Secure Remote Password protocol

<h2 id="overview">Overview</h2>
The SRP protocol has a number of desirable properties: it allows a user to authenticate themselves to a server, it is resistant to <a href="/facts/Dictionary_attack/0DdvVvBM">dictionary attacks</a> mounted by an eavesdropper, and it does not require a <a href="/facts/Trusted_third_party/VdPm949G">trusted third party</a>. It effectively conveys a <a href="/facts/Zero-knowledge_password_proof/vgebecKq">zero-knowledge password proof</a> from the user to the server. In revision 6 of the protocol only one password can be guessed per connection attempt. One of the interesting properties of the protocol is that even if one or two of the cryptographic primitives it uses are attacked, it is still secure. The SRP protocol has been revised several times, and is currently at revision 6a.
The SRP protocol creates a large private key shared between the two parties in a manner similar to <a href="/facts/Diffie%25E2%2580%2593Hellman_key_exchange/xR4YQcaD">Diffie–Hellman key exchange</a> based on the client side having the user password and the server side having a <a href="/facts/Cryptography/e94PEVau">cryptographic</a> verifier derived from the password. The shared public key is derived from two random numbers, one generated by the client, and the other generated by the server, which are unique to the login attempt. In cases where encrypted communications as well as authentication are required, the SRP protocol is more secure than the alternative <a href="/facts/Secure_Shell/wjVRw5zv">SSH</a> protocol and faster than using <a href="/facts/Diffie%25E2%2580%2593Hellman_key_exchange/xR4YQcaD">Diffie–Hellman key exchange</a> with signed messages. It is also independent of third parties, unlike <a href="/facts/Kerberos_(protocol)/RMXs3P1w">Kerberos</a>.
The SRP protocol, version 3 is described in RFC 2945. SRP version 6a is also used for strong password authentication in <a href="/facts/Transport_Layer_Security/pGy16TnA">SSL/TLS</a><a class="footnote-ref" id="fnref:6" href="#fn:6">6</a> (in <a href="/facts/TLS-SRP/6b76S7MT">TLS-SRP</a>) and other standards such as <a href="/facts/Extensible_Authentication_Protocol/yuCAFHxC">EAP</a><a class="footnote-ref" id="fnref:7" href="#fn:7">7</a> and <a href="/facts/Security_Assertion_Markup_Language/HbCY4ge6">SAML</a>, and is part of <a href="/facts/IEEE_P1363/pEjW4GjI">IEEE 1363.2</a> and ISO/IEC 11770-4.

<h2 id="protocol">Protocol</h2>
The following notation is used in this description of the protocol, version 6:

<ul><li>q and N = 2q + 1 are chosen such that both are prime (which makes q a <a href="/facts/Sophie_Germain_prime/d4pApf8z">Sophie Germain prime</a> and N a <a href="/facts/Safe_prime/d4pApf8z">safe prime</a>). N must be large enough so that computing discrete logarithms modulo N is infeasible.</li>
<li>All arithmetic is performed in the <a href="/facts/Ring_of_integers/KEzxxMbh">ring of integers</a> modulo N, 
 
 
 
 
 
 
 Z
 
 
 N
 
 
 
 
 
 {\displaystyle \scriptstyle \mathbb {Z} _{N}}
 
. This means that below gx should be read as gxmod N</li>
<li>g is a <a href="/facts/Multiplicative_group_of_integers_modulo_n/IACS6cgH">generator of the multiplicative group 
 
 
 
 
 
 
 Z
 
 
 N
 
 
 ∗
 
 
 
 
 
