3 ms·
That's good to know. I just wanted to separate the two usecases from the developer's perspective. I'm not qualified to make any authoritative conclusions about
by delano 16y ago
That's good to know.
I just wanted to separate the two usecases from the developer's perspective. I'm not qualified to make any authoritative conclusions about any particular solution.
- zedshaw 16y agoActually, he's incorrect. The crypto is calculated in javascript, and in a C library written by the author of SRP: http://srp.stanford.edu/download.html http://srp.stanford.edu/download.html I'm using 2.1.2 with one slight modification to use SHA256 instead of SHA1+MGF1. That means that, should there be a failure in the javascript, it has a chance of getting caught in the C code written by the author of SRP.
- tptacek 16y agoI'm not incorrect. I did actually read your code, Zed. You think I've made a claim that I haven't made: that you wrote a serverside implementation of SRP. I know you're using the original SRP library. That was a good call. You know SRP is mutual auth, right?
- zedshaw 16y agoYes, I do, but claiming I wrote the crypto in javascript is false. I wrote one part in javascript, and the other part is in C. That means, if there's an attack against the Javascript cryptography not the browser environment, then the mutual aspect of the cryptography will mean that the C side will catch the error. That's why you're wrong when you say I did in javascript. Only 1/2 of it is in javascript, and I only wrote a minimal amount of that.