* Database stores { username, hash(s), υ } where s = P P F (salt, password, cost, misc)
for each user.
– Each user has a different υ which is generated by a CSPRNG and is at least 128-bits.
– The user’s υ changes whenever his password changes.
– The value s originally comes from the client via TLS when the user sets his password. It is tran- sient on the server.
– hash is a cryptographic hash function such as SHA256.
– The salt is taken to be hash(username ∥ domain- name ∥ υ). It is not stored in the database but instead is recomputed when required. If the salt could be longer than what is allowed for the PPF (such as in bcrypt [20]), then instead use as many bits as possible from the hash.
– cost should be set to about 1 second computation time on the slowest device that is supported.
– The output length of the PPF (which might be part of the misc parameter) should be at least 128-bits.
* Database stores system level secret σ that changes approximately once per year. σ is generated by a CSPRNG and is at least 128-bits.
• For user to authenticate, the following operations hap- pen.
– Client gets username and password from user.
– Client sends a request with username to the server
to get salt, cost, misc.
– Server only accepts usernames within the allowed size limit. If it is not, the server rejects it and does not continue.
– Server looks up username in database. If user ex- ists, then it computes salt as hash(username ∥ do- mainname ∥ υ) for that user’s υ value. If user does not exist, then it computes salt as hash(username ∥ domainname ∥ σ) for the system secret σ value. The salt, cost, and misc are sent to the client.
– The client computes
ς = PPF(salt,p,cost,misc)
where p is the user entered password and sends { ς, username } to server via secure TLS connec- tion.
• Server verifies that ς is the expected length, and if not, it rejects it and does not continue.
• Server computes hash( ς ) regardless of whether or not the user exists in database. Server accepts user if and only if user exists5 and its computation of the hash matches the value in the database.
It accepts if and only if there is a match.