My customer is currently using Secure Remote Password (with SSL) for authentication. The reason is that he does not want to send the user password on the server-side, to prove no confidential user data is stored on the server-side (only the salt and verifier generated on client-side are stored on the server-side, not the password itself).

Is it a valid reason? If yes, is there any other Authentication mechanism more standard (like OAuth, JWT, etc) that meets the same requirement?

I have a new application to secure, and it is easy to find frameworks which provide out of the box integrations with mechanisms like OAuth, SAML, LDAP, JWT, but no one is supporting SRP. It should be fine, and less harmful for us to use another mechanism other than SRP.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.