When Sniffers Are Useless

Recently, the trend of migrating to authentication protocols protected against sniffing has become noticeable. Such protected authentication protocols never transmit the password as plaintext over the network. Instead, such protocols transmit password hashes, each time with different values (which means that the captured hash value cannot be reused).

Authentication is carried out approximately as follows : The client passes his or her login name to the server (as a rule, this is done as plaintext). The server retrieves the corresponding hash from its database, generates an arbitrary sequence of bytes (challenge), and passes it to the client. The client computes the hash of its password, uses the challenge as the encryption key to encrypt it, and returns the result to the server. The server carries out a similar operation, compares the result with the client's response, and either authenticates the user or refuses to establish the connection.

The procedure of hash encryption is irreversible, and a brute-force attack on it requires considerable time, which makes traffic sniffing meaningless.