The original post: /r/cybersecurity by /u/wisdom_of_east on 2024-10-12 12:36:21.

Please consider sharing your insight on my project…

🔧 GitHub Repository [Oblivious SRP Library]

Explore the repo and README to get started.

💡 Feedback Request [GitHub Discussions], or email me directly at by clicking here! Also, everyone is welcome to post their feedback in the comments or message me on Reddit itself.

Greetings,

I’m excited to announce the release of my dev project called Oblivious SRP, an evolution of the already highly secure Secure Remote Password (SRP) protocol. SRP is well-known for its use of zero-knowledge password proof, meaning the user’s password is never stored anywhere—not on the client, not even on the server. In SRP, passwords are never even sent over the network, not even in encrypted form! This makes SRP far more secure than other password-based systems. Hence, many major players like Apple and Skiff-mail make extensive use of SRP protocol in their products.

What makes SRP so secure?

  • No Password Storage: SRP doesn’t store your password, not even in an encrypted form. Instead, the password is transformed into a verifier that the server stores. The server uses this verifier to authenticate the user without ever learning the actual password.
  • No Password Transmission: During authentication, the user’s password is never transmitted, not even in encrypted form. Instead, a mathematical proof is exchanged, allowing the server to verify the password without knowing it.
  • This makes SRP immune to common threats like password leaks from server breaches, phishing, and replay attacks.

But there’s still a potential vulnerability…

While SRP is extremely secure, it does store a verifier on the server. If a server becomes malicious, it can try to use this verifier to run dictionary attacks (guessing passwords until it finds the right one).

Introducing Oblivious SRP:

Oblivious SRP takes things up a notch by introducing Oblivious Pseudo-Random Functions (OPRF) and multi-server support to close these gaps:

  • OPRF: Instead of storing the verifier directly, the verifier is split into a private and a public component. The public verifier is generated via hashing OPRF evaluations with the private verifier, where the OPRF evaluations are username-rate-limited, making dictionary attacks nearly impossible.
  • Multi-Server Model: Oblivious SRP also supports a multi-server approach, where attackers need to compromise multiple servers to perform a successful attack. This makes password guessing far more complex and increases overall security.

Enhanced Security:

With Oblivious SRP, attackers would need to break into all the servers, bypass their rate-limitations and acquire real-time responses from each one to even begin trying to guess a password. The extra layers of defense significantly reduce the risks of traditional SRP while maintaining its core strengths.🔧