Stack Overflow
Stack Overflow

Questions tagged [srp-protocol]

The Secure Remote Password protocol (SRP) is a password-authenticated key agreement protocol in order to establish an encrypted channel based on a password.

37 questions
23
votes
2 answers

implementing USER_SRP_AUTH with python boto3 for AWS Cognito

Amazon provides iOS, Android, and Javascript Cognito SDKs that offer a high-level authenticate-user operation. For example, see Use Case 4 here: https://github.com/aws/amazon-cognito-identity-js However, if you are using python/boto3, all you get…
billc
  • 1,791
  • 4
  • 16
  • 25
16
votes
4 answers

TLS/SRP in browsers?

Is there a plan or existing implementation of RFC 5054 in any of the major browsers yet? If nobody has an implementation yet, then which major browsers have it on their roadmap? Where?
Jason
  • 3,021
  • 1
  • 23
  • 25
8
votes
1 answer

Cognito UnknownError after turn on device registration

As per requirement, I need to turn on device registration to Always. However, our SRP flow starts failing with the below issue. { code: 'UnknownError', message: 'Unknown error, the response body from fetch is: undefined' } After doing some…
sayboras
  • 4,897
  • 2
  • 22
  • 40
6
votes
2 answers

AWS Cognito user authentication Missing required parameter SRP_A

I am trying to use AWS Cognito services for user authentication through ruby SDK. I could able to sign_up, confirm sign_up process using the methods resp = client.sign_up({ client_id: "ClientIdType", secret_hash:…
Bala Karthik
  • 1,353
  • 2
  • 17
  • 26
6
votes
2 answers

Spring Security - Secure Remote Password protocol - SRP - Authentication Provider

When asking this question I am looking for guidance with implementation of my own AuthenticationProvider. By that i mean the following: Till now i have learned that Spring Security ask the AuthenticationProvider object if the user is authenticated…
Tito
  • 2,234
  • 6
  • 31
  • 65
5
votes
1 answer

Cognito SRP Authentication JAVA SDK

Iam trying to authenticate a Java app with Cognito. I have used for python the warrant library that worked very good. But i want to do the same in java now. My Python function i used for authentication with the warrant library def…
Khan
  • 1,418
  • 1
  • 25
  • 49
4
votes
1 answer

Couldn't generate correct PASSWORD_CLAIM_SIGNATURE in PHP for Cognito

I am trying to use AuthFlow USER_SRP_AUTH for user login. I am getting the "PASSWORD_VERIFIER" challenge in the response of initiateAuth request. While responding to that challenge I am not sure what I should pass as the value of…
Vivek Pipaliya
  • 488
  • 1
  • 7
  • 17
4
votes
3 answers

Browser-Based SRP without Java

I am considering implementing the Secure Remote Password protocol to conduct a zero-knowledge password proof between the browser and my web application. The SRP website provides an example, but it requires java to perform calculations. I am…
Matt Eskridge
  • 1,019
  • 10
  • 24
4
votes
2 answers

Secure Remote Password protocol on application level

I'm writing a Java EE application, which allows new users to register themselves and then log in over the Internet. I'm storing the credentials an a db. Now, there are several ways to do that, e.g.: send username and password, preferably over a…
Puce
  • 37,247
  • 13
  • 80
  • 152
3
votes
2 answers

Why SRP is not plaintext-equivalent?

About the SRP Protocol: http://en.wikipedia.org/wiki/Secure_remote_password_protocol I can see that the generation of the session key (K) is perfectly safe, but in the last step the user sends proof of K (M). If the network is insecure and the…
Julio Faerman
  • 13,228
  • 9
  • 57
  • 75
3
votes
0 answers

SRP Delphi Implementation

I finally finished the implementation of the SRP protocol in delphi! Using the openssl library to calculate the hash and Bignum. The implementation at the end is not complicated. but I have come in doubt: 1) I can use random pair N, g. N 4096 bit is…
user3703876
  • 174
  • 12
3
votes
2 answers

Questions about SRP algorithm

I trying to use SRP algorithm but I have some questions: Is that a good choice to use for registration and authorization SRP algorithm with SSL/TLS? And for all other transmission using just SSL/TLS? I will use C# Sockets for implementation. How…
konstantin_doncov
  • 2,725
  • 4
  • 40
  • 100
3
votes
0 answers

Does nginx support SSL-SRP?

Does nginx support the SRP (secure remote password) protocol? I see that the ssl_ciphers directive accepts the format used by OpenSSL, but not clear if nginx actually supports all ciphers supported by OpenSSL. I see no nginx documentation for SRP…
Aliza
  • 734
  • 1
  • 10
  • 25
2
votes
1 answer

SRP6 TrinityCore Implementation wrong?

TrinityCore deprecated the old sha_pass_hash column on the auth table, in favour of the much safer SRP6 method. However, I am unable to properly calculate the verifier in C#/dotnet NOR in PHP using the example provided here. I've looked at examples…
Rudi
  • 95
  • 9
2
votes
2 answers

DEVICE_PASSWORD_VERIFIER challenge response in Amazon Cognito using boto3 and warrant

I'm using both the boto3 and warrant libraries to try to get a device authenticated to skip multi-factor authentication after it's been recognized. I've got through a user/password auth but can't seem to figure out the right way to authenticate the…
jsam
  • 83
  • 1
  • 11
1
2 3