What scheme would allow for that, though? Except for public key cryptography?<p>Seems to me storing hashes and nonces does not work, because without the original password the server can not create new hashes and nonces. So the client would still always send the same thing, which would be equivalent to a password.