I was thinking about how SRP might be used with Curve25519 or Curve448. In this question, Can SRP be used with Elliptic Curves?, the answer is that you can't directly translate SRP to a group that isn't also a ring, because SRP uses not just multiplication but also addition.

In traditional SRP-6a, the server computes its public element $B$ from random secret $b$ as follows:

$B = kv + g^b$

The client then computes $S$ from its own secret $a$ and the server's $B$ as follows:

$S = (B - kv)^{a + ux}$

The subtraction of $kv$ from $B$ restores $g^b$ to compute the shared secret $S = {(g^b)}^{a + ux}$. It's only the single addition and subtraction (not counting $a+ux$) that prevent using a non-ring group like elliptic curves.

The purpose of adding $kv$ to $g^b$ seems to be to hide the value of $g^b$ from any adversary who does not know the verifier $v=g^x$. In other words, a sort of encryption.

What if we then remove the problematic operations and replace them with encryption using hashes of the verifier as the key?

$B = Enc(H(kv), g^b)$
$S = Dec(H(kv), B)^{a + ux}$

Now all the operations can be translated to an elliptic curve group. (With proper precautions like ensuring that $A$ and $Dec(H(kv),B)$ are on the curve and not on small subgroups.)

  • $\begingroup$ Two considerations: 1. what is the total cost of the proposed 2. The proposed increased the number of security dependencies that we want depend to less if possible. $\endgroup$
    – kelalaka
    Nov 10, 2023 at 5:43
  • 1
    $\begingroup$ There are plenty of serious PAKE constructions supporting elliptic curves and that come with meaningful security guarantees. Trying to design your own custom variant of SRP (a pretty poorly designed protocol to begin with) to support elliptic curves sounds like a poor idea: 1/ not particularly useful, 2/ has been done already (sometimes insecurely!), 3/ almost certainly worse that the state of the art. If you nevertheless have serious reasons to think you have a valuable protocol, you should write a paper about it (with security proofs) and submit it for peer review. $\endgroup$ Nov 10, 2023 at 10:35


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.