Editing Challenge–response authentication (section)

==Password storage==
To avoid storage of passwords, some operating systems (e.g. [[Unix]]-type) store a [[password#Form of stored passwords|hash of the password]] rather than storing the password itself. During authentication, the system need only verify that the hash of the password entered matches the hash stored in the password database. This makes it more difficult for an intruder to get the passwords, since the password itself is not stored, and it is very difficult to determine a password that matches a given hash. However, this presents a problem for many (but not all) challenge-response algorithms, which require both the client and the server to have a shared secret. Since the password itself is not stored, a challenge-response algorithm will usually have to use the hash of the password as the secret instead of the password itself. In this case, an intruder can use the actual hash, rather than the password, which makes the stored hashes just as sensitive as the actual passwords. [[Salted Challenge Response Authentication Mechanism|SCRAM]] is a challenge-response algorithm that avoids this problem.