# I would like to see SRP added

Damon Atkins (Damon.Atkins@nabaus.com.au)
Tue, 10 Feb 1998 15:51:55 +1100

- Messages sorted by: [ date ][ thread ][ subject ][ author ]
- Next message: John Roach: "warning: applet window"
- Previous message: Jan Luehe: "Re: Asymmetric Cipher"

    Date: Tue, 10 Feb 1998 15:51:55 +1100

    From: Damon Atkins <Damon.Atkