Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

SRP is short for Secure Remote Password protocol, and provides a better way for passwords to be sent over the internet.

I've read the information at it's Stanford University home page, the Wiki Page, looked at a in-browser demo. I even found a company that uses SRP, read their blog but still can't figure out how to integrate it into my application.


Can someone provide general guidelines on how to implement SRP in a web browser, and what the requirements are?

My ultimate goal is to get this to work in ASP.NET MVC, though that may be a question best suited for Programmers.SE.

share|improve this question
Which criteria make SRP "better" than SSH? –  Bruno Mar 19 '12 at 12:52
@Bruno - See this: srp.stanford.edu/analysis.html –  makerofthings7 Mar 19 '12 at 13:04
Going from potential issues when using SSH (mostly coming from insufficient care from the user) to saying that SRP is better than SSH is quite a leap. You're comparing two completely different things (SRP is not a remote shell). –  Bruno Mar 19 '12 at 13:13
and the reason for people wanting SRP in javascript is pretty obvious - people still want to protect passwords from sniffers, but WITHOUT the risk of handing untrusted third parties the power to frighten and annoy users away and without the performance hit of encrypting public content! there is no magic one-size-fits all solution that will suit every site! –  user32950 Nov 7 '13 at 18:53
SRP is not a better way to transmit passwords; it is a way to permit password-based authentication without transmitting either the password (and not even a password-equivalent in the sense that what is transmitted is not susceptible to a replay attack). –  pyramids Apr 18 at 9:09

2 Answers 2

up vote 2 down vote accepted

It can't. Browsers don't support SRP. To use SRP, both the browser and the site needs to support it. Until browsers support SRP, there's nothing you can do as a site operator to deploy it to protect your website.

share|improve this answer

SRP is being implemented into SSL, so browsers are beginning to support it. Another option (albeit, much slower) is to run SRP in Javascript. Since the server supplies the javascript code, however, this is an attack point. So, it would have to be delivered over SSL, and the client must trust the server, which makes SRP with Javascript less than ideal.

There is more information on using SRP with OpenSSL, which seems fairly current.

For more information:
http://srp.stanford.edu/download.html (includes patches for OpenSSL) http://en.wikipedia.org/wiki/Secure_Remote_Password_protocol#Real_world_implementations
http://trustedhttp.org/wiki/Main_Page (has information on chrome and firefox support)

share|improve this answer
SRP in javascript didn't seem to work at all in Chrome. Though IE did prompt me to permit "Java" ... strange –  makerofthings7 Mar 18 '12 at 18:39
@makerofthings7, from what I saw in the last link I posted, it looks like chrome supports srp-tls –  mikeazo Mar 18 '12 at 18:41
Yes, I would like to find a working implementation that uses httpsv as in "httpsv://tls-srp.test.trustedhttp.org" , but that link didn't work with my default settings (not sure if I need Dev mode) –  makerofthings7 Mar 18 '12 at 18:43
I don't understand why anyone would deploy SRP in Javascript. What is the security threat that it is trying to defend against? If the server is malicious or compromised, it can send malicious Javascript that captures your password, so it doesn't help protect against a compromised server. If the server is not compromised, and if you're using SSL, then SRP in Javascript doesn't seem to have any security benefit over just sending a username and password over SSL and handling it appropriately on the server side. –  D.W. Mar 19 '12 at 0:23
@makerofthings7, SRP does not provide resistance to dictionary attacks against an attacker who gains read-only access to the database. SRP stores what is essentially a hash of your password in the database. As far as a shared secret key after authentication, that is already provided by the standard approach of sending a username/password over SSL. –  D.W. Mar 19 '12 at 1:57

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.