Questions tagged [srp]
The “secure remote password protocol” is a modern cryptographic protocol for password authenticated key exchange (PAKE). It provides some desireable properties, like a passive eavesdropper being unable to brute-force the password. It is usually used to derive shared session keys from passwords and authenticate users with passwords.
17
questions
13
votes
3
answers
11k
views
What should be the size of a Diffie-Hellman private key?
I'm implementing the SRP-6 protocol, which relies on discrete logarithms for it's security (essentially Diffie-Hellman).
The RFC documents state:
The private values $a$ and $b$ SHOULD be at least 256-...
- 133
10
votes
1
answer
2k
views
How realistic is a dictionary attack on a secure remote password protocol (SRP) verifier?
I'm deploying a secure remote password protocol implementation and I'm wondering what the consequences are when the client generated verifier gets leaked to an attacker. I've read Thomas Wu's paper ...
- 355
26
votes
7
answers
14k
views
Why is SRP not widely used?
SRP seems to be a very good password authentication protocol, compared to any other things used now. So why is there no popular implementations, or even no working secure implementations?
I tried to ...
- 1,691
9
votes
1
answer
1k
views
Why does SRP-6a use k = H(N, g) instead of the k = 3 in SRP-6?
I've been reading up on the Secure Remote Pasword protocol (SRP). There are a couple different versions of the protocol (the original published version being designated SRP-3, with two subsequent ...
- 175
6
votes
1
answer
1k
views
Why is TLS SRP verifier based on user name?
I don't understand why TLS SRP (or SRP in general) includes the user name in verifier calculation, given that user name is basically public.
From spec RFC 5054 $x$, which is then used to calculate ...
- 183
4
votes
1
answer
457
views
Which version(s) of SRP are in ISO/IEC 11770-4:2006?
I am on the impression that SRP emerges as the least uncommon and best analyzed protocol for authentication and key agreement based on a short password.
This states that SRP is part of IEC 11770-4, ...
- 138k
1
vote
1
answer
394
views
Is this variant of SRP for peer-to-peer authentication practical?
I'm interested in using a modified form of SRP as a peer-to-peer authentication method. Since neither side is acting as a host, one of the primary design goals for SRP (that the client doesn't need ...
- 829
19
votes
2
answers
1k
views
Is there any SRP-like key exchange only using "standard" cryptographic primitives?
I am looking into PAKEs (password-authenticated key exchanges), and it seems like SRP (Secure Remote Password) is essentially the de-facto standard.
However, implementing SRP actually requires doing ...
- 1,101
8
votes
3
answers
1k
views
Can I use a key-derivation-function as the hash function H in SRP?
In the Secure Remote Password Protocol, the verifier must be stored on the server. In the case of a server compromise, an attacker could obtain these verifiers. If nobody reused passwords, this ...
- 373
5
votes
1
answer
236
views
State level "Weak Diffie-Hellman" working for SRP too?
I've read about the "Weak Diffie-Hellman" attack (paper, website), where a resourceful entity like a state can pre-compute values for known primes to aid solving the discrete logarithm ...
- 153
3
votes
2
answers
474
views
Does impersonating an SRP server give you enough information for an off-line dictionary attack?
In a comment to an answer I wrote to another question, CodesInChaos wrote that:
"Problem with SRP is that an attacker who impersonates a server learns the password hash, enabling offline search.&...
- 45.9k
3
votes
1
answer
246
views
Where is SRP-Z from?
The Stanford license for SRP says:
Broader use of the SRP authentication technology, such as variants
incorporating the use of an explicit server secret (SRP-Z), may
require a license;
Yet I ...
- 655
3
votes
1
answer
703
views
SRP man-in-the-middle
This site suggests that Secure Remote Password protocol is secure when "Attackers can intercept, modify, and forge arbitrary messages between client and server."
However, from a quick reading of the ...
- 165
1
vote
2
answers
525
views
What can I do, if my SRP password verifier was stolen?
I've got a system that works like this:
...
- 267
1
vote
2
answers
206
views
In SRP, is the client protected from server impersonation?
Assume use of SRP over an otherwise insecure unauthenticated channel where
the user running the client side has chosen a password,
the user only uses that password with a trusted SRP client software, ...
- 138k
1
vote
1
answer
254
views
There is a protocol similar to SRP but where a part of the secret is stored on the client side?
SRP is very useful but if our DB is leaked, an attacker could brute force a user's password with his associated salt/verifier found in the DB. I'm searching a solution to prevent this.
My first idea ...
- 51
1
vote
3
answers
864
views
Argon2id internal iterations vs multiple Argon2id calls ?
TLDR;
Is there a security risk if rather than setting the iteration parameter to 12 (for example), we set it to 3 but call the function 4 times?
I'm asking that for 2 reasons:
Firstly, we use SRP ...
- 51