For a new website (HTTPS with HSTS+HPKP), we would like to restrict login access only on authorized user's devices. For that, there is a WebCrypto ECDSA public/private keys generated on each new device. The server store the public key of the new device and return a device ID. The browser save in an IndexedDB named « device » the private key (not extractable) and the device ID.
When the user register his account or want to authorize a new device, we ask him a password for this device, but we don't want to save his password in server database.
We could use SRP protocol and send the salt & « verifier » to the server, but rather using the user password, we use a derivated password (WebCrypto PBKDF2 or Argon2 library)
Or we could use WebCrypto again to create new ECDSA keys, specific for this user on this device, and send the public key on the server. On the browser, we store in an IndexedDB named « base64(SHA-256(login) » this user private key but encrypted (wrapKey function) with AES-GCM algorithm and for the key we use the user password derivation (WebCrypto PBKDF2 or Argon2 external library). Then to login, the server send a challenge, a simple random string, the client return the signature of this challenge with this new user specific private key (so he need to known the good password to unwrap the key).
If our DataBase is leaked:
With SRP, the verifier can't permit to guess easily the user password, but I suppose we need to ask a new password to all our users.
With WebCrypto, it's only a public key. Users don't need to change their password. EDIT: A downside is it's possible to do multiple passwords check on the client side, for example if I known my victim I could try may be 1000 possible passwords on the JS Console to unwrap the user private key, without the need to contact the server.
Of course, if the IndexedDBs are deleted on the browser, this require for the user to start a process to recover his account (private question, OTP by email, whatever... it's not the subject), but this is not specific to the WebCrypto option, it's also happend for the SRP option because we need to detect the device ID and check their signature to be sure it's a device authorized by the user.
Just for information, we also add U2F after this first authentification challenge.
In my specific case, do you recommend to use SRP challenge or this WebCrypto challenge please?