Secure Remote Password protocol.

This is simple MySQL + PHP application which also uses JavaScript, to perform two-way auhentication.

Features: It is secure for both sides. It do not need certificates or certification authorities (beside initial account creation, which is almost always safer than day-to-day usage, and can be done using secondary channels, like telephone, or other system). It is brute-force and replay attack resilent. It establishes strong common session encryption key. It makes offline attacks almost impossible. It do not store plain text passwords on tht database, and database cannot be used even break into the same system or systems with same login / password pairs. It do not leak any informations to the not trusted servers, and to not trusted users.

It is better than plain text passwords, it is better than hashed passwords, it is better than salted passwords, it is better than chalenge-response schemes, it is better than Diffie-Helman authentification, it is better than public key systems. One of the best cryptographic protocols ever.

We use SHA-256 (and its -HMAC version) as basic cryptographic primitive, and use GMP (GNU Multiprecission library) for PHP to perform large number arithmetic. We use scrypt-inspired key derivation (password strenghtening) from password.

It is just a proof of concept, good for didactic purposes. Do not use in production systems. Can contain bugs, as well can be vorunable to side-channel attacks using time based methods. It also do not solve how client-side code is distributed to the client (probably using SSL based HTTP, with trusted certificates, for example on trusted third-party server).

Please rather vote for a native TLS-SRP support in browsers: Mozilla Firefox, Chromium, Opera, etc., and libraries: OpenSSL, GNUTLS, NSS.

Copytright: Witold Baryluk, June 2009

Links: http://en.wikipedia.org/wiki/Secure_Remote_Password_protocol http://srp.stanford.edu/ http://tools.ietf.org/html/rfc2945 http://tools.ietf.org/html/rfc5054 http://grouper.ieee.org/groups/1363/ http://en.wikipedia.org/wiki/TLS-SRP http://trustedhttp.org/ patches for libs (GnuTLS, OpenSSL, NSS, Python), servers (apache), and clients (curl, Firefox, Chrome)