The tag has no wiki summary.

learn more… | top users | synonyms

2
votes
1answer
31 views

Feeding PBKDF2 to SRP verifier creation

There is an older game that solely uses UDP to communicate, and I wanted to add password authentication to the game to facilitate things like experience points and rankings. To this end, I decided to ...
1
vote
1answer
65 views

What is the purpose of “g” -> generator of the multiplicative group

I am currently beginning to studying the different security protocols and came across the SRP secure remote password protocol. I manage to understand the mathematic formulas behind it and the ...
0
votes
1answer
64 views

Advantages of TLS-SRP when the secret must be exchanged online?

I've got some practical questions about SRP when the shared secret must be established online. Is there a way to establish the shared secret online without the use of HTTPS? If you've already used ...
1
vote
1answer
86 views

What's the advantage of TLS-SRP over self-signed certificates?

According to http://security.stackexchange.com/a/2531/5002 TLS-SRP allows one to authenticate a client or server without third-party certificates because it uses a shared secret. If you're going to ...
2
votes
2answers
126 views

How do clients enroll using SRP?

From what I understand, one of the benefits or Secure Remote Password (SRP) is that is does not require reliance on certificate authorities. In a scenario where clients need the ability to register as ...
1
vote
1answer
121 views

Any good tutorials / libaries for implementing TLS-SRP? [closed]

In this thread, Tom Ptacek explains what Password-Authenticated Key Exchanges are, and it got me really interested in them. If I'd like to start learning about how to build them into real world ...
1
vote
1answer
66 views

Hardening an old SRP3 protocol setup

This is the situation: client-server login is done via SRP3, hash used is single SHA1. Client cannot be modified but server can (open source). Because of this, all hashed passwords in the database are ...
11
votes
3answers
427 views

Can I use the same password both for SRP and for client-side encryption?

Suppose a less-than-trusted server is used to store users' confidential data (encrypted at the client side), and both tasks - authentication and encryption/decryption - should be doable with a single ...