Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

In the Secure Remote Password Protocol, the verifier must be stored on the server. In the case of a server compromise, an attacker could obtain these verifiers. If nobody reused passwords, this wouldn't be a big deal (as the users' data is probably also compromised). However since people do reuse passwords it seems a good idea to make offline attacks against the password file difficult.

SRP is based off of a cryptographic hash H; part of the cost of an offline attack would be calculating H, so using an expensive hash for this step seems good. However, I am unsure of the suitability of tunably expensive hashing mechanisms (e.g. PBKDF2, bcrypt, scrypt) for this.

share|improve this question
I think the problem would be finding a collision-resistant key-derivation-function, since a $\hspace{1.2 in}$ collision would allow a fake server to test 2 passwords. $\:$ –  Ricky Demer Aug 1 '12 at 2:49
@RickyDemer, turns out that's not a problem. First, collision-resistance is not a big issue for this particular application. Second, PBKDF2 is already adequately collision-resistant. –  D.W. Aug 1 '12 at 5:20
add comment

2 Answers

up vote 4 down vote accepted

Yes, you can and use a slow hashing function when constructing the verifier. I would recommend using PBKDF2, as it is designed for this purpose.

In fact, Wikipedia says:

$v$ is the host's password verifier, $v = g^x$, $x = H(s,p)$. Using of functions like PBKDF2 instead of $H$ for password hashing is highly recommended.

Thus, you could use $x=\text{PBKDF2}(s,p)$. Alternatively, you could pre-hash the password with PBKDF2, then use the result as your $p$.

share|improve this answer
Thanks, do you have a more reliable source than wikipedia for this? In any event prehashing with PBKDF2 is clearly okay, and will only allow a compromise of the account on the single site, not recovery of the cleartext password. –  Aidenn Aug 1 '12 at 22:58
@Aidenn, sorry, no, I don't have any source for this, alas. Sorry about that. (It's a perfectly fair question. I wish I had a better citation or analysis for you!) –  D.W. Aug 1 '12 at 23:35
Wikipedia is not a source. –  Smit Johnth May 24 '13 at 3:23
add comment
  1. There is no reason why you can't, i.e. why H() used for hashing passwords and for the rest of protocol should be the same.

  2. The only thing you pay for that is the speed. Password hash is only generated on the client while you usually want to spare server's CPU time, client's is less important.

share|improve this answer
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.