 {\displaystyle \scriptstyle \mathbb {Z} _{N}^{*}}
 
</a>.</li>
<li>H() is a <a href="/facts/Cryptographic_hash_function/cuxkgbST">hash</a> function; e.g., SHA-256.</li>
<li>k is a parameter derived by both sides; in SRP-6, k = 3, while in SRP-6a it is derived from N and g : k = H(N, g). It is used to prevent a 2-for-1 guess when an active attacker impersonates the server.<a class="footnote-ref" id="fnref:8" href="#fn:8">8</a><a class="footnote-ref" id="fnref:9" href="#fn:9">9</a></li>
<li>s is a <a href="/facts/Salt_(cryptography)/9g6l177I">salt</a>.</li>
<li>I is an identifying username.</li>
<li>p is the user's password.</li>
<li>v is the host's password verifier, v = gx where at a minimum x = H(s, p). As x is only computed on the client it is free to choose a stronger algorithm. An implementation could choose to use x = H(s | I | p) without affecting any steps required of the host. The standard <a href="https://tools.ietf.org/html/rfc2945">RFC2945</a> defines x = H(s | H ( I | ":" | p) ). Use of I within x avoids a malicious server from being able to learn if <a href="https://crypto.stackexchange.com/a/9430">two users share the same password</a>.</li>
<li>A and B are random one time ephemeral keys of the user and host respectively.</li>
<li>| (pipe) denotes concatenation.</li></ul>
All other variables are defined in terms of these.
First, to establish a password p with server Steve, client Carol picks a random <a href="/facts/Salt_(cryptography)/9g6l177I">salt</a> s, and computes x = H(s, p), v = gx. Steve stores v and s, indexed by I, as Carol's password verifier and salt. Carol must not share x with anybody, and must safely erase it at this step, because it is <a href="/facts/Pass_the_hash/es1D51Rt">equivalent</a> to the plaintext password p. This step is completed before the system is used as part of the user registration with Steve. Note that the salt s is shared and exchanged to negotiate a session key later so the value could be chosen by either side but is done by Carol so that she can register I, s and v in a single registration request. The transmission and authentication of the registration request is not covered in SRP.
Then to perform a proof of password at a later date the following exchange protocol occurs:

<ol><li>Carol → Steve: generate random value a; send I and A = ga</li>
<li>Steve → Carol: generate random value b; send s and B = kv + gb</li>
<li>Both: u = H(A, B)</li>
<li>Carol: SCarol = (B − kgx)(a + ux) = (kv + gb − kgx)(a + ux) = (kgx − kgx + gb)(a + ux) = (gb)(a + ux)</li>
<li>Carol: KCarol = H(SCarol)</li>
<li>Steve: SSteve = (Avu)b = (gavu)b = [ga(gx)u]b = (ga + ux)b = (gb)(a + ux)</li>
<li>Steve: KSteve = H(SSteve) = KCarol</li></ol>
Now the two parties have a shared, strong session key K. To complete authentication, they need to prove to each other that their keys match. One possible way is as follows:

<ol><li>Carol → Steve: M1 = H[H(N) <a href="/facts/XOR/FHyr7hGQ">XOR</a> H(g) | H(I) | s | A | B | KCarol]. Steve verifies M1.</li>
<li>Steve → Carol: M2 = H(A | M1 | KSteve). Carol verifies M2.</li></ol>
This method requires guessing more of the shared state to be successful in impersonation than just the key. While most of the additional state is public, private information could safely be added to the inputs to the hash function, like the server private key.
Alternatively, in a password-only proof the calculation of K can be skipped and the shared S proven with:

<ol><li>Carol → Steve: M1 = H(A | B | SCarol). Steve verifies M1.</li>
<li>Steve → Carol: M2 = H(A | M1 | SSteve). Carol verifies M2.</li></ol>
When using SRP to negotiate a shared key K which will be immediately used after the negotiation, it is tempting to skip the verification steps of M1 and M2. The server will reject the very first request from the client which it cannot decrypt. This can however be dangerous as demonstrated in the Implementation Pitfalls section below.
The two parties also employ the following safeguards:

<ol><li>Carol will abort if she receives B = 0 (mod N) or u = 0.</li>
<li>Steve will abort if he receives A (mod N) = 0.</li>
<li>Carol must show her proof of K (or S) first. If Steve detects that Carol's proof is incorrect, he must abort without showing his own proof of K (or S)</li></ol>
<h3>Example code in Python</h3>
"""
An example SRP authentication

WARNING: Do not use for real cryptographic purposes beyond testing.
WARNING: This below code misses important safeguards. It does not check A, B, and U are not zero.

based on http://srp.stanford.edu/design.html
"""
import hashlib
import random

# Note: str converts as is, str([1,2,3,4]) will convert to "[1,2,3,4]"
def H(*args) -> int:
    """A one-way hash function."""
    a = ":".join(str(a) for a in args)
    return int(hashlib.sha256(a.encode("utf-8")).hexdigest(), 16)

def cryptrand(n: int = 1024):
    return random.SystemRandom().getrandbits(n) % N

# A large safe prime (N = 2q+1, where q is prime)
# All arithmetic is done modulo N
# (generated using "openssl dhparam -text 1024")
N = """00:c0:37:c3:75:88:b4:32:98:87:e6:1c:2d:a3:32:
       4b:1b:a4:b8:1a:63:f9:74:8f:ed:2d:8a:41:0c:2f:
       c2:1b:12:32:f0:d3:bf:a0:24:27:6c:fd:88:44:81:
       97:aa:e4:86:a6:3b:fc:a7:b8:bf:77:54:df:b3:27:
       c7:20:1f:6f:d1:7f:d7:fd:74:15:8b:d3:1c:e7:72:
       c9:f5:f8:ab:58:45:48:a9:9a:75:9b:5a:2c:05:32:
       16:2b:7b:62:18:e8:f1:42:bc:e2:c3:0d:77:84:68:
       9a:48:3e:09:5e:70:16:18:43:79:13:a8:c3:9c:3d:
       d0:d4:ca:3c:50:0b:88:5f:e3"""
     
