Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to implement the SRP crypto; 6a. However I'm not familiar with the cryptography and it's computing. I'm using the public implementation of the BouncyCastle lib, but I have no idea how it works actually. It's for a "private" server for a game and I'm kinda stuck now.

share|improve this question
Do you need to conform to a pre-existing binary protocol? SRP by itself is just a mathematical protocol. – CodesInChaos May 3 '12 at 15:22
No just plain SRP with a different K compution. – John May 3 '12 at 15:34

Implementating your own authentication protocol is not easy and should be left to professionals. If you feel like you have to write your own security protocol, you are doing it wrong. A lot of other people have this same need, and they have already implemented it for you.

SRP isn't a bad choice for authentication, in fact there is SRP-TLS, which uses SRP to create a TLS connection. SRP-TLS has been implemented in OpenSSL and bindings for this library exist for C#.

Also keep in mind, that the password itself isn't how the client maintains its authenticated state. For example, in a web application a user logs in with a username and password and they are given a cookie to authenticate with the web application. If the attacker obtains this cookie, then can login. To prevent this, the entire session (or in your case the entire game) must be protected with TLS, or you will be in violation of OWASP a9 and anyone sniffing the wire can just wander into the game.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.