1
$\begingroup$

Is it considered bad practice to use the same N and q parameters for all users in an SRP-6A based authentication system?

I know that q MUST be a Sophie Germain prime and N a safe prime, but can they be generated ahead of time and be somewhat fixed / hardcoded in the client and server? Or should I generate a fresh pair for each new user registration?

I imagine, it's better to have a different one for each account, but if it's not affecting the security of the system in any way...

Improve this question
$\endgroup$
1
  • $\begingroup$ what is q? the parameters are usually defined as N a safe prime and g its generator which you can create from OpenSSL with openssl dhparam -text <bit-length> $\endgroup$
    – simbo1905
    Oct 10, 2015 at 22:29

1 Answer 1

Reset to default
3
$\begingroup$

You can pre-compute and hardcode N and g into your client and server. There's no harm in doing this. I do not believe that using per-user N will provide any additional security.

It is common practice to define SRP parameters for a particular application or (larger) protocol, see e.g. RFC 5054.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.