As an amateur cryptographer and professional slowpoke, I just learned about SRP (and other PAKE protocols), and my thoughts immediately wandered to asymmetric crypto challenge protocols, like WebAuthn(/Passkeys/FIDO/CTAP, whatever the name of the month is right now).

I'm of course aware that asymmetric ciphers can do much more than what SRP can do, but in the limited context of just signing a challenge to prove possession of the private key, it seems to me that SRP has a ton of similarities. It seems to me that you could easily consider the password to be the private key, and the verifier as the public key, and it would basically work the same way, in that the random numbers generated for each login session in SRP would take the place of the challenge. Except in one important regard: The private key can be any data, rather than something with very specific mathematical properties like a valid elliptic curve point.

The core of my question boils down to something like this: Would WebAuthn have been strictly better off if it had used a PAKE protocol instead of an asymmetric cipher signature? If it had done that, it would extend the scope of WebAuthn to also be able to handle more secure password logins, while it would still be just as capable of handling hardware-bound credentials (a FIDO hardware key could simply use a string of random-generated bytes as "password").

Are my conclusions valid, or does SRP (and/or other PAKE-based protocols) have other security aspects that I'm not aware of that would make them different in some important regard in this role?


1 Answer 1


I'm not a specialist but I can bring some insights and some light on this question that is Google trend :

  • ECDH uses keys that needs to be transmit to every system the user wants to access its assets.
  • SRP uses password to perform the workflow and therefore the user can remember the password without the obvious problem of password stealing. However those algorithms are subject to precomputed attacks unlike OPAQUE which is still in paperwork at IETF.
  • FIDO on its own does not send the key to the user and is therefore completely immune to phishings. But you need to always have the (USB) key.

So I don't think there is such huge differences outside mathematical operations and depends on what kind of users you are targeting. And as already said, it will authenticate both client and server, something that can already be achieved using TLS on websites as long as PKI is secured.

  • Welcome to the community. Please separate your unrelated topics to other separate questions, it's hard to comprehend what you're actually asking when you topic-hop like that... Aug 28, 2023 at 18:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .