I'm sure it can, because SRP (secure remote protocol) can be implemented everywhere where Diffie-Hellman works, but I need a proof to put this aspect into Wikipedia.

Edit: ok, can it be at least partially moved to elliptic curves?

  • $\begingroup$ It's certainly possible to use a protocol that generates a private key from a password hash with ECC. But the proof that the client possesses the key will be different. $\endgroup$ – CodesInChaos Mar 23 '13 at 18:01

SRP needs more than a group, it requires a field. See the specification: second user sends $B = v + g^b$. This requires two operations, addition and multiplication. You cannot trivially slap that onto a group which provides only one operation, such as elliptic curves.

Variants of SRP which use elliptic curves have been proposed, but do not seem to have reached wide acceptance or even substantial scrutiny yet. See for instance this proposal. Also, this article gives some details (e.g. it claims to break a previous proposal for an EC-based SRP variant).

  • $\begingroup$ Argh, just forgot that, but the rest should work fine with ECC. But why can't we just leave the same + operation mod N? $\endgroup$ – Smit Johnth Mar 4 '13 at 1:07
  • 2
    $\begingroup$ @SmitJohnth: because that would void the security guarrantee that SRP makes. Only some bit patterns are possible Elliptic Curve points (even if you use only the x coordinate); if the attacker sees a value $B = v + bG$, he can guess a possible password, generate the corresponding $v'$ value; if $B - v'$ is not a possible Elliptic Curve point, he now knows that the password was not correct. $\endgroup$ – poncho Mar 6 '13 at 15:45
  • $\begingroup$ @Thomas Pornin, do you have an updated link to (or just the name of) the first article you quoted on ECC based analogues of SRP? The current link doesn't appear to work anymore. Thanks! $\endgroup$ – Hanno Becker Oct 1 '19 at 12:23
  • $\begingroup$ I have fixed the two article links. The Web is impermanent. $\endgroup$ – Thomas Pornin Oct 1 '19 at 13:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.