In the secure remote password protocol version 6a, the identifier for the user, I, is hashed along with the salt and the password on the client.

While I understand the identifier is used to locate the verifier on the server, what is the purpose of including the identifier in the client side hash?

Does it serve a cryptographic purpose?

Is SRP weakened if I always use an empty string for I on the client?

  • $\begingroup$ This is answered here. $\endgroup$
    – Modal Nest
    Dec 28, 2020 at 21:52
  • $\begingroup$ @ModalNest Thanks! $\endgroup$
    – Andre
    Dec 29, 2020 at 13:45


Browse other questions tagged or ask your own question.