4
$\begingroup$

I am on the impression that SRP emerges as the least uncommon and best analyzed protocol for authentication and key agreement based on a short password.

This states that SRP is part of IEC 11770-4, among other protocols. But no version is specified, and I've seen there's SRP-1, SRP-2, SRP-3, SRP-6, and the current SRP-6a.

Hence my first question: which version(s) of SRP are in ISO/IEC 11770-4:2006? (link is to a free preview; drafts are available here to those willing to subscribe to a mailing list, and I have yet to spot a meaningful technical difference between the October 31, 2005 draft and the real thing)

Which list of parameters and options to SRP or/and ISO/IEC 11770-4:2006 would be necessary to define implementations to the point of being secure and inter-operable?

Also: ISO/IEC 11770-4:2006 can use an Elliptic Curve setting, with (I guess) shorter cryptograms; is that the case for SRP?

Update: the motivation of the question is that ISO/IEC 11770-4 is an international standard, approved by a committee, which is more reassuring to a decision-maker than SRP-6a as defined by a web page than can disappear or change any second.

In a comment, Smit Johnth suggested TLS-SRP/RFC 5054, which has some traction. That could be a possible choice. I'm reading it as implementing SRP-6a, despite claiming to implement SRP-6 with reference to documents predating SRP-6a. My main reservations are that TLS is a bit heavy for my application; and RFC 5054 is stuck to SHA-1, which is bad from a certification standpoint: in France, any hash less than 200 bits, or 256 bits for use after year 2020, does not match rules in section 2.3 of these official recommendations, which at least can make a prescriber less comfortable.

Improve this question
$\endgroup$
4
  • $\begingroup$ Since SE is already impersonal and community-oriented, could you explain, why is ISO/IEC 11770-4:2006 so interesting? $\endgroup$
    – Smit Johnth
    Jun 4, 2013 at 18:30
  • $\begingroup$ There is already TSL-SRP, what's the difference between it and ISO? $\endgroup$
    – Smit Johnth
    Jun 4, 2013 at 18:38
  • $\begingroup$ If you consider you local network secure, you can use plain text :) $\endgroup$
    – Smit Johnth
    Jun 4, 2013 at 18:45
  • $\begingroup$ There seems to be a trend of SRP-6a being misquoted as SRP-6 in standards. IEEE Std 1363.2-2008 does the same! $\endgroup$
    – Mingye Wang
    Jun 10 at 5:06

1 Answer 1

Reset to default
1
$\begingroup$

The multiplier parameter $k$ is different between SRP 6 and 6a. You can see that RFC 5054 calculates it using a hash of the domain parameters (modulus $N$ and generator $g$), so it is using SRP 6a, as opposed to SRP 6 where $k$ is constant.

Likewise, in section 6.2.1 of IEC 11770-4 – the October 2005 draft at least – the equivalent value $c$ is defined as a hash of the domain parameters which it calls $q$ and $g_{q-1}$, so it too is based on SRP 6a.

Also: ISO/IEC 11770-4:2006 can use an Elliptic Curve setting, with (I guess) shorter cryptograms; is that the case for SRP?

Yes. The protocol in 6.2 is defined for either of the fields in section 5: the discrete logarithm one or the elliptic curve one.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.