Collaborate Disseminate
As an amateur cryptographer and professional slowpoke, I just learned about SRP (and other PAKE protocols), and my thoughts immediately wandered to asymmetric crypto challenge protocols, like WebAuthn(/Passkeys/FIDO/CTAP, whatever the name… Continue reading Is SRP/PAKE equivalent to an asymmetric crypto challenge?
I’ve been reading up a bit on zero-knowledge proofs and how they are applied to authentication, specifically the PAKE protocol and the SRP and OPAQUE implementations. From my (limited) understanding this seems similar to Public Key authent… Continue reading Public key authentication as zero-knowledge proof?
I’m currently trying to come up with an authentication process for an Android app, that talks with web backend using REST. At the moment the communication is secured by TLS (with cert pinning) and auth tokens – former makes the client trus… Continue reading SRP authentication in an Android app over REST
In the case of a password hashing function like Argon2, I know that when a weakness is found, you use another password hashing function, wrap it around the existing hashes and calculate the hash of the password directly when the user logs … Continue reading PAKE – What to do when a weakness is found?
First post, not a crypto expert. 🙂
TLDR
Is it wise to use SRP to implement app-level "passkey entry" pairing in Bluetooth LE? There are known issues with using fixed passkeys in BLE, even with LE Secure Connections.
Background
A… Continue reading Fixing BLE Passkey Entry with SRP
I have been reading into PAKE protocols, specifically starting with SRP RFC2945
The gist of the requirement on the server is that the server saves triplet (username, verifier (v), salt (s)) in the credentials table.
Where verifier v = g^… Continue reading How do SRP (and PAKE generally) protect against verifier leak
SRP (secure remote password) needs an exchange of hash signatures to verify that both parties have the same shared key (RFC2945):
At this point, the client and server should have a common session key
that is secure (i.e. not known… Continue reading SRP confirmation of shared keys
I have developed a TLS 1.3, PKI based communication module with OpenSSL for a SCADA system. I intend to broaden the security of this system by implementing some kind of access control. My goal is to be able to set the privile… Continue reading How to develop the access control/authorization of a TLS 1.3 based system?
I am attempting to use SRP to verify clients when they authenticate with a webserver, so that the password is never sent over the wire.
Looking at the SRP procedure, when a client registers with the server it sends v (verifi… Continue reading Implementing SRP without storing the salt anywhere
My customer is currently using Secure Remote Password protocol (with SSL) for authentication. The reason is because he does not want to send the user password on server side, to prove no confidential user data is stored on se… Continue reading Authentication protocol without sending password on server side