On 01/03/2015 7:45 pm, "Ben Laurie" <<a href="mailto:ben@links.org">ben@links.org</a>> wrote: > > On 1 March 2015 at 07:24, Michael Hamburg <<a href="mailto:mike@shiftleft.org">mike@shiftleft.org</a>> wrote: > > Perhaps you should use oblivious function evaluation with a user-specific > > secret at the server. So for example, server has a per-user secret key e, > > and user has a (salted, scrypted) password p. Let h = hash(p) on some > > curve. > > > > client chooses a uniformly random scalar r. > > client -> server: Q = h^r > > server -> client: P = Q^e = h^er > > client computers P^1/r = h^e, and uses the hash of that point as part of the > > secret key derivation. > > I feel sure I'm missing something, but doesn't the server also need h^e? The server receives Q from the client and multiplies the point Q by e. The client then removes the random blanking factor r to get h^e. The server doesn't know r so it can't remove the blanking. I thought there was an attack on this discussed on this list though?