N = int("".join(N.split()).replace(":", ""), 16)
g = 2  # A generator modulo N

k = H(N, g) # Multiplier parameter (k=3 in legacy SRP-6)

F = '#0x' # Format specifier

print("#. H, N, g, and k are known beforehand to both client and server:")
print(f'{H = }\n{N = :{F}}\n{g = :{F}}\n{k = :{F}}')

print("\n0. server stores (I, s, v) in its password database")

# The server must first generate the password verifier
I = "person"        # Username
p = "password1234"  # Password
s = cryptrand(64)   # Salt for the user
x = H(s, I, p)      # Private key
v = pow(g, x, N)    # Password verifier

print(f'{I = }\n{p = }\n{s = :{F}}\n{x = :{F}}\n{v = :{F}}')

# 0. server stores(I, s, v) in its password database
# I = 'person'
# p = 'password1234'
# s = 0x67bc8932cfd26a49
# x = 0x98a4bce8dde877762a90222f1a1161eba9248590a47eb83aa9e5bd7ecda5368d
# v = 0xa7e2038e675d577ac0f318999cab67bba7ec2daf45d2d09f7911b1b78d2fc7f963cd0ac8f17851e0516f059e453672c3b70fcecf5f6843180b271abdd01f552ccda7b24fe4719336409cbc1352f8517be651b8935cc0b74ff2819fa07a3f031537d4cfd9f8df7b788a5f2f88e1cd4106b35c38b3d7205a

# <demo> --- stop ---

print("\n1. client sends username I and public ephemeral value A to the server")
a = cryptrand()
A = pow(g, a, N)
print(f"{I = }\n{A = :{F}}")  # client->server (I, A)

# 1. client sends username I and public ephemeral value A to the server
# I = 'person'
# A = 0x678556a7e76581e051af656e8cee57ae46df43f1fce790f7750a3ec5308a85da4ec4051e5cb74d3e463685ee975a2747cf49035be67c931b56e793f23ea3524af8909dcfbc8675d872361025bf884778587ac49454a57c53a011ac2be2839bfb51bf7847a49a483aba870dc7a8b467a81cec91b8ae7813

# <demo> --- stop ---

print("\n2. server sends user's salt s and public ephemeral value B to client")
b = cryptrand()
B = (k * v + pow(g, b, N)) % N
print(f"{s = :{F}}\n{B = :{F}}")  # server->client (s, B)

# 2. server sends user's salt s and public ephemeral value B to client
# s = 0x67bc8932cfd26a49
# B = 0xb615a0a5ea6abf138077bbd869f6a8da37dfc0b7e06a9f5fac5c1e4109c6302cb3e94dcc2cc76da7b3d87d7e9b68a1db998ab239cfde609f3f7a1ece4a491ce3d9a665c20cf4e4f06730daaa8f52ed61e45bbb67cdc337bf648027ffa7f0f215d5ebe43f9f51832518f1142266aae0dfa960e0082b5154

# <demo> --- stop ---

print("\n3. client and server calculate the random scrambling parameter")
u = H(A, B)  # Random scrambling parameter
print(f"{u = :{F}}")

# 3. client and server calculate the random scrambling parameter
# u = 0x796b07e354c04f672af8b76a46560655086355a9bbce11361f01b45d991c0c52

# <demo> --- stop ---

print("\n4. client computes session key")
x = H(s, I, p)
S_c = pow(B - k * pow(g, x, N), a + u * x, N)
K_c = H(S_c)
print(f"{S_c = :{F}}\n{K_c = :{F}}")

# 4. client computes session key
# S_c = 0x699170aff6e9f08ed09a1dff432bf0605b8bcba05aadcaeea665757d06dbda4348e211d16c10ef4678585bcb2809a83c62b6c19d97901274ddafd4075f90604c06baf036af587af8540342b47867eaa22b9ca5e35ac14c8e85a0c4e623bd855828dffd513cea4d829c407137a0dd81ab4cde8a904c45cc
# K_c = 0x43f8df6e1d2ba762948c8316db5bf03a7af49391742f5f51029630711c1671e

# <demo> --- stop ---

print("\n5. server computes session key")
S_s = pow(A * pow(v, u, N), b, N)
K_s = H(S_s)
print(f"{S_s = :{F}}\n{K_s = :{F}}")

