I was intentionally a bit vague there because I didn't want to lend additional credibility to those concerns, especially without researching the current status.

I was intentionally a bit vague there because I didn't want to lend additional credibility to those concerns, especially without researching the current status. Though IIRC only the limited form of SRP which doesn't provide bidirectional authentication (e.g. where you can't be MITMed even by a sever that knows your password or has stolen the server's 'hash' database) was covered under the royalty free grant. Implementation of the full protocol required a license from Stanford, https://ietf.org/ipr/31/ https://ietf.org/ipr/31/