2 ms·

I'm not an expert, but your question has interested me for quite a while as well, so I did some research. It seems that SRP does not require the plaintext passw

by shawnz 13y ago

I'm not an expert, but your question has interested me for quite a while as well, so I did some research. It seems that SRP does not require the plaintext password to be stored by the server. > SRP does not expose passwords to either passive or active network intruders, and it stores passwords as a "non-plaintext-equivalent" one-way hash on the server. Source: http://srp.stanford.edu/analysis.html http://srp.stanford.edu/analysis.html

andrewcooke 13y ago
interesting, thanks. turns out there are even patches for ssh! http://srp.stanford.edu/links.html http://srp.stanford.edu/links.html but i get the impression that still doesn't mean that ssh can be made to work with system passwords without transmitting them (over an encrypted channel). i don't understand why - maybe srp requires a particular kind of hash? ah yes - this answer http://security.stackexchange.com/questions/23821/srp-can-the-client-authenticate-using-only-the-stored-hash http://security.stackexchange.com/questions/23821/srp-can-th... gives some details.