Questions tagged [srp]
The “secure remote password protocol” is a modern cryptographic protocol for password authenticated key exchange (PAKE). It provides some desireable properties, like a passive eavesdropper being unable to brute-force the password. It is usually used to derive shared session keys from passwords and authenticate users with passwords.
51
questions
2
votes
1
answer
625
views
Understanding AES-GCM IV (Nonce), Tag/MAC, Message & Transmission
I am working on a project that uses PAKE (SRP) for authentication. When we send the M1 to the server we are encrypting the payload using AES-GCM. I mention SRP only to set the context:
A message is ...
- 123
0
votes
0
answers
50
views
What is the purpose of hashing the identifier in the secure remote password (SRP) protocol? [duplicate]
In the secure remote password protocol version 6a, the identifier for the user, I, is hashed along with the salt and the password on the client.
While I understand ...
- 1
1
vote
1
answer
118
views
Getting a random number on an STM32L0x1 device for SRP6a
I'm trying to get a random number for a STM32L0x1 MCU to use it in protocol SRP6a.
(I know that there are MCUs with an embedded hardware random number generator. But it would cost twice as much as the ...
- 11
0
votes
1
answer
73
views
Is there a PAKE algorithm that is fully resistant to a server data leak?
I'm looking to build an authorization system with a completely "public" server which involves two assumptions:
The server's data is public
The server is incorruptible and uncrackable i.e. nobody can ...
- 1
3
votes
1
answer
328
views
Why are PAKE protocols not widely used?
While there are plenty of PAKE protocols, especially those augmented ones which are practical in C/S model, actually they seem to be not widely used. Even TLS-Standardized SRP, the most popular one ...
- 31
2
votes
2
answers
123
views
Break large exponent calculation into smaller calculations?
I am implementing SRP on an embedded platform. It has crypto acceleration and I am using its built in modular exponentiation function, however it doesn't seem to be able to handle an exponent over 32 ...
- 121
1
vote
2
answers
203
views
In SRP, is the client protected from server impersonation?
Assume use of SRP over an otherwise insecure unauthenticated channel where
the user running the client side has chosen a password,
the user only uses that password with a trusted SRP client software, ...
- 137k
1
vote
2
answers
505
views
What can I do, if my SRP password verifier was stolen?
I've got a system that works like this:
...
- 267
3
votes
1
answer
689
views
SRP man-in-the-middle
This site suggests that Secure Remote Password protocol is secure when "Attackers can intercept, modify, and forge arbitrary messages between client and server."
However, from a quick reading of the ...
- 165
4
votes
0
answers
105
views
Implications of TLS-SRP client with improper N validation?
During development of a client side application of TLS-SRP, i noticed a bug that allows an attacker spoofing as the server to send custom, but non-arbitrary $N$ values, with the client accepting them. ...
1
vote
1
answer
253
views
There is a protocol similar to SRP but where a part of the secret is stored on the client side?
SRP is very useful but if our DB is leaked, an attacker could brute force a user's password with his associated salt/verifier found in the DB. I'm searching a solution to prevent this.
My first idea ...
- 51
1
vote
3
answers
850
views
Argon2id internal iterations vs multiple Argon2id calls ?
TLDR;
Is there a security risk if rather than setting the iteration parameter to 12 (for example), we set it to 3 but call the function 4 times?
I'm asking that for 2 reasons:
Firstly, we use SRP ...
- 51
0
votes
2
answers
169
views
SRP with random, but constant private-value b
In RFC5054, the SRP6a algorithm states that the client and the server should generate random ephemeral private values $a$ and $b$ respectively which are used for further derivation in the handshake ...
- 103
0
votes
2
answers
953
views
How should one create an ephemeral Diffie-Hellman private key?
When picking an ephemeral Diffie-Hellman private key (little a or little b), can I reasonably just pick 32 random bytes? I am specifically interested in use within SRPv6.
RFC5054 says that these ...
- 324
3
votes
1
answer
313
views
SRP and compromised verifier [closed]
Let's assume that attacker knows the verifier so now the attacker can commit a Man-in-the-Middle (MitM) attack:
Client sends A to server;
MitM takes it and sends B to client.
As the MitM knows the ...
- 267
4
votes
1
answer
817
views
Why is SRP considered to be resistant to MITM attack?
Why is SRP considered to be resistant to MITM attack? Documentation says
A man-in-the-middle attack, which requires an attacker to fool both
sides of a legitimate conversation, cannot be carried ...
