Usually to check password validity we used to create over given password it hash value and compare it with stored one. So password protection relies on strength of hashing function.
Could it be used another approach?
- Let's say we have encryption algorithm (doesn't matter which one).
- Let assume we have some array of predefined chars (for instance just digits)
- Then generate random sequence of chars consisting predefined array (for instance just random sequence of digits)
- Encrypt sequence with our algorithm with given password and store it somewhere in safe place (let's call it as saved value)
- EDIT Also presumed that channel between client and server provides confidentiality and integrity
Now time to check password validity
- Trying to decrypt saved value with probe password
- If decryption successfull (meaning mathematically correct) check decrypted value to presence of predefined chars array. For instance if value consists only digits - we assume that password is correct. If decrypted value contains extra chars (except digits) - we would assume that password is incorrect.
Now question: what do you think about crypto-strength of this method?