The “secure remote password protocol” is a modern cryptographic protocol for password authenticated key exchange (PAKE). It provides some desireable properties, like a passive eavesdropper being unable to brute-force the password. It is usually used to derive shared session keys from passwords and ...
I'm implementing the SRP-6 protocol, which relies on discrete logarithms for it's security (essentially Diffie-Hellman). The RFC documents state: The private values $a$ and $b$ SHOULD be at least ...
I'm deploying a secure remote password protocol implementation and I'm wondering what the consequences are when the client generated verifier gets leaked to an attacker. I've read Thomas Wu's paper ...
I've been reading up on the Secure Remote Pasword protocol (SRP). There are a couple different versions of the protocol (the original published version being designated SRP-3, with two subsequent ...
SRP seems to be a very good password authentication protocol, compared to any other things used now. So why is there no popular implementations, or even no working secure implementations? I tried to ...
I'm interested in using a modified form of SRP as a peer-to-peer authentication method. Since neither side is acting as a host, one of the primary design goals for SRP (that the client doesn't need ...
In a comment to an answer I wrote to another question, CodesInChaos wrote that: "Problem with SRP is that an attacker who impersonates a server learns the password hash, enabling offline search." ...
OK, here's the two different ways I was thinking about making the authentication for the login thing to store the passwords securely. The first is the following. Client hashes password ...