Secure Remote Password (SRP)

Considering the value and avoiding pitfalls

I’ve been working on a penetration test of an application that is using the Secure Remote Password Protocol. I decided to dig in a bit deeper to see how this protocol works in detail and if I could find any weaknesses in the implementation.

This quest led me down a rabbit hole of poorly defined specifications, versions and documentation. After hunting through details, videos and blog posts, this is my conclusion, a simpler explanation, and things to check if you are using Secure Remote Password Protocol to help ensure your implementation is not vulnerable to attack.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

⚙️ Check out my series on Automating Cybersecurity Metrics. The Code.

🔒 Related Stories: Secure Code | Data Breaches | Pentesting | Bug Bounties

💻 Free Content on Jobs in Cybersecurity | ✉️ Sign up for the Email List

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Password Authentication Key Exchange (PAKE)

For starters, Secure Remote Password Protocol is a type of PAKE or Password Authentication Key Exchange. I’ll let you research all the references at the bottom of Wikipedia if you want to know the full history but basically people were trying to determine if and how they could authenticate users without actually sharing…