A novel approach to password-auth without sharing the password to server