# Is SRP post-quantum secure?

Is SRP-6a post-quantum secure? If it is not post-quantum secure, do any post-quantum secure alternatives similar to SRP-6a exist?

No, since finding $a$ allows offline checking of passwords. $\:$ No, although I can't back this part up.
• That is what it refers to. $\:$ For S/KEY, I think a commitment scheme that is one-to-one non-malleable, extractable, and equivocable would suffice, although the only candidates for that which I can think of use at least multi-string setup. $\:$ What is "a similar alternative based on Lamport's scheme"? $\;\;\;\;$ – user991 Aug 3 '14 at 5:25
Post-Quantum Secure Remote Password Protocol from RLWE Problem describes one possible solution using a RLWE-based SRP protocol (RLWE-SRP) which inherits the advantages from SRP and the elegant design from an RLWE key exchange. Additionally the reference implementation of the protocol is said to be significantly faster than the original SRP for a 112-bits of security.