Programming Jabber

Zero-knowledge authentication method

The zero-knowledge authentication method is so-called as the server requires no knowledge of the password in order to check the credentials. It makes use of the same hashing algorithm used in the digest authentication method.

Method

Just as mod_auth_plain is responsible for storing the password (in plaintext) when a user is created or when the password is changed, so mod_auth_0k is responsible for storing its version of the password, actually, the information it needs (originally based on the password) to check the client’s credentials in a zero-knowledge authentication process.

As we know from the user registration and password change processes, any new password is supplied to the server in plaintext. This is where a secure (SSL) connection is critical for complete security. While the mod_auth_plain module just stores that password as is, the mod_auth_0k module stores a sequenced hash of the password instead.

What does this mean? The server stores a value that is the password hashed with an arbitrary string token multiple (N) times, recursively. It doesn’t store the password itself. It also remembers how many times it has been hashed (N).

Whenever a client wants to authenticate, the server sends the client the string token and the value of N. The client, having obtained the password from the user, performs the same iterative hashing sequence that the server performed when it was originally given the password but performs the sequence ...