psa-api icon indicating copy to clipboard operation
psa-api copied to clipboard

Add support for the SRP-6/6a PAKE protocol

Open athoelke opened this issue 1 year ago • 2 comments

SRP-6 is the currently most widely deployed augmented PAKE algorithm, based on a key exchange based on finite-field Diffie-Hellmann arithmetic.

An early version is defined in RFC 2945, the SRP-6 definition adds protection against additional attacks, and RFC 5054 defines how SRP-6 can be used with TLS.

However, there is no single definitive reference for SRP-6, and differences exist in both the construction of the key confirmation messages, and the processing of the raw DH output value into a shared secret. For inclusion into the Crypto API, a precise definition of the algorithm (or algorithms) will need to be provided.

athoelke avatar Mar 05 '24 09:03 athoelke

An initial proposal for the API elements has been proposed in #178

athoelke avatar Mar 05 '24 09:03 athoelke