# 5. server computes session key
# S_s = 0x699170aff6e9f08ed09a1dff432bf0605b8bcba05aadcaeea665757d06dbda4348e211d16c10ef4678585bcb2809a83c62b6c19d97901274ddafd4075f90604c06baf036af587af8540342b47867eaa22b9ca5e35ac14c8e85a0c4e623bd855828dffd513cea4d829c407137a0dd81ab4cde8a904c45cc
# K_s = 0x43f8df6e1d2ba762948c8316db5bf03a7af49391742f5f51029630711c1671e

# <demo> --- stop ---

print("\n6. client sends proof of session key to server")
M_c = H(H(N) ^ H(g), H(I), s, A, B, K_c)
print(f"{M_c = :{F}}")
# client->server (M_c) ; server verifies M_c

# 6. client sends proof of session key to server
# M_c = 0x75500df4ea36e06406ac1f8a8241429b8e90a8cba3adda3405c07f19ea3101e8

# <demo> --- stop ---

print("\n7. server sends proof of session key to client")
M_s = H(A, M_c, K_s)
print(f"{M_s = :{F}}")
# server->client (M_s) ;  client verifies M_s

# 7. server sends proof of session key to client
# M_s = 0x182ed24d1ad2fb55d2268c46b42435d1ef02e0fc49f647c03dab8b2a48b0bd3d

<h2 id="implementation-pitfalls">Implementation pitfalls</h2>
<h3>Offline bruteforce attack with server-first messaging in the absence of key verification</h3>
If the server sends an encrypted message without waiting for verification from the client then an attacker is able to mount an offline bruteforce attack similar to hash cracking. This can happen if the server sends an encrypted message in the second packet alongside the salt and B or if key verification is skipped and the server (rather than the client) sends the first encrypted message. This is tempting as after the very first packet, the server has every information to compute the shared key K.
The attack goes as follow:

<ol><li>Carol → Steve: generate random value a; send I and A = ga</li>
<li>Steve: u = H(A, B); S=Avu; K=H(S)</li>
<li>Steve: generate message m and encrypts it to produce c=ENC(K,m)</li>
<li>Steve → Carol: generate random value b; send s, B = kv + gb and c</li></ol>
Carol doesn't know x or v. But given any password p she can compute:

<ul><li>xp = H(salt, p)</li>
<li>Sp = (B - kgxp)(a + uxp)</li>
<li>Kp = H(Sp)</li></ul>
Kp is the key that Steve would use if p was the expected password. All values required to compute Kp are either controlled by Carol or known from the first packet from Steve. Carol can now try to guess the password, generate the corresponding key, and attempt to decrypt Steve's encrypted message c to verify the key. As protocol messages tend to be structured, it is assumed that identifying that c was properly decrypted is easy. This allows offline recovery of the password.
This attack would not be possible had Steve waited for Carol to prove she was able to compute the correct key before sending an encrypted message. Proper implementations of SRP are not affected by this attack as the attacker would be unable to pass the key verification step.

<h3>Offline bruteforce based on timing attack</h3>
In 2021 Daniel De Almeida Braga, Pierre-Alain Fouque and Mohamed Sabt published PARASITE,<a class="footnote-ref" id="fnref:10" href="#fn:10">10</a> a paper in which they demonstrate practical exploitation of a timing attack over the network. This exploits non-constant implementations of modular exponentiation of big numbers and impacted OpenSSL in particular.

