7

SRP is short for Secure Remote Password protocol, and provides a better way for passwords to be sent over the internet.

I've read the information at it's Stanford University home page, the Wiki Page, looked at a in-browser demo. I even found a company that uses SRP, read their blog but still can't figure out how to integrate it into my application.

Question

Can someone provide general guidelines on how to implement SRP in a web browser, and what the requirements are?

My ultimate goal is to get this to work in ASP.NET MVC, though that may be a question best suited for Programmers.SE.

Improve this question
6
  • Which criteria make SRP "better" than SSH?
    – Bruno
    Commented Mar 19, 2012 at 12:52
  • 1
    @Bruno - See this: srp.stanford.edu/analysis.html
    – makerofthings7
    Commented Mar 19, 2012 at 13:04
  • 3
    Going from potential issues when using SSH (mostly coming from insufficient care from the user) to saying that SRP is better than SSH is quite a leap. You're comparing two completely different things (SRP is not a remote shell).
    – Bruno
    Commented Mar 19, 2012 at 13:13
  • and the reason for people wanting SRP in javascript is pretty obvious - people still want to protect passwords from sniffers, but WITHOUT the risk of handing untrusted third parties the power to frighten and annoy users away and without the performance hit of encrypting public content! there is no magic one-size-fits all solution that will suit every site!
    – user32950
    Commented Nov 7, 2013 at 18:53
  • 1
    SRP is not a better way to transmit passwords; it is a way to permit password-based authentication without transmitting either the password (and not even a password-equivalent in the sense that what is transmitted is not susceptible to a replay attack).
    – user27909
    Commented Apr 18, 2014 at 9:09

2 Answers 2

Reset to default
2

It can't. Browsers don't support SRP. To use SRP, both the browser and the site needs to support it. Until browsers support SRP, there's nothing you can do as a site operator to deploy it to protect your website.

Improve this answer
1
  • This is a somewhat unhelpful answer. Because if development, maintenance, and complexity are acceptably low, you'd want to support it on your website before browsers support it. That way, when browsers start supporting it, your users immediately benefit (and people can point browser developers at websites that support it as an argument for adding support for it).
    – mtraceur
    Commented Aug 21, 2020 at 19:03
8

SRP is being implemented into SSL, so browsers are beginning to support it. Another option (albeit, much slower) is to run SRP in Javascript. Since the server supplies the javascript code, however, this is an attack point. So, it would have to be delivered over SSL, and the client must trust the server, which makes SRP with Javascript less than ideal.

There is more information on using SRP with OpenSSL, which seems fairly current.

For more information:
https://stackoverflow.com/q/2778629
http://srp.stanford.edu/download.html (includes patches for OpenSSL) http://en.wikipedia.org/wiki/Secure_Remote_Password_protocol#Real_world_implementations
http://trustedhttp.org/wiki/Main_Page (has information on chrome and firefox support)

Improve this answer
10
  • SRP in javascript didn't seem to work at all in Chrome. Though IE did prompt me to permit "Java" ... strange
    – makerofthings7
    Commented Mar 18, 2012 at 18:39
  • @makerofthings7, from what I saw in the last link I posted, it looks like chrome supports srp-tls
    – mikeazo
    Commented Mar 18, 2012 at 18:41
  • 3
    I don't understand why anyone would deploy SRP in Javascript. What is the security threat that it is trying to defend against? If the server is malicious or compromised, it can send malicious Javascript that captures your password, so it doesn't help protect against a compromised server. If the server is not compromised, and if you're using SSL, then SRP in Javascript doesn't seem to have any security benefit over just sending a username and password over SSL and handling it appropriately on the server side.
    – D.W.
    Commented Mar 19, 2012 at 0:23
  • 1
    @makerofthings7, SRP does not provide resistance to dictionary attacks against an attacker who gains read-only access to the database. SRP stores what is essentially a hash of your password in the database. As far as a shared secret key after authentication, that is already provided by the standard approach of sending a username/password over SSL.
    – D.W.
    Commented Mar 19, 2012 at 1:57
  • 1
    "SRP does not provide resistance to dictionary attacks against an attacker who gains read-only access to the database." Indeed. If a database of users is "resistant to dictionary attacks", it means it cannot even be used to verify user passwords. IOW, this database is useless.
    – curiousguy
    Commented Jul 12, 2012 at 22:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .