TLS-SRP

Transport Layer Security Secure Remote Password (TLS-SRP) ciphersuites are a set of cryptographic protocols that provide secure communication based on passwords, using an SRP password-authenticated key exchange.

There are two classes of TLS-SRP ciphersuites: The first class of cipher suites uses only SRP authentication. The second class uses SRP authentication and public key certificates together for added security.

Usually, TLS uses only public key certificates for authentication. TLS-SRP uses a value derived from a password (the SRP verifier) and a salt, shared in advance among the communicating parties, to establish a TLS connection. There are several possible reasons one may choose to use TLS-SRP:

  • Using password-based authentication does not require reliance on certificate authorities.
  • The end user does not need to check the URL being certified. If the server does not know data derived from the password then the connection simply cannot be made. This prevents Phishing.
  • Password authentication is less prone than certificate authentication to certain types of configuration mistakes, such as expired certificates or mismatched common name fields.
  • TLS-SRP provides mutual authentication (the client and server both authenticate each other), while TLS with server certificates only authenticates the server to the client. Client certificates can authenticate the client to the server, but it may be easier for a user to remember a password than to install a certificate.

Implementations

TLS-SRP is implemented in GnuTLS,[1] OpenSSL as of release 1.0.1,[2] Apache mod_gnutls[3] and mod_ssl, cURL, TLS Lite[4] and SecureBlackbox.[5]

Standards
gollark: Aren't discreteness and small changes causing big differences somewhat separate, though?
gollark: True.
gollark: DNA is sort of kind of a digital storage system, and it gets translated into proteins, which can turn out really differently if you swap out an amino acid.
gollark: Real-world evolution works fine with fairly discrete building blocks, though.
gollark: Did you know? There have been many incidents in the past where improper apiary safety protocols have lead to unbounded tetrational apiogenesis, also referred to as a VK-class "universal apiary" scenario. Often, the fallout from this needs to be cleaned up by moving all sentient entities into identical simulated universes, save for the incident occurring. This is known as "retroactive continuity", and modern apiaries provide this functionality automatically.

See also

References
  1. "Authentication using SRP". GnuTLS Manual. 2016-11-13. Retrieved 2016-12-02.
  2. OpenSSL Project Team (2012-03-14). "OpenSSL 1.0.1 released". Retrieved 2016-12-02.
  3. "mod_gnutls". 2015-11-22. Retrieved 2016-12-02.
  4. "TLS Lite". 2013-03-20. Retrieved 2016-12-02.
  5. "SecureBlackbox: TElSRPCredential class". 2019-02-20. Retrieved 2019-02-20.
This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.