Talk:Secure Remote Password protocol

message: There seems to be an error in this output. I believe it is supposed to show the client and server generate the same session keys however they are clearly different lengths and looking closer you can see that there are some non hexadecimal values causing the difference. I am fairly sure this a bug in the code.
4. client computes session key
S_c = 0x94ea4b72b61d4330hcf44f31e5c710491d41abdd6dd5b66b277bc5e17addbe89d9aa002645897567ae7796d1574f5d7f62cf96d2246adabfbc919alscf1444d69097ceaf5476bc3964cacd52697e346f5e5a424c2c89b661d2eba34e5c7195573442195611497f606fa49639f873f385d0f6cdb9308fe2b0777d1a89bbaebe9df237a4
K_c = 0x3f1e089e02b3770a5e4ab27b3a04415e54826fe4b729cd37b86fbe59b9e0d3c6
5. server computes session key
S_s = 0x94ea4b72b61d4330ecf44f31e5c710491d41abdd6dd5b66b277bc517addbe89d9aa002645897567ae7796d1574f5d7f62cf96d2246daibfbc919cf1444d69097ceaf5476bc3964cacd52697en346f5e5a424c2c89b661d2eba34e5c719557344219t5611497f606fa49639f873f385d0f6cdb9308fe2b0777d1a89bbaebe9df237a4
K_s = 0x3f1e089e02b3770a5e4ab27b3a04415e54826fe4bg729cd37b86fbe59b9e0hd3c6  — Preceding unsigned comment added by 5.71.204.100 (talk) 17:55, 12 December 2017 (UTC)
thread_title: Python Example Output

message: Small nitpick: If N=2q+1 and both N and q are prime then q
(not N) is called a Sophie Germain prime. Unfortunately, this error calling the bigger prime
"Sophie Germain" is quite popular in cryptography and even made it into some RFCs.
I have also noticed this and made the correction. TheAnarcat (talk) 22:07, 23 July 2009 (UTC)
thread_title: Talk

message: How generator of the multiplicative group is selected? Dipogogo (talk) 10:31, 22 July 2009 (UTC)
thread_title:  g? 

message: The example states that the chosen prime is a large, safe prime. 1024 bits are no longer long neither safe size for anything that is supposed to live longer than a month or three.  — Preceding unsigned comment added by 80.252.219.34 (talk) 12:54, 21 January 2016 (UTC)
thread_title:  Python Code flaw 

message: * What exactly meaning of "All arithmetic is performed in the field of integers modulo N"?
In python demonstration, It seem like only "power mod" operation in the field of modulo N.
Others like additon, subtraction, multiplication are beyond the field. Should these operation module N too?  — Preceding unsigned comment added by 58.38.19.167 (talk) 18:21, 3 October 2011 (UTC)
replies: text: I agree, this point needs proper clarification 81.153.206.110 (talk) 11:48, 22 October 2011 (UTC)

text: Any operation should be modulo N. This is just python code flaw. 1.2.3.4  — Preceding unsigned comment added by 178.27.147.19 (talk) 01:26, 2 February 2012 (UTC)
thread_title:  Confusing about arithmetic 

message: Why is there no mention of this the highly contentious IPR status of SRP? Did it become no longer highly contentious?--71.191.197.79 (talk) 05:52, 30 June 2011 (UTC)
thread_title:  Patents? 

message: question: 2nd bullet in "protocol says:
* All arithmetic is performed in the ring of integers modulo N, \scriptstyle \mathbb{Z}_N.
since N is prime, shouldn't this be "field" rather than "ring"? peace - קיפודנחש (aka kipod) (talk) 18:59, 21 April 2014 (UTC)
thread_title:  Ring or field? 

message: Could really use one or two sentences at beginning, in layman terms (assume knowledge of basic computer software terminology, but not of security terminology).
I didn't understand the purpose and benefit of SRP until I found a stackoverflow answer:
http://stackoverflow.com/a/4642699/199364
    Start with both parties already having agreed [to] a password.
Ahhh. Before reading this, I thought SRP was part of a secure mechanism for communicating the password in the first place; I did not realize it was an authentication mechanism for use after the password was known to both sides.
And a sentence in a comment to that stackover answer:
    The difficulty in dealing with passwords is how you avoid sending the password in plaintext on the wire, and that's one of the driving forces behind SRP.
That's exactly what I needed to know, to know "WHY use SRP?".
I will attempt to add a couple of sentences to beginning of intro.  I apology for the likelihood that I will do so poorly, so hopefully someone will see and review .. and come here to find out why I added them.
ToolmakerSteve (talk) 21:51, 16 November 2015 (UTC)
thread_title:  Layman explanation? 

message: What's the consensus on deciding whether something is sufficiently notable to be listed in the implementations? An edit today by  (an account that's made only three contributions since registering in Jan 2008) adds:
*mozilla/node-srp, with 21 watches, 86 stars, 95 commits, 29 forks on Github
*opencoff/go-srp, with 1 watch, 8 stars, 5 commits, 2 forks on Github
*AddAloner/ALOSRPAuth, with 2 watches, 7 stars, 10 commits, 4 forks on Github
The first one look legitimate, but what about the other two? - Pointillist (talk) 00:32, 14 October 2016 (UTC)
thread_title:  Notability of Implementations 

message: Anonymous user 93.132.170.179's contributions lacked citations despite making new assertions. I found both factual errors (e.g. a man-in-the-middle can only impersonate a server during the registration phase of SRP) and grammatical/style errors (e.g. using "A-Priori"  instead of italicizing the Latin term as "a priori") to be sufficient to revert the changes.  — Preceding unsigned comment added by Anwynd (talk • contribs) 17:51, 25 November 2018 (UTC)
thread_title:  Reverted Introductory Text 

message: "Skipping the verification steps can be dangerous. In the case where the server sends an encrypted packet first, there is a vulnerability where anyone can get offline password guessing.[citation needed]"
About the newly added "[citation needed]", I don't know of a source that isn't me, but it's simple math and I assume it's in the definition (RFC or paper). Here's the simple math:
Given:
* Public info: I, u, k, g, s, A, B
* Attacker's: a
* Server's verifier: Verifier = H(SSteve) = H(SCarol) = H((B − kg)(a + ux)) or equivalent (e.g. aead(key=H(SSteve), ...))
Attack:
* Make guess at password and generate x = H(s | H(I | ":" | password))
* Check Verifier == H((B − kg)(a + ux) (Note B, k, g, u are public, a is known to the attacker, and x is guessed) NotSc00bz (talk) 18:52, 4 September 2020 (UTC)
thread_title:  Remove "citation needed" for "Skipping the verification steps can be dangerous"