<h2 id="implementations">Implementations</h2>
<ul><li><a href="https://github.com/Glusk/srp6-variables">SRP-6 Variables</a> A Java library of cryptographic primitives required to implement the SRP-6 protocol.</li>
<li><a href="/facts/OpenSSL/aXvs5fo2">OpenSSL</a> version 1.0.1 or later.</li>
<li><a href="/facts/Botan_(programming_library)/IehRkvcn">Botan</a> (the C++ crypto library) contains an implementation of SRP-6a</li>
<li><a href="/facts/TLS-SRP/6b76S7MT">TLS-SRP</a> is a set of ciphersuites for <a href="/facts/Transport_layer_security/pGy16TnA">transport layer security</a> that uses SRP.</li>
<li><a href="https://github.com/symeapp/srp-client">srp-client</a> SRP-6a implementation in <a href="/facts/JavaScript/XhhIIEsl">JavaScript</a> (compatible with RFC 5054), open source, <a href="/facts/Mozilla_Public_License/hBuvAz1w">Mozilla Public License</a> (MPL) licensed.</li>
<li>The <a href="https://clipperz.is/open_source/javascript_crypto_library">JavaScript Crypto Library</a> includes a JavaScript implementation of the SRP protocol, open source, <a href="/facts/Berkeley_Software_Distribution/XQKcURrh">BSD</a> licensed.</li>
<li><a href="https://www.gnu.org/software/gnu-crypto/">Gnu Crypto</a> provide a <a href="/facts/Java_(programming_language)/9ScgFyAL">Java</a> implementation licensed under the <a href="/facts/GNU_General_Public_License/S75KhLSX">GNU General Public License</a> with the "library exception", which permits its use as a library in conjunction with non-Free software.</li>
<li><a href="/facts/Bouncy_Castle_(cryptography)/uwEYp9tT">The Legion of the Bouncy Castle</a> provides Java and <a href="/facts/C_Sharp_(programming_language)/UC2gxeyb">C#</a> implementations under the <a href="/facts/MIT_License/8llAQtlk">MIT License</a>.</li>
<li><a href="http://connect2id.com/products/nimbus-srp">Nimbus SRP</a> is a Java library providing a verifier generator, client and server-side sessions. Includes interfaces for custom password key, client and server evidence message routines. No external dependencies. Released under the <a href="/facts/Apache_License/5AeIjas8">Apache 2.0 license</a>.</li>
<li><a href="https://code.google.com/p/srplibcpp/">srplibcpp</a> is a C++ implement base on MIRACL.</li>
<li><a href="https://github.com/slechta/DragonSRP/">DragonSRP</a> is a C++ modular implementation currently works with <a href="/facts/OpenSSL/aXvs5fo2">OpenSSL</a>.</li>
<li><a href="/facts/Json2Ldap/C8vuw2cE">Json2Ldap</a> provides SRP-6a authentication to <a href="/facts/Lightweight_Directory_Access_Protocol/KgpfD8nR">LDAP</a> directory servers.</li>
<li><a href="https://github.com/cocagne/csrp">csrp</a> SRP-6a implementation in C.</li>
<li><a href="https://search.cpan.org/~mik/Crypt-SRP/">Crypt-SRP</a> SRP-6a implementation in <a href="/facts/Perl/fx31kjlT">Perl</a>.</li>
<li><a href="https://github.com/cocagne/pysrp">pysrp</a> SRP-6a implementation in <a href="/facts/Python_(programming_language)/YbuGqofa">Python</a> (compatible with <a href="https://code.google.com/p/csrp/">csrp</a>).</li>
<li><a href="https://bitbucket.org/pbleyer/py3srp">py3srp</a> SRP-6a implementation in pure <a href="/facts/Python_(programming_language)/YbuGqofa">Python3</a>.</li>
<li><a href="https://pypi.org/project/srptools/">srptools</a> Tools to implement Secure Remote Password (SRP) authentication in <a href="/facts/Python_(programming_language)/YbuGqofa">Python</a>. <a href="https://github.com/secure-remote-password/implementations">Verified compatible libraries</a>.</li>
<li><a href="http://meteor.com/">Meteor</a> web framework's Accounts system implements SRP for password authentication.</li>
<li><a href="https://github.com/lamikae/srp-rb">srp-rb</a> SRP-6a implementation in <a href="/facts/Ruby_(programming_language)/BeYSaPSR">Ruby</a>.</li>
<li><a href="https://github.com/falkmueller/srp">falkmueller</a> <a href="https://code.falk-m.de/srp/">demo SRP-6a</a> implementation of the <a href="/facts/Stanford_University/JEQeF9z2">Stanford</a> SRP Protocol Design in <a href="/facts/JavaScript/XhhIIEsl">JavaScript</a> and <a href="/facts/PHP/vU6YRJX0">PHP</a> under the <a href="/facts/MIT_License/8llAQtlk">MIT License</a>.</li>
<li><a href="https://github.com/RuslanZavacky/srp-6a-demo">srp-6a-demo</a> SRP-6a implementation in <a href="/facts/PHP/vU6YRJX0">PHP</a> and <a href="/facts/JavaScript/XhhIIEsl">JavaScript</a>.</li>
<li><a href="https://bitbucket.org/simon_massey/thinbus-srp-js">thinbus-srp-js</a> SRP-6a implementation in <a href="/facts/JavaScript/XhhIIEsl">JavaScript</a>. Comes with compatible <a href="/facts/Java_(programming_language)/9ScgFyAL">Java</a> classes which use <a href="http://software.dzhuvinov.com/nimbus-srp.html">Nimbus SRP</a> a demonstration app using <a href="/facts/Spring_Security/G3YvuLoV">Spring Security</a>. There is also a demonstration application performing authentication to a <a href="/facts/PHP/vU6YRJX0">PHP</a> server. Released under the <a href="/facts/Apache_License/5AeIjas8">Apache License</a>.</li>
<li><a href="https://bitwiseshiftleft.github.io/sjcl/">Stanford JavaScript Crypto Library (SJCL)</a> implements SRP for key exchange.</li>
<li><a href="https://github.com/mozilla/node-srp">node-srp</a> is a JavaScript client and server (node.js) implementation of SRP.</li>
<li><a href="https://sourceforge.net/projects/srp6-for-csharp-and-java/">SRP6 for C# and Java</a> implementation in C# and Java.</li>
<li><a href="https://github.com/AddAloner/ALOSRPAuth">ALOSRPAuth</a> is an Objective-C implementation of SRP-6a.</li>
<li><a href="https://github.com/opencoff/go-srp">go-srp</a> is a Go implementation of SRP-6a.</li>
<li><a href="https://github.com/midonet/tssrp6a">tssrp6a</a> is a TypeScript implementation of SRP-6a.</li>
<li><a href="https://github.com/theicenet/theicenet-cryptography">TheIceNet Cryptography</a> Java library to develop cryptography-based Spring Boot applications. Implements SRP-6a. Under <a href="/facts/Apache_License/5AeIjas8">Apache License</a>.</li>
<li><a href="https://github.com/secure-remote-password/srp.net">SRP-6a</a> in .NET implementation of SRP-6a</li>
<li><a href="https://support.apple.com/guide/security/homekit-communication-security-sec3a881ccb1/web">Apple Homekit</a> <a href="/facts/Apple_Homekit/YGcIMtuM">Apple Homekit</a> uses SRP when pairing with "smart" home accessories & devices</li>
<li><a href="https://proton.me/blog/encrypted-email-authentication">Proton Mail</a> Authentication for Email Encryption</li>
<li><a href="https://github.com/posterity/srp">SRP</a> is a Go implementation of SRP, used to authenticate users on <a href="https://posterity.life">Posterity</a>.</li></ul>
<h2 id="history">History</h2>
The SRP project was started in 1997.<a class="footnote-ref" id="fnref:11" href="#fn:11">11</a> Two different approaches to fixing a security hole in SRP-1 resulted in SRP-2 and SRP-3.<a class="footnote-ref" id="fnref:12" href="#fn:12">12</a> SRP-3 was first published in 1998 in a conference.<a class="footnote-ref" id="fnref:13" href="#fn:13">13</a> RFC 2945, which describes SRP-3 with SHA1, was published in 2000.<a class="footnote-ref" id="fnref:14" href="#fn:14">14</a> SRP-6, which fixes "two-for-one" guessing and messaging ordering attacks, was published in 2002.<a class="footnote-ref" id="fnref:15" href="#fn:15">15</a> SRP-6a appeared in the official "libsrp" in version 2.1.0, dated 2005.<a class="footnote-ref" id="fnref:16" href="#fn:16">16</a> SRP-6a is found in standards as:

