Questions tagged [srp]

The “secure remote password protocol” is a modern cryptographic protocol for password authenticated key exchange (PAKE). It provides some desireable properties, like a passive eavesdropper being unable to brute-force the password. It is usually used to derive shared session keys from passwords and authenticate users with passwords.

Filter by
Sorted by
Tagged with
12
votes
3answers
9k views

What should be the size of a Diffie-Hellman private key?

I'm implementing the SRP-6 protocol, which relies on discrete logarithms for it's security (essentially Diffie-Hellman). The RFC documents state: The private values $a$ and $b$ SHOULD be at least ...
9
votes
1answer
1k views

How realistic is a dictionary attack on a secure remote password protocol (SRP) verifier?

I'm deploying a secure remote password protocol implementation and I'm wondering what the consequences are when the client generated verifier gets leaked to an attacker. I've read Thomas Wu's paper ...
18
votes
7answers
8k views

Why is SRP not widely used?

SRP seems to be a very good password authentication protocol, compared to any other things used now. So why is there no popular implementations, or even no working secure implementations? I tried to ...
8
votes
1answer
1k views

Why does SRP-6a use k = H(N, g) instead of the k = 3 in SRP-6?

I've been reading up on the Secure Remote Pasword protocol (SRP). There are a couple different versions of the protocol (the original published version being designated SRP-3, with two subsequent ...
1
vote
1answer
342 views

Is this variant of SRP for peer-to-peer authentication practical?

I'm interested in using a modified form of SRP as a peer-to-peer authentication method. Since neither side is acting as a host, one of the primary design goals for SRP (that the client doesn't need ...
4
votes
1answer
327 views

Which version(s) of SRP are in ISO/IEC 11770-4:2006?

I am on the impression that SRP emerges as the least uncommon and best analyzed protocol for authentication and key agreement based on a short password. This states that SRP is part of IEC 11770-4, ...
17
votes
2answers
686 views

Is there any SRP-like key exchange only using “standard” cryptographic primitives?

I am looking into PAKEs (password-authenticated key exchanges), and it seems like SRP (Secure Remote Password) is essentially the de-facto standard. However, implementing SRP actually requires doing ...
8
votes
3answers
1k views

Can I use a key-derivation-function as the hash function H in SRP?

In the Secure Remote Password Protocol, the verifier must be stored on the server. In the case of a server compromise, an attacker could obtain these verifiers. If nobody reused passwords, this ...
1
vote
2answers
227 views

What can I do, if my SRP password verifier was stolen?

I've got a system that works like this: ...
1
vote
1answer
169 views

There is a protocol similar to SRP but where a part of the secret is stored on the client side?

SRP is very useful but if our DB is leaked, an attacker could brute force a user's password with his associated salt/verifier found in the DB. I'm searching a solution to prevent this. My first idea ...
3
votes
1answer
222 views

Where is SRP-Z from?

The Stanford license for SRP says: Broader use of the SRP authentication technology, such as variants incorporating the use of an explicit server secret (SRP-Z), may require a license; Yet I ...
3
votes
2answers
389 views

Does impersonating an SRP server give you enough information for an off-line dictionary attack?

In a comment to an answer I wrote to another question, CodesInChaos wrote that: "Problem with SRP is that an attacker who impersonates a server learns the password hash, enabling offline search." ...
1
vote
2answers
389 views

Argon2id internal iterations vs multiple Argon2id calls ?

TLDR; Is there a security risk if rather than setting the iteration parameter to 12 (for example), we set it to 3 but call the function 4 times? I'm asking that for 2 reasons: Firstly, we use SRP ...
1
vote
2answers
105 views

In SRP, is the client protected from server impersonation?

Assume use of SRP over an otherwise insecure unauthenticated channel where the user running the client side has chosen a password, the user only uses that password with a trusted SRP client software, ...