What Is Secure Remote Password (SRP) Protocol and How to Use It?

Re:What Is Secure Remote Password (SRP) Protocol and How to ... by GhettoMaestro on Sunday December 01, 2019 @12:34PM (#21676617)

I feel dumb asking this, but does current industry authentication methods (secure channel via TLS) send the actual password, or a derived challenge-response value through the secure channel? I thought it was the latter.

[ Parent | on HN ]

Re:What Is Secure Remote Password (SRP) Protocol and How to ... by M4v3R on Sunday December 01, 2019 @12:38PM (#21676645)

In 99% cases client sends the actual password to the server. If you don't want to send the actual password over the wire then you use SRP (or something similar) mentioned in the original post.

[ Parent | on HN ]

Re:What Is Secure Remote Password (SRP) Protocol and How to ... by GhettoMaestro on Sunday December 01, 2019 @01:17PM (#21676881)

Thanks for clearing that up. I had incorrectly assumed that something other than SRP had come along to fulfill this need - I guess not!

[ Parent | on HN ]