The Secure Remote Password protocol (SRP) is a secure password-based authentication and key-exchange protocol. It solves the problem of authenticating clients to servers securely, in cases where the user of the client software must memorize a small secret (like a password or a passphrase) and where the server carries a verifier for each user, which allows it to authenticate the client but which, if compromised, would not allow the attacker to impersonate the client. In addition, SRP exchanges a cryptographically-strong secret as a byproduct of successful authentication, which enables the two parties to communicate securely.

SRP offers a number of new benefits for password system implementors:

• An attacker with neither the user’s password nor the host’s password file cannot mount a dictionary attack on the password.
• An attacker who captures the host’s password file cannot directly compromise user-to-host authentication and gain access to the host without an expensive dictionary search.
• An attacker who compromises the host does not obtain the the password from a legitimate authentication attempt.
• An attacker who captures the session key cannot use it to mount a dictionary attack on the password.

It is believed that this set of properties is at or near the theoretical limit of security that can be offered by a purely password-based protocol. SRP, which bases its security on the difficulty of solving the Diffie-Hellman problem in the multiplicative field modulo a large safe prime, meets these requirements and does so using only one exponential key exchange round, making it useful for applications in which good performance is an issue. SRP’s security, simplicity, and speed make it ideal for a wide range of real-world applications in which secure password authentication is required. Further technical details of the actual protocol design are available from the Stanford SRP Authentication Project website.

• n - A large prime number
• g - A primitive root modulo n (often called a generator)
• I - The user’s identifier or username
• s - A random string used as the user’s salt
• P - The user’s password
• x - A private key derived from the password and salt
• v - The host’s password verifier
• u - Random scrambling parameter, publicly revealed
• a, b - Ephemeral private keys, generated randomly and not publicly revealed
• A, B - Corresponding public keys
• H( ) - One-way hash function
• K - Session key

The values n and g are well-known values, agreed to beforehand.

The seven steps of SRP-6, from SRP-6: Improvements and Refinements to the Secure Remote Password Protocol by Thomas Wu.

Notes on Clipperz’s implementation

Coming soon …