Hot answers tagged

3

In the introduction of the Logjam paper, it is stated that After a week-long precomputation for a specified 512-bit group, we can compute arbitrary discrete logs in that group in about a minute. So it seems that what it actually does is attack the discrete logarithm problem, so any discrete-logarithm-based system which uses a common prime should ...


3

RFC 2945 By Tom Wu the SRP inventor uses x = H(s, H(I, ":", p)) where I is the username demonstrating that can do anything you like to the stretch the password such as prefixing the username then hashing it. So stretching the user entered password before putting it into function using PBKDF2 would increase the time taken for a dictionary attack with no ...


2

I know PBKDF2 is essentially "useless" against anyone with a GPU rig and I have read that bcrypt is "useless" to anyone with an FPGA setup. Neither is useless. Newer alternatives like scrypt and the eventual PHC winner make better use of the defenders' resources, but even a thousand iterations of PBKDF2 is useful, compared to doing nothing. If you ...


2

Yes, it's okay. This is actually mentioned in passing in the SRP 6 design paper. Previous versions used a random $u$ where an attacker who saw (or could predict) it before revealing $A$ could compute $A = g^a v^{-u}$ and use this to effectively cancel out the long term secret. With $u$ derived from a hash, even if the attacker saw $B$, the dependence of $u$ ...


2

SRP with the user's key = 0 is identical to DH. SRP with a publicly known key is identical to DH with a constant multiplier. For private key $x$, user ephemeral value $a$, server ephemeral value $b$, and $u$ derived from shared values, SRP ends up calculating the value $g^{ab + uxa}$ (which is then typically hashed to get the shared key). If $x$ is zero, ...


2

As mentioned in the comments this is a standard problem not unique to SRP and not really about the cryptography of SRP. So this question would probably be better posted on 'security.stackexchange.com' as it is more of a generic problem. Fundamentally setting a shared secret like a regular password or a password verifier over a public network has its ...


2

The property of SRP is that: If the attacker is a passive listener to an exchange between a client and a server, he learns nothing about the shared password If the attacker is a participant in the exchange with either a client or a server with the password (or modifies the exchange between the client and the server), the attacker learns nothing except for ...


1

This question both describes the SRP-Z variant and mentions that the patent should expire in three years. I think the patent in question is this one, but I'm not sure: US 6539479. If it is, it seems to actually have expired earlier this year due to non-payment of fees. Looking it up on the USPTO PAIR says: Status: Patent Expired Due to NonPayment of ...


1

Taking a stab at answering my own question. First, this is very similar to STS (Station to Station) protocol and the KEA+ (Key Exchange Algorithm), which I had not seen before. I've refined the algorithm above and changed a few variable names for clarity (w, y become a, b; v, h become X, Z). Changes from the earlier version include removing the $kh$ and ...


1

According to the Stanford page mutual authentication can be provided if both sides keep their secrets secret. Thanks mikeazo.


1

From the Security Considerations -section of the RFC: Even if the host's password database were publicly revealed, the attacker would still need an expensive dictionary search to obtain any passwords. The exponential computation required to validate a guess in this case is much more time-consuming than the hash currently used by ...


1

I don't see how the server can directly learn $x$; what a server would be able to is perform a single exchange with the client (recording the initial parts of the protocol), and then go through a dictionary, and test various passwords (that is, various possible $x$ values), and realize when he finds the right one. The idea here would be to select a prime ...


1

Nimbus or Thinbus are two popular SRP implementations in Java and Javascript compute the proof of password as you describe H(A|B|S) where you can supply your own hash functions such as SHA1 or SHA256 or stronger. The actual protocol design document states H(H(N) xor H(g), H(I), s, A, B, K) where K=H(S) so that expands to H(H(N) xor H(g)|H(I)|s|A|B|H(S)). ...



Only top voted, non community-wiki answers of a minimum length are eligible