Email Password Hash User Authentication

This user authentication scheme makes use of an email and password but avoids sending the password over the wire as an extra security precaution. Instead, a nonce is hashed with the password using SHA-256 and the resulting hash value is sent. The recipient can verify the value if it also knows the password.

This scheme is identified by the string EMAIL_PASSWORDHASH.

Authentication Data Representation

authdata = {
  "#mandatory" : [ "email", "nonce", "hash" ],
  "email" : "string",
  "nonce" : "binary",
  "hash" : "binary",
}

Field	Description
email	user email address
hash	hash of nonce and user password
nonce	random value

Nonce

The nonce should be a randomly generated value of sufficient length. Using a value at least as long as the hash algorithm block size is recommended.

Hash

The hash of the nonce concatenated with the user password.