SRP support

[tanx]

Hi,

we are looking into the possibility of using the SRP protocol in our application. I wanted to ask if it is in the scope of this library to provide such functionality since, OpenSSL 1.0.1 also supports this:
http://en.wikipedia.org/wiki/Secure_Remote_Password_protocol#Real_world_implementations

Here is a js implementation that could potentially be integrated:
https://code.google.com/p/srp-js/source/browse/#svn%2Ftrunk%2Fjavascript

Thanks

[dlongley]

Yeah, I think it's in scope considering various other similar crypto libraries provide it (not only OpenSSL). A PR for SRP support would likely be accepted.

[dlongley]

It looks like the implementation of SRP you linked to is very tightly integrated with XMLHttpRequest and the DOM. A PR for this should really try to make sure there are good enough abstractions so that code can be easily reused by other future additions like TLS-SRP. It would be best if people could easily plug SRP in wherever they wanted.

[tanx]

Yeah that makes sense. It's way down the road, but at least we know know where to send our PR when the time comes ^^

[fpietrosanti]

It look like Stanford Javascript Crypto Library now support SRP6a together with RFC5054 test vectors bitwiseshiftleft/sjcl#214 .

Considering the TLSLite pure-python TLS-SRP server-side implementation (sqs/tlslite#4), it would be super to see a fully working integration of the 3 components:

• SJCL for SRP6a (JS client)
• Forge for TLS + TLS-SRP (JS client)
• TLSLite for TLS-SRP (server)