From previous discussions about this topic, I had noted down the following best practices:
Passwords should be scrypt'ed on client, and then, the server should generate a SHA256 hash of the scrypt'ed hash and store that in DB.
- Running CPU & memory heavy scrypt hashing on the client side will allow us to use bigger hashing work-loads.
- EDIT: Removing the MITM point, because as many said, that's the job of TLS anyway.
- External brute force attackers will have to take the burden of heavy hashing. No DOSing through scrypt.
- Storing SHA256 hash instead of scrypt hash on DB means even if DB is stolen, attackers can't use stolen scrypt hashes to authenticate any client.
I would love to get others' feedback on this. EDIT: Found the reference: https://news.ycombinator.com/item?id=9305504
Passwords should be scrypt'ed on client, and then, the server should generate a SHA256 hash of the scrypt'ed hash and store that in DB.
- Running CPU & memory heavy scrypt hashing on the client side will allow us to use bigger hashing work-loads.
- EDIT: Removing the MITM point, because as many said, that's the job of TLS anyway.
- External brute force attackers will have to take the burden of heavy hashing. No DOSing through scrypt.
- Storing SHA256 hash instead of scrypt hash on DB means even if DB is stolen, attackers can't use stolen scrypt hashes to authenticate any client.
I would love to get others' feedback on this. EDIT: Found the reference: https://news.ycombinator.com/item?id=9305504