Skip to content

Instantly share code, notes, and snippets.

@chaicko
Forked from azul/gist:9209005
Last active August 29, 2015 14:23
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save chaicko/1d3fc1f9b508feadfac3 to your computer and use it in GitHub Desktop.
Save chaicko/1d3fc1f9b508feadfac3 to your computer and use it in GitHub Desktop.

Secure Remote Password explained for mere mortals

Discrete Logarithm

Most SRP calculations happen in the group of integers modulo a large number N. Basically whenever a number x grow beyond N you use x mod N instead.

Here's an example:

N = 7
x = 3
x² = 3*3 = 9 % 7 = 2
x³ = x²*x = 2*3 = 6
x^4 = x²*x² = 2*2 = 4
x^4 = x³*x = 6*3 = 18 % 7 = 4

As you can see in the last examples you can still apply your known math tricks.

Finding the exponent b in x^b = y in this group is called the discrete logarithm problem https://en.wikipedia.org/wiki/Discrete_logarithm . Computing discrete logarithms is believed to be difficult. No efficient general method for computing discrete logarithms on conventional computers is known, and SRP bases it's security on the assumption that the discrete logarithm problem has no efficient solution.

Diffie Hellman Key Exchange

It's fairly easy to agree upon a shared key and prevent anyone listening from calculating the same key without solving the discrete log problem (Diffie Hellman Key Exchange):

client picks random number a
server picks random number b
client calculates A=g^a
server calculates B=g^b
client sends A to server
server sends B to client
server calculates S=A^b=g^(a*b)
client calculates S=B^a=g^(a*b)

As you can see both sides now know a shared secret S. Anyone who only knows A and B will have a hard time calculating S.

SRP Key Exchange

SRP includes the password in the key exchange and thus allows the server to authenticate the client.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment