6 ms·
SRP note was very nice: http://en.wikipedia.org/wiki/Secure_Remote_Password_protocol http://en.wikipedia.org/wiki/Secure_Remote_Password_protocol On a more eso
by DanielRibeiro 14y ago
SRP note was very nice: http://en.wikipedia.org/wiki/Secure_Remote_Password_protocol http://en.wikipedia.org/wiki/Secure_Remote_Password_protocol
On a more esoteric note: If you are looking to resist quantum algorithms attacks, there are post-quantum algorithms for that[1] (they are computed on normal machines, but the problems behind the crypstosystems are hard to solve even for quantum computers).
[1] http://crypto.stackexchange.com/questions/494/what-is-the-post-quantum-cryptography-alternative-to-diffie-hellman http://crypto.stackexchange.com/questions/494/what-is-the-po...
- tptacek 14y agoSRP also has tunable work-factor knobs, although they aren't as explicit as the ones in bcrypt, scrypt, or PBKDF2. But I'd strongly recommend against re-implementing SRP, since it's treacherous to get right.
- shabble 14y agoOf the implementations listed in the WP article, which, if any, are suitable for general purpose use? And what manner of implementation screwups are most likely|hazardous? [With the obvious caveat: Advice not for production use, If you have to ask...]
- tptacek 14y agoIf you're going to use an SRP library, there's an open-source Stanford SRP library (most commercial systems derive from it) which deals with the obvious attacks.
- pbsd 14y agoIf you're worried about quantum computers when thinking some website's security, you're either doing it wrong, or living in the future. Post-quantum is cool alright, but it's not really a thing that implementers need to worry about.