<ul><li>ISO/IEC 11770-4:2006 "Key Agreement Mechanism 2" (calls the method "SRP-6, but has the k calculation of 6a)</li>
<li>RFC 5054 TLS-SRP of 2007 (again referred to as "SRP-6", but corrected in erratum<a class="footnote-ref" id="fnref:17" href="#fn:17">17</a>)</li>
<li>IEEE Std 1363.2-2008 "DLAPKAS-SRP6" (again referred to as "SRP-6")<a class="footnote-ref" id="fnref:18" href="#fn:18">18</a></li></ul>
IEEE 1363.2 also includes a description of "SRP5", a variant replacing the discrete logarithm with an <a href="/facts/Elliptic_curve/60jvaHSA">elliptic curve</a> contributed by Yongge Wang in 2001.<a class="footnote-ref" id="fnref:19" href="#fn:19">19</a> It also describes SRP-3 as found in RFC 2945.

<h2 id="see-also">See also</h2>
<ul><li><a href="/facts/Challenge%25E2%2580%2593response_authentication/QTMRmhpM">Challenge–response authentication</a></li>
<li><a href="/facts/Password-authenticated_key_agreement/udf3tV4x">Password-authenticated key agreement</a></li>
<li><a href="/facts/Salted_Challenge_Response_Authentication_Mechanism/8G5cx8UV">Salted Challenge Response Authentication Mechanism</a> (SCRAM)</li>
<li><a href="/facts/SPEKE/mGm0Bf2x">Simple Password Exponential Key Exchange</a></li>
<li><a href="/facts/Zero-knowledge_password_proof/vgebecKq">Zero-knowledge password proof</a></li></ul>

