Questions tagged [srp]

The “secure remote password protocol” is a modern cryptographic protocol for password authenticated key exchange (PAKE). It provides some desireable properties, like a passive eavesdropper being unable to brute-force the password. It is usually used to derive shared session keys from passwords and authenticate users with passwords.

Filter by
Sorted by
Tagged with
13 votes
3 answers

What should be the size of a Diffie-Hellman private key?

I'm implementing the SRP-6 protocol, which relies on discrete logarithms for it's security (essentially Diffie-Hellman). The RFC documents state: The private values $a$ and $b$ SHOULD be at least 256-...
Jim's user avatar
  • 133
10 votes
1 answer

How realistic is a dictionary attack on a secure remote password protocol (SRP) verifier?

I'm deploying a secure remote password protocol implementation and I'm wondering what the consequences are when the client generated verifier gets leaked to an attacker. I've read Thomas Wu's paper ...
Grant BlahaErath's user avatar
26 votes
7 answers

Why is SRP not widely used?

SRP seems to be a very good password authentication protocol, compared to any other things used now. So why is there no popular implementations, or even no working secure implementations? I tried to ...
Smit Johnth's user avatar
  • 1,691
9 votes
1 answer

Why does SRP-6a use k = H(N, g) instead of the k = 3 in SRP-6?

I've been reading up on the Secure Remote Pasword protocol (SRP). There are a couple different versions of the protocol (the original published version being designated SRP-3, with two subsequent ...
Robert I. Jr.'s user avatar
6 votes
1 answer

Why is TLS SRP verifier based on user name?

I don't understand why TLS SRP (or SRP in general) includes the user name in verifier calculation, given that user name is basically public. From spec RFC 5054 $x$, which is then used to calculate ...
nefarel's user avatar
  • 183
4 votes
1 answer

Which version(s) of SRP are in ISO/IEC 11770-4:2006?

I am on the impression that SRP emerges as the least uncommon and best analyzed protocol for authentication and key agreement based on a short password. This states that SRP is part of IEC 11770-4, ...
fgrieu's user avatar
  • 138k
1 vote
1 answer

Is this variant of SRP for peer-to-peer authentication practical?

I'm interested in using a modified form of SRP as a peer-to-peer authentication method. Since neither side is acting as a host, one of the primary design goals for SRP (that the client doesn't need ...
Steve Peltz's user avatar
19 votes
2 answers

Is there any SRP-like key exchange only using "standard" cryptographic primitives?

I am looking into PAKEs (password-authenticated key exchanges), and it seems like SRP (Secure Remote Password) is essentially the de-facto standard. However, implementing SRP actually requires doing ...
ithisa's user avatar
  • 1,101
8 votes
3 answers

Can I use a key-derivation-function as the hash function H in SRP?

In the Secure Remote Password Protocol, the verifier must be stored on the server. In the case of a server compromise, an attacker could obtain these verifiers. If nobody reused passwords, this ...
Jason's user avatar
  • 373
5 votes
1 answer

State level "Weak Diffie-Hellman" working for SRP too?

I've read about the "Weak Diffie-Hellman" attack (paper, website), where a resourceful entity like a state can pre-compute values for known primes to aid solving the discrete logarithm ...
user10008's user avatar
  • 153
3 votes
2 answers

Does impersonating an SRP server give you enough information for an off-line dictionary attack?

In a comment to an answer I wrote to another question, CodesInChaos wrote that: "Problem with SRP is that an attacker who impersonates a server learns the password hash, enabling offline search.&...
Ilmari Karonen's user avatar
3 votes
1 answer

Where is SRP-Z from?

The Stanford license for SRP says: Broader use of the SRP authentication technology, such as variants incorporating the use of an explicit server secret (SRP-Z), may require a license; Yet I ...
simbo1905's user avatar
  • 655
3 votes
1 answer

SRP man-in-the-middle

This site suggests that Secure Remote Password protocol is secure when "Attackers can intercept, modify, and forge arbitrary messages between client and server." However, from a quick reading of the ...
Him's user avatar
  • 165
1 vote
2 answers

What can I do, if my SRP password verifier was stolen?

I've got a system that works like this: ...
Tony's user avatar
  • 267
1 vote
2 answers

In SRP, is the client protected from server impersonation?

Assume use of SRP over an otherwise insecure unauthenticated channel where the user running the client side has chosen a password, the user only uses that password with a trusted SRP client software, ...
fgrieu's user avatar
  • 138k
1 vote
1 answer

There is a protocol similar to SRP but where a part of the secret is stored on the client side?

SRP is very useful but if our DB is leaked, an attacker could brute force a user's password with his associated salt/verifier found in the DB. I'm searching a solution to prevent this. My first idea ...
lakano's user avatar
  • 51
1 vote
3 answers

Argon2id internal iterations vs multiple Argon2id calls ?

TLDR; Is there a security risk if rather than setting the iteration parameter to 12 (for example), we set it to 3 but call the function 4 times? I'm asking that for 2 reasons: Firstly, we use SRP ...
lakano's user avatar
  • 51