Editing Password (section)

====Hash-based challenge–response methods====

There is a conflict between stored hashed-passwords and hash-based [[challenge–response authentication]]; the latter requires a client to prove to a server that they know what the [[shared secret]] (i.e., password) is, and to do this, the server must be able to obtain the shared secret from its stored form. On a number of systems (including [[Unix]]-type systems) doing remote authentication, the shared secret usually becomes the hashed form and has the serious limitation of exposing passwords to offline guessing attacks. In addition, when the hash is used as a shared secret, an attacker does not need the original password to authenticate remotely; they only need the hash.