Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

SRP seems to be a very good password authentication protocol, compared to any other things used now. So why is there no popular implementations, or even no working secure implementations?

I tried to set up TLS-SRP protocol, but it haven't worked for me.


Haaalp! Someone?

share|improve this question
    
Tom Wu, the author of SRP, was here once. Curious what would he say. –  Smit Johnth May 5 '13 at 19:57
add comment

2 Answers

When I learned about SRP we were told it wasn't seeing much deployment due to possibly infringing on EKE patents. Network Computing had this to say in 2002:

Standards groups have made several attempts to induce Lucent to talk about its EKE patent -- to no avail. Even with Lucent's silence on the topic, few vendors have been willing to use SRP. To further cloud the situation, there's been a new patent issued claiming that it too covers SRP.

The SRP website, however claims

Since SRP is specifically designed to work around existing patents in the area, it gives everybody access to strong, unencumbered password authentication technology that can be put to a wide variety of uses.

If I had to guess, I'd say patents were part of the original problem and that effect has continued even today. Whether patents are the sole reason for limited deployment or even the major reason is beyond me.

share|improve this answer
    
TLS-SRP became a RFC standard long ago. There is lack of implementations. Reference from 2002 is probably a little too old. –  Smit Johnth May 5 '13 at 18:02
add comment

While I think this is changing very recently with expiration of additional patents and SRP included with OpenSSL one of the central problems is compatibility with existing authentication databases.

NT OWFs, unix crypts, directory server hashes..etc everything but plaintext passwords (e.g. plaintext reversibly encrypted on disk) are incompatible with SRP. Sure you can have a SRP client perform encryption if you leak salts and match stored hash but this escalates importance of hashes to be equivalent to plaintext passwords. (e.g. "passing the hash")

Personally I'm very excited about SRP we have a few projects planned that will be leveraging TLS-SRP.

share|improve this answer
    
What patents do you mean? TLS-SRP in OpenSSL doesn't work for me (see link in the question) and I can't get help nowhere.<br> Don't even mention windows NT auth, it sucked 15 years ago and now it sucks multiplied growed computing power. –  Smit Johnth May 21 '13 at 21:49
    
Well, if you ask about auth databases, then you are probably inside and organisation and could probably acquire one or many ssl certificates or even a CA. SRP would be useful for a lonely server for that it would be expensive or complicated to get a signed SSL certificate. –  Smit Johnth May 22 '13 at 2:44
    
@SmitJohnth SRP has the additional advantage (over traditional RSA or DH key exchange with a server's certificate) that the client is automatically authenticated, too, and you don't need an additional step for client authentication. –  Paŭlo Ebermann May 23 '13 at 21:43
    
@PaŭloEbermann I think your post doesn't belong here :) –  Smit Johnth May 24 '13 at 1:27
    
@SmitJohnth No, my comment was meant as a response to your comment. SRP is not just for the case where "I can't afford a SSL certificate", but offers additional advantages (but only works for the case of a limited user group). –  Paŭlo Ebermann May 24 '13 at 19:12
show 1 more comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.