How to authenticate client at server using a hashed password with salt?

Question

I try to implement a authentification algorithm. My basic sequence for now is the following:

Right now i doubt that this is the correct way to do it. With the salt i want to prevent rainbow tables but requesting the salt from the server would let a man in the middle attack get the salt and after it cracking the password with a rainbow table using the salt is easy.

Is the only way solving this a https connection or is it somehow possible to get it more save?

Answer 1

1. Never store passwords, just its hash.
2. Salt shall never leave server, generate salt and keep it as part of generated hash.
3. Use seed for added protection. Seed can be number of seconds from some predefined date till the date user created his login with the application.

C# code sample:

// extends byte[] to create SHA256 hash code with seed and salt of supplied size
public static byte[] GetSHA256HashCode(this byte[] value, byte[] seed, int prefix = 0)
{
    var salt = new byte[prefix];
    RNG.GetBytes(salt);
    return salt.Concat(seed.Concat(salt).Concat(value).ToArray().GetSHA256HashCode()).ToArray();
}

// extends byte[] to compare SHA256 hash code with seed and salt of supplied size to supplied hash code
public static bool IsEqualToSHA256HashCode(this byte[] value, byte[] code, byte[] seed, int prefix = 0)
{
    return seed.Concat(code.Take(prefix)).Concat(value).ToArray().GetSHA256HashCode().SequenceEqual(code.Skip(prefix));
}