hashed value.