<h2 id="external-links">External links</h2>
<ul><li><a href="http://srp.stanford.edu">Official website</a></li>
<li><a href="http://srp.stanford.edu/license.txt">SRP License</a>—BSD like open source.</li>
<li><a href="https://patents.google.com/patent/US6539479">US6539479</a> - SRP Patent (Expired on May 12, 2015 due to failure to pay maintenance fees (according to Google Patents). Originally set to expire in July 2018).</li></ul>
<h3>Manual pages</h3>
<ul><li><a href="https://ppp.samba.org/pppd.html">pppd(8)</a>: Point-to-Point Protocol Daemon</li>
<li><a href="http://man7.org/linux/man-pages/man1/srptool.1.html">srptool(1)</a>: Simple SRP password tool</li></ul>
<h3>RFCs</h3>
<ul><li>RFC <a href="https://www.rfc-editor.org/rfc/rfc2944">2944</a> - Telnet Authentication: SRP</li>
<li>RFC <a href="https://www.rfc-editor.org/rfc/rfc2945">2945</a> - The SRP Authentication and Key Exchange System (version 3)</li>
<li>RFC <a href="https://www.rfc-editor.org/rfc/rfc3720">3720</a> - Internet Small Computer Systems Interface (iSCSI)</li>
<li>RFC <a href="https://www.rfc-editor.org/rfc/rfc3723">3723</a> - Securing Block Storage Protocols over IP</li>
<li>RFC <a href="https://www.rfc-editor.org/rfc/rfc3669">3669</a> - Guidelines for Working Groups on Intellectual Property Issues</li>
<li>RFC <a href="https://www.rfc-editor.org/rfc/rfc5054">5054</a> - Using the Secure Remote Password (SRP) Protocol for TLS Authentication</li></ul>
<h3>Other links</h3>
<ul><li><a href="https://archive.today/20081216020624/http://grouper.ieee.org/groups/1363/">IEEE 1363</a></li>
<li><a href="http://www.pdl.cmu.edu/mailinglists/ips/mail/msg08027.html">SRP Intellectual Property Slides (Dec 2001 - possible deprecated)</a> The EKE patents mentioned expired in 2011 and 2013.</li></ul>

