6 ms·
is anyone aware of a pre-existing Python implementation of this that isn't `warrant` (which appears to be unmaintained as it has several significant issues in i
by ledauphin 7y ago
is anyone aware of a pre-existing Python implementation of this that isn't `warrant` (which appears to be unmaintained as it has several significant issues in its underlying crypto stack)?
I'm tempted to spend some time writing one (AWS Cognito uses SRP), but also have other things I could do... :)
- pjbk 7y agoThe implementation itself is relatively simple. The most popular Python implementation is Tom Cocagne's pysrp that builds on csrp, his original C implementation: https://github.com/cocagne/pysrp https://github.com/cocagne/pysrp. I used this as a guide to write a pure Python3 implementation of SRP-6a some years ago that I needed for protocol testing on embedded devices, and to internalize how the algorithm worked and the complexity of the calculations: https://bitbucket.org/pbleyer/py3srp https://bitbucket.org/pbleyer/py3srp. That being said, I would never use plain vanilla Python for cryptography in a system that needs to be strongly secured. Too many side channel and timing attacks possible where you can replicate or estimate the state of things locally once you know the other side is running a Python VM.