Questions tagged [srp]

Secure Remote Password (SRP) is a password-authenticated key agreement protocol.

0
votes
1answer
86 views

Implementing SRP without storing the salt anywhere

I am attempting to use SRP to verify clients when they authenticate with a webserver, so that the password is never sent over the wire. Looking at the SRP procedure, when a client registers with the ...
2
votes
0answers
113 views

Authentication mechanism without sending password on server-side

My customer is currently using Secure Remote Password (with SSL) for authentication. The reason is that he does not want to send the user password on the server-side, to prove no confidential user ...
3
votes
1answer
781 views

Why isn't Secure Remote Password protocol being used in REST APIs?

I have seen a few samples of SRP protocol used for web applications and I wonder why nobody ever uses it for RESTful authentication. I have done some research and I couldn't find any single example, ...
1
vote
1answer
60 views

There is a recommanded solution to protect SRP verifier to be used if the DB is leaked?

We working on a new website we would like to use SRP protocol. So the salt and verifier are sent to the server, and in theory the server store them like that in a database. If the DB is leaked, ...
4
votes
1answer
198 views

SRP or WebCrypto challenge?

For a new website (HTTPS with HSTS+HPKP), we would like to restrict login access only on authorized user's devices. For that, there is a WebCrypto ECDSA public/private keys generated on each new ...
1
vote
1answer
238 views

SRP cipher suite

From this I understand that SRP is an algorithm that performs authentication and key exchange between a client and a server. Consider two cipher suites like the following two, which algorithm would ...
0
votes
1answer
195 views

TLS: is authentication and forward secrecy possible without PKI?

Im making a project that consist of a client/server system that requires TLS without PKI.. Design Requirements: The client MUST authenticate that it's communicating with 'THE' server The server ...
1
vote
0answers
43 views

SRP and compromised verifier [closed]

Let's assume that attacker knows verifier, so now he can commit MitM attack. 1) Client sends A to Server 2) MITM takes it and sends B to client While MITM knows the verifier, he also can compute ...
6
votes
2answers
152 views

Will OpenSSL's TLS-SRP still provide PFS if all credentials are public?

The obvious go-to for PFS is DHE (or ECDHE). But I'm wondering if using tls-srp but with fixed (and therefore can be considered publicly known) credentials can achieve PFS as well. I suspect this is ...
2
votes
2answers
247 views

Could PKE be used as a better alternative to SRP for authentication?

If I understood SRP correctly, its weakpoint is during the registration of a user when sending the verifier to the server. Let's say the Server knows the PubKey(User) of the User and the User knows ...
7
votes
1answer
136 views

Forcing new password with zero-knowledge proof authentications

Let's say a ZKP (e.g. SRP6a) is used, for password verification. Let's say I need to force a user to change their password (so I have the salt and the verifier for the current password). For this, ...
1
vote
0answers
170 views

Questions about SRP algorithm

I trying to use SRP algorithm but I have some questions: Is that a good choice to use for registration and authorization SRP algorithm with SSL/TLS? And for all other transmission using just SSL/TLS? ...
1
vote
1answer
149 views

SRP in local, private wireless network

i am trying to secure the connection between a single-page webApp (angularJS, loaded from a secure source via SSL) to a local server (called BOX) inside the private, local wifi of the user. So the ...
4
votes
1answer
300 views

Feeding PBKDF2 to SRP verifier creation

There is an older game that solely uses UDP to communicate, and I wanted to add password authentication to the game to facilitate things like experience points and rankings. To this end, I decided to ...
1
vote
1answer
187 views

What is the purpose of “g” -> generator of the multiplicative group

I am currently beginning to studying the different security protocols and came across the SRP secure remote password protocol. I manage to understand the mathematic formulas behind it and the ...
1
vote
1answer
353 views

Advantages of TLS-SRP when the secret must be exchanged online?

I've got some practical questions about SRP when the shared secret must be established online. Is there a way to establish the shared secret online without the use of HTTPS? If you've already used ...
1
vote
1answer
689 views

What's the advantage of TLS-SRP over self-signed certificates?

According to https://security.stackexchange.com/a/2531/5002 TLS-SRP allows one to authenticate a client or server without third-party certificates because it uses a shared secret. If you're going to ...
3
votes
4answers
550 views

How do clients enroll using SRP?

From what I understand, one of the benefits or Secure Remote Password (SRP) is that is does not require reliance on certificate authorities. In a scenario where clients need the ability to register as ...
2
votes
1answer
416 views

Any good tutorials / libaries for implementing TLS-SRP? [closed]

In this thread, Tom Ptacek explains what Password-Authenticated Key Exchanges are, and it got me really interested in them. If I'd like to start learning about how to build them into real world ...
1
vote
1answer
91 views

Hardening an old SRP3 protocol setup

This is the situation: client-server login is done via SRP3, hash used is single SHA1. Client cannot be modified but server can (open source). Because of this, all hashed passwords in the database are ...
13
votes
3answers
737 views

Can I use the same password both for SRP and for client-side encryption?

Suppose a less-than-trusted server is used to store users' confidential data (encrypted at the client side), and both tasks - authentication and encryption/decryption - should be doable with a single ...