# Which version(s) of SRP are in ISO/IEC 11770-4:2006?

I am on the impression that SRP emerges as the least uncommon and best analyzed protocol for authentication and key agreement based on a short password.

This states that SRP is part of IEC 11770-4, among other protocols. But no version is specified, and I've seen there's SRP-1, SRP-2, SRP-3, SRP-6, and the current SRP-6a.

Hence my first question: which version(s) of SRP are in ISO/IEC 11770-4:2006? (link is to a free preview; drafts are available here to those willing to subscribe to a mailing list, and I have yet to spot a meaningful technical difference between the October 31, 2005 draft and the real thing)

Which list of parameters and options to SRP or/and ISO/IEC 11770-4:2006 would be necessary to define implementations to the point of being secure and inter-operable?

Also: ISO/IEC 11770-4:2006 can use an Elliptic Curve setting, with (I guess) shorter cryptograms; is that the case for SRP?

Update: the motivation of the question is that ISO/IEC 11770-4 is an international standard, approved by a committee, which is more reassuring to a decision-maker than SRP-6a as defined by a web page than can disappear or change any second.

In a comment, Smit Johnth suggested TLS-SRP/RFC 5054, which has some traction. That could be a possible choice. I'm reading it as implementing SRP-6a, despite claiming to implement SRP-6 with reference to documents predating SRP-6a. My main reservations are that TLS is a bit heavy for my application; and RFC 5054 is stuck to SHA-1, which is bad from a certification standpoint: in France, any hash less than 200 bits, or 256 bits for use after year 2020, does not match rules in section 2.3 of these official recommendations, which at least can make a prescriber less comfortable.

-
Since SE is already impersonal and community-oriented, could you explain, why is ISO/IEC 11770-4:2006 so interesting? – Smit Johnth Jun 4 '13 at 18:30
There is already TSL-SRP, what's the difference between it and ISO? – Smit Johnth Jun 4 '13 at 18:38
If you consider you local network secure, you can use plain text :) – Smit Johnth Jun 4 '13 at 18:45

## 1 Answer

The multiplier parameter $k$ is different between SRP 6 and 6a. You can see that RFC 5054 calculates it using a hash of the domain parameters (modulus $N$ and generator $g$), so it is using SRP 6a, as opposed to SRP 6 where $k$ is constant.

Likewise, in section 6.2.1 of IEC 11770-4 – the October 2005 draft at least – the equivalent value $c$ is defined as a hash of the domain parameters which it calls $q$ and $g_{q-1}$, so it too is based on SRP 6a.

Also: ISO/IEC 11770-4:2006 can use an Elliptic Curve setting, with (I guess) shorter cryptograms; is that the case for SRP?

Yes. The protocol in 6.2 is defined for either of the fields in section 5: the discrete logarithm one or the elliptic curve one.

-