Skip to content

Latest commit

 

History

History
68 lines (52 loc) · 2.38 KB

README.md

File metadata and controls

68 lines (52 loc) · 2.38 KB
Raw

Client - Server authentication demo in python 2.7

Main aim of this project was to show how to authenticate user without transferring:

  • plain text password
  • hashed password
  • other value which does not change in subsequent authentication processes

Solution: Generate (on server) random nonce value every time user wants to log in. Send nonce to client. Client calculates hash(plain_text_password + nonce) and sends it to server. Hash value changes every time and server is able to authenticate user.

  ______________________                                      ________________________
 |                      |              username              |                        | 
 |                      |----------------------------------->|                        | 
 |                      |         user_salt, nonce           |                        | 
 |                      |<-----------------------------------|                        | 
 |       Client         | hash(nonce + hash(password + salt) |         Server         |
 |                      |----------------------------------->|                        | 
 |                      |        OK | Access Denied          |                        | 
 |                      |<-----------------------------------|                        | 
 |______________________|                                    |________________________|

Sample User in sqlite Database:

login: admin
password: Administrator100

Run Server

python run_server.py

Run Client

python run_client.py

Connection between client and server secured with SSL from OpenSSL library.

Server provide:
  • login
  • register
  • for logged users:
    • fake access
    • delete_account
    • change_password
Register function:
  • client sends username
  • server check if username is free and response
  • client sends to server password as a text twice
  • server checks if passwords match
  • server checks if password has enough strength
  • server generates salt value
  • server hashes (password + salt)
  • server save hashed_value and salt in database
Login function:
  • client sends username
  • server respond with client_salt and generated nonce value
  • client hashes (password + salt)
  • client hashes (nonce + hash(password + salt))
  • client sends hashed_value
  • server hashes (nonce + hash_from_database)
  • if hashes match server grants access