<h2 id="references">References</h2>

<ol>
<li id="fn:1">"What is SRP?". Stanford University. <a href="http://srp.stanford.edu/whatisit.html" target="_blank">http://srp.stanford.edu/whatisit.html</a> <a href="#fnref:1" class="footnote-back-ref">↩</a></li>
<li id="fn:2">Sherman, Alan T.; Lanus, Erin; Liskov, Moses; Zieglar, Edward; Chang, Richard; Golaszewski, Enis; Wnuk-Fink, Ryan; Bonyadi, Cyrus J.; Yaksetig, Mario (2020), Nigam, Vivek; Ban Kirigin, Tajana; Talcott, Carolyn; Guttman, Joshua (eds.), "Formal Methods Analysis of the Secure Remote Password Protocol", Logic, Language, and Security: Essays Dedicated to Andre Scedrov on the Occasion of His 65th Birthday, Lecture Notes in Computer Science, Cham: Springer International Publishing, pp. 103–126, arXiv:2003.07421, doi:10.1007/978-3-030-62077-6_9, ISBN 978-3-030-62077-6 <a href="978-3-030-62077-6" target="_blank">978-3-030-62077-6</a> <a href="#fnref:2" class="footnote-back-ref">↩</a></li>
<li id="fn:3">Green, Matthew (18 October 2018). "Should you use SRP?". A Few Thoughts on Cryptographic Engineering. NB: source refers to SRP-6 as SRPv4 for reason unknown. <a href="https://blog.cryptographyengineering.com/should-you-use-srp/" target="_blank">https://blog.cryptographyengineering.com/should-you-use-srp/</a> <a href="#fnref:3" class="footnote-back-ref">↩</a></li>
<li id="fn:4">Haase, Björn (22 January 2023). "(strong) AuCPace, an augmented PAKE [draft-haase-aucpace-07]". Internet Engineering Task Force. Retrieved 10 June 2023. <a href="https://datatracker.ietf.org/doc/html/draft-haase-aucpace-07" target="_blank">https://datatracker.ietf.org/doc/html/draft-haase-aucpace-07</a> <a href="#fnref:4" class="footnote-back-ref">↩</a></li>
<li id="fn:5">Stanislaw Jarecki; Hugo Krawczyk; Jiayu Xu. OPAQUE: An Asymmetric PAKE Protoco lSecure Against Pre-Computation Attacks (PDF). Eurocrypt 2018. <a href="https://eprint.iacr.org/2018/163.pdf" target="_blank">https://eprint.iacr.org/2018/163.pdf</a> <a href="#fnref:5" class="footnote-back-ref">↩</a></li>
<li id="fn:6">Taylor, David; Tom Wu; Nikos Mavrogiannopoulos; Trevor Perrin (November 2007). "Using the Secure Remote Password (SRP) Protocol for TLS Authentication". RFC 5054 <a href="http://tools.ietf.org/html/rfc5054" target="_blank">http://tools.ietf.org/html/rfc5054</a> <a href="#fnref:6" class="footnote-back-ref">↩</a></li>
<li id="fn:7">Carlson, James; Bernard Aboba; Henry Haverinen (July 2001). "EAP SRP-SHA1 Authentication Protocol". IETF. Draft. <a href="http://tools.ietf.org/html/draft-ietf-pppext-eap-srp-03" target="_blank">http://tools.ietf.org/html/draft-ietf-pppext-eap-srp-03</a> <a href="#fnref:7" class="footnote-back-ref">↩</a></li>
<li id="fn:8">Wu, Tom (October 29, 2002). SRP-6: Improvements and Refinements to the Secure Remote Password Protocol (Technical report). <a href="http://srp.stanford.edu/srp6.ps" target="_blank">http://srp.stanford.edu/srp6.ps</a> <a href="#fnref:8" class="footnote-back-ref">↩</a></li>
<li id="fn:9">"SRP Protocol Design". <a href="http://srp.stanford.edu/design.html" target="_blank">http://srp.stanford.edu/design.html</a> <a href="#fnref:9" class="footnote-back-ref">↩</a></li>
<li id="fn:10">"PARASITE: PAssword Recovery Attack against Srp Implementations in ThE wild". Retrieved 8 November 2023. <a href="https://dl.acm.org/doi/10.1145/3460120.3484563" target="_blank">https://dl.acm.org/doi/10.1145/3460120.3484563</a> <a href="#fnref:10" class="footnote-back-ref">↩</a></li>
<li id="fn:11">"SRP: About the Project". srp.stanford.edu. <a href="http://srp.stanford.edu/project.html" target="_blank">http://srp.stanford.edu/project.html</a> <a href="#fnref:11" class="footnote-back-ref">↩</a></li>
<li id="fn:12">"SRP-2: Design Specifications". srp.stanford.edu. <a href="http://srp.stanford.edu/design2.html" target="_blank">http://srp.stanford.edu/design2.html</a> <a href="#fnref:12" class="footnote-back-ref">↩</a></li>
<li id="fn:13">Wu, T., "The Secure Remote Password Protocol", Proceedings of the 1998 Internet Society Network and Distributed System Security Symposium pp. 97-111, March 1998. <a href="http://srp.stanford.edu/ndss.html" target="_blank">http://srp.stanford.edu/ndss.html</a> <a href="#fnref:13" class="footnote-back-ref">↩</a></li>
<li id="fn:14">"SRP: Design Specifications". srp.stanford.edu. <a href="http://srp.stanford.edu/design3.html" target="_blank">http://srp.stanford.edu/design3.html</a> <a href="#fnref:14" class="footnote-back-ref">↩</a></li>
<li id="fn:15">Wu, Tom (October 29, 2002). SRP-6: Improvements and Refinements to the Secure Remote Password Protocol (Technical report). <a href="http://srp.stanford.edu/srp6.ps" target="_blank">http://srp.stanford.edu/srp6.ps</a> <a href="#fnref:15" class="footnote-back-ref">↩</a></li>
<li id="fn:16">CHANGES file in srp-2.1.2.tar.gz, available from http://srp.stanford.edu/download.html <a href="http://srp.stanford.edu/download.html" target="_blank">http://srp.stanford.edu/download.html</a> <a href="#fnref:16" class="footnote-back-ref">↩</a></li>
<li id="fn:17">Wang, Mingye. "RFC Errata Report #7538". RFC Editor. Retrieved 15 October 2023. <a href="https://www.rfc-editor.org/errata/eid7538" target="_blank">https://www.rfc-editor.org/errata/eid7538</a> <a href="#fnref:17" class="footnote-back-ref">↩</a></li>
<li id="fn:18">IEEE 1363.2-2008: IEEE Standard Specification for Password-Based Public-Key Cryptographic Techniques <a href="#fnref:18" class="footnote-back-ref">↩</a></li>
<li id="fn:19">Wang, Y., "IEEE P1363.2 Submission / D2001-06-21," [P1363.2-ecsrp-06-21.doc] A contribution by Yongge Wang for P1363.2 giving an elliptic curve version of the SRP protocol, June 21, 2001. <a href="#fnref:19" class="footnote-back-ref">↩</a></li>
</ol>

Secure Remote Password protocol open-in-new

Secure Remote Password protocol