# Can SRP be used with Elliptic Curves?

I'm sure it can, because SRP (secure remote protocol) can be implemented everywhere where Diffie-Hellman works, but I need a proof to put this aspect into Wikipedia.

Edit: ok, can it be at least partially moved to elliptic curves?

-
It's certainly possible to use a protocol that generates a private key from a password hash with ECC. But the proof that the client possesses the key will be different. –  CodesInChaos Mar 23 '13 at 18:01

SRP needs more than a group, it requires a field. See the specification: second user sends $B = v + g^b$. This requires two operations, addition and multiplication. You cannot trivially slap that onto a group which provides only one operation, such as elliptic curves.

Variants of SRP which use elliptic curves have been proposed, but do not seem to have reached wide acceptance or even substantial scrutiny yet. See for instance this proposal. Also, this article gives some details (e.g. it claims to break a previous proposal for an EC-based SRP variant).

-
Argh, just forgot that, but the rest should work fine with ECC. But why can't we just leave the same + operation mod N? –  Smit Johnth Mar 4 '13 at 1:07
@SmitJohnth: because that would void the security guarrantee that SRP makes. Only some bit patterns are possible Elliptic Curve points (even if you use only the x coordinate); if the attacker sees a value $B = v + bG$, he can guess a possible password, generate the corresponding $v'$ value; if $B - v'$ is not a possible Elliptic Curve point, he now knows that the password was not correct. –  poncho Mar 6 '13 at 15:45