- 267
19
votes
2
answers
1k
views
Is there any SRP-like key exchange only using "standard" cryptographic primitives?
I am looking into PAKEs (password-authenticated key exchanges), and it seems like SRP (Secure Remote Password) is essentially the de-facto standard.
However, implementing SRP actually requires doing ...
- 1,101
5
votes
1
answer
193
views
What security checks do I need for SRP-6a?
I'm implementing an SRP-6a login system. What security checks do I need to do? Note that the modulus is sent to the client at algorithm startup.
Here is the list I have so far. I'm using the ...
- 2,451
1
vote
1
answer
400
views
How does a user register his verifier at host in SRP (Secure Remote Password) protocol?
I read RFC 2945 and 5054 describing SRP, but there was no mention of registration.
How should user registration happen in SRP? Is there a standard or paper describing it?
- 31
1
vote
1
answer
321
views
Why does the Secure Remote Protocol have resistance of dictionary attack?
Assume that Eeve who masquerades as a legitimate host and convinces Carol to
make an authentication attempt. (Carol wants to handshake with Steve – a host)
Thus, Eve can get values $A = g^a, M1 = H(A,...
- 31
5
votes
1
answer
234
views
State level "Weak Diffie-Hellman" working for SRP too?
I've read about the "Weak Diffie-Hellman" attack (paper, website), where a resourceful entity like a state can pre-compute values for known primes to aid solving the discrete logarithm ...
- 153
4
votes
2
answers
806
views
Weakness of SRP after server compromise
From SRP section 3:
The host stores user passwords as triplets of the form
{ <username>, <password verifier>, <salt> }
Password entries are ...
2
votes
1
answer
182
views
Security of SRP-6a against impersonating server choosing small/wrong N
I'm looking at an implementation of SRP (Secure Remote Password) that essentially follows the Stanford documentation (http://srp.stanford.edu/design.html). I'm worried about one aspect though: In the ...
- 68
5
votes
2
answers
383
views
Does SRP also authenticate the server to the client?
The Secure Remote Password (SRP) protocol lets a client prove to a server that it knows a specific password without revealing that password to the server. The server stores a cryptographic verifier ...
- 223
3
votes
2
answers
173
views
Public SRP verifiers or public hash chain "public keys" when secret is low entropy password
I want to set up the following:
An untrusted server should host user sessions and authenticate users without knowing their passwords or being capable of creating a fake user session in the user's ...
- 157
3
votes
1
answer
245
views
Where is SRP-Z from?
The Stanford license for SRP says:
Broader use of the SRP authentication technology, such as variants
incorporating the use of an explicit server secret (SRP-Z), may
require a license;
Yet I ...
- 655
1
vote
1
answer
394
views
Is this variant of SRP for peer-to-peer authentication practical?
I'm interested in using a modified form of SRP as a peer-to-peer authentication method. Since neither side is acting as a host, one of the primary design goals for SRP (that the client doesn't need ...
- 829
3
votes
3
answers
636
views
SRP-6 vulnerabilities when N is small
I'm one of the developers of an application which uses SRP-6 as the authentication mechanism. The authentication part of the code is very old and uses N with only 256 bits (all arithmetic is done in ...
5
votes
1
answer
295
views
Discovering private exponent from public key
I'm going to assume this isn't possible, but I have to ask because I'm trying to fundamentally understand what I've thus far been trying to implement by following an RFC.
SRP-6a starts off with ...
- 225
7
votes
1
answer
948
views
Implementation and Testing of SRP-6a
I have been wracking my brain trying to develop a functioning implementation of SRP-6a in Python to use with a 3rd-party API that claims to use SRP-6a with $N=$ 2048-bit prime and generator of $2$. ...
- 225
6
votes
2
answers
472
views
Is SRP post-quantum secure?
Is SRP-6a post-quantum secure? If it is not post-quantum secure, do any post-quantum secure alternatives similar to SRP-6a exist?
- 245
4
votes
2
answers
240
views
Use of less than secure random numbers for 'a' during an SRP proof of password
With Secure Remote Password protocol SRP6a random numbers are used for s, a and b. Where <...
- 655
1
vote
1
answer
145
views
Can N, q be shared for multiple users when using SRP-6A
Is it considered bad practice to use the same N and q parameters for all users in an SRP-6A based authentication system?
I know that q MUST be a Sophie Germain prime and N a safe prime, but can they ...
- 13
-1
votes
1
answer
691
views
Are the protocols DH-EKE, B-SPEKE, A-EKE, and SRP are considered challenge-response authenticaion mechanisms? [closed]
I got confused which one is considered challenge-response mechanism which one is not.
