# Is SRP post-quantum secure?

Is SRP-6a post-quantum secure? If it is not post-quantum secure, do any post-quantum secure alternatives similar to SRP-6a exist?

-

No, since finding $a$ allows offline checking of passwords. $\:$ No, although I can't back this part up.

-
Thanks for this! I assume the second "no" refers to post-quantum secure "SRP-6a-like" alternatives, right? Does S/KEY or a similar alternative based on Lamport's scheme provide such a security? – mpr Aug 2 '14 at 14:53
That is what it refers to. $\:$ For S/KEY, I think a commitment scheme that is one-to-one non-malleable, extractable, and equivocable would suffice, although the only candidates for that which I can think of use at least multi-string setup. $\:$ What is "a similar alternative based on Lamport's scheme"? $\;\;\;\;$ – Ricky Demer Aug 3 '14 at 5:25
Thanks for the paper! I'll be sure to read it :) Regarding "a similar alternative based on Lamport's scheme", what I meant was using the one-way property of cryptographic hashes based on a common secret. Would you mind extending your comment on the S/KEY alternatives into an answer? Thank you very much for your time! – mpr Aug 5 '14 at 13:02