Password checking algorithm

Question

Usually to check password validity we used to create over given password it hash value and compare it with stored one. So password protection relies on strength of hashing function.

Could it be used another approach?

1. Let's say we have encryption algorithm (doesn't matter which one).
2. Let assume we have some array of predefined chars (for instance just digits)
3. Then generate random sequence of chars consisting predefined array (for instance just random sequence of digits)
4. Encrypt sequence with our algorithm with given password and store it somewhere in safe place (let's call it as saved value)
5. EDIT Also presumed that channel between client and server provides confidentiality and integrity

Now time to check password validity

1. Trying to decrypt saved value with probe password
2. If decryption successfull (meaning mathematically correct) check decrypted value to presence of predefined chars array. For instance if value consists only digits - we assume that password is correct. If decrypted value contains extra chars (except digits) - we would assume that password is incorrect.

Now question: what do you think about crypto-strength of this method?

Answer 1

The first problem you face is that a password cannot be used as an encryption key. For instance, let the password be $%^gHk23. How do you interpret this as an AES-256 key?

The second problem is that the client has to send the password in clear, and then the server tries to make a key from it, and decrypt saved values.

Thirdly, the scheme is fixed. No salting whatsoever is incorporated in it, and thus it is vulnerable to a variety of attack, most notably the dictionary attack.

The hashing scheme you described at the beginning of your post is very old. Today, an extremely secure password-based identification scheme, named SRP, is gaining momentum. (See also the demo.)

Answer 2

As much as you're being downvoted and attacked, your idea is absolutely right, correct, and valid.

You've nearly reinvented bcrypt.

Let's say we have encryption algorithm (doesn't matter which one):

I'll choose blowfish.

Then generate random sequence of chars consisting predefined array (for instance just random sequence of digits)

I'll pick a sequence of 24 characters. And even better if it's an even multiple of the blowfish 8-byte blocksize:

   OrpheanBeholderScryDoubt
   \______/\______/\______/
      |       |       |
8-bytes     8-bytes   8-bytes

Encrypt sequence with our algorithm with given password and store it somewhere in safe place (let's call it as saved value)

The password needs to be transformed into a 72-byte encryption key - the key size of blowfish. Bcrypt does this with a function called ExpensiveKeySetup:

String password = "correct horse battery staple";
Int32 costFactor = 12;
Byte[16] salt = CryptGenRandom(16);
Byte[72] key  = ExpensiveKeySetup(password, salt, costFactor);

And then we'll encrypt our random sequence of chars. And just to be extra secure: we'll encrypt it 64 times:

Byte[24] ciphertext = BytesOf("OrpheanBeholderScryDoubt");
for int i = 1 to 64 do
   ciphertext = BlowfishEncrypt(cipherText, ref key);

(Why use 3-DES when you can use 64-DES!)

And now you have your stuff to store:

• costFactor
• salt
• ciphertext

Bcrypt coverts the salt and ciphertext to base64, and gives you a string:

$2b$[costFactor]$[salt][ciphertext]

Such as:

$2a$12$vI8aWBnW3fID.ZQ4/zo1G.q1lRps.9cGLcZEiGDMVr5yUP1KUOYTa

Now time to check password validity

Try to decrypt saved value with probe password

Rather than decrypt, just repeat the encryption of "OrpheanBeholderScryDoubt", with the password, and the same salt. And compare the result to what you stored.

It would be nice if the community was nice, helpful, or knowledgeable - rather than just attacking or using clichés.