- 1
2
votes
1
answer
2k
views
Proper way of doing encryption and authentication (PBKDF2 + AES)
I'm currently in the planning phase of an authentication and storage-ish service.
The client needs a file ("ENCFILE") which he will work with. This file will be encrypted with AES256, and stored on ...
- 21
3
votes
2
answers
473
views
Does impersonating an SRP server give you enough information for an off-line dictionary attack?
In a comment to an answer I wrote to another question, CodesInChaos wrote that:
"Problem with SRP is that an attacker who impersonates a server learns the password hash, enabling offline search.&...
- 45.7k
3
votes
2
answers
234
views
Is this exponentation or bitwise XOR
I'm reading about SRP from this page and came accross the line that says a party computes
v = g^x
I am unfamiliar with reading cryptography texts. Does this mean gx, or g ⊕ x?
Jecko
6
votes
1
answer
1k
views
Why is TLS SRP verifier based on user name?
I don't understand why TLS SRP (or SRP in general) includes the user name in verifier calculation, given that user name is basically public.
From spec RFC 5054 $x$, which is then used to calculate ...
- 183
4
votes
1
answer
455
views
Which version(s) of SRP are in ISO/IEC 11770-4:2006?
I am on the impression that SRP emerges as the least uncommon and best analyzed protocol for authentication and key agreement based on a short password.
This states that SRP is part of IEC 11770-4, ...
- 137k
5
votes
2
answers
1k
views
Does SRP reduce to DH key exchange when shared password is not secret?
I can find JavaScript implementations of SRP (Secure Remote Password protocol), but nothing that inspires confidence for Diffie-Hellmen key exchange. I also have a separate need for SRP later.
I ...
- 324
26
votes
7
answers
14k
views
Why is SRP not widely used?
SRP seems to be a very good password authentication protocol, compared to any other things used now. So why is there no popular implementations, or even no working secure implementations?
I tried to ...
- 1,691
7
votes
2
answers
2k
views
Can SRP be used with Elliptic Curves?
I'm sure it can, because SRP (secure remote protocol) can be implemented everywhere where Diffie-Hellman works, but I need a proof to put this aspect into Wikipedia.
Edit: ok, can it be at least ...
- 1,691
2
votes
1
answer
479
views
How can I validate generated session keys in SRP-6a protocol
I have genereted two equal session keys on client and server successfully. But I couldn't understand how each other should validate that they have same session keys.
On the client I generated a SHA1 ...
4
votes
1
answer
225
views
Changing SRP-6a message order
In SRP-6a, the public key $B$ of the server is normally sent after receiving the public key of the client $A$. Is it okay to send $B$ and $s$ after the client sends its username $I$, but before the ...
- 213
4
votes
1
answer
707
views
Why does the SRP-6 calculation of B include a multiplier k = 3?
In SRP-6 $B$ is calculated as $B=kv+ g^b, k=3$. What is the purpose of $k$, and why was it fixed as $3$?
(In SRP-6a, this value $3$ is replaced by $k = H(N,g)$, but this question is about SRP-6.)
- 213
4
votes
2
answers
2k
views
Which is more secure, using just bcrypt or SRP?
OK, here's the two different ways I was thinking about making the authentication for the login thing to store the passwords securely.
The first is the following.
Client hashes password bcrypt(...
- 159
9
votes
1
answer
1k
views
Why does SRP-6a use k = H(N, g) instead of the k = 3 in SRP-6?
I've been reading up on the Secure Remote Pasword protocol (SRP). There are a couple different versions of the protocol (the original published version being designated SRP-3, with two subsequent ...
- 165
8
votes
3
answers
1k
views
Can I use a key-derivation-function as the hash function H in SRP?
In the Secure Remote Password Protocol, the verifier must be stored on the server. In the case of a server compromise, an attacker could obtain these verifiers. If nobody reused passwords, this ...
- 373
4
votes
2
answers
355
views
Can the premaster secret generated by SRP be used as a secure private key?
It seems like the pre-master secret generated during the SRP protocol would make a good source to generate a shared private key using a secure hash to compress it down into a 128/256 symmetric key. ...
- 355
10
votes
1
answer
2k
views
How realistic is a dictionary attack on a secure remote password protocol (SRP) verifier?
I'm deploying a secure remote password protocol implementation and I'm wondering what the consequences are when the client generated verifier gets leaked to an attacker. I've read Thomas Wu's paper ...
- 355