0
$\begingroup$

In the secure remote password protocol version 6a, the identifier for the user, I, is hashed along with the salt and the password on the client.

While I understand the identifier is used to locate the verifier on the server, what is the purpose of including the identifier in the client side hash?

Does it serve a cryptographic purpose?

Is SRP weakened if I always use an empty string for I on the client?

Improve this question
$\endgroup$
2
  • $\begingroup$ This is answered here. $\endgroup$
    – Modal Nest
    Dec 28 '20 at 21:52
  • $\begingroup$ @ModalNest Thanks! $\endgroup$
    – Andre
    Dec 29 '20 at 13:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.