Hacker News new | ask | show | jobs
by Ar-Curunir 1827 days ago
What are "ZKPPs"?
1 comments

Possibly Zero Knowledge Password Proof?
That sounds right.

A zero-knowledge password proof is a way for one party to prove to another the knowledge of a password, without revealing anything else about the password.

Such a protocol prevents an attacker (eavesdropper or man in the middle) from brute-forcing the password offline even if they capture the whole exchange, so insecure passwords become much less of a risk as long as the verifier rate-limits login attempts on its end.

Some of these also have the property that a malicious verifier can't fake a success unless it already knows the password, thus making password phishing pretty much pointless: the only thing a phisher can verify is whether the user uses some predetermined password, and if not, the user is immediately made aware that the site expected another password.

IIRC, the most recently developed ZKPP is OPAQUE: https://blog.cryptographyengineering.com/2018/10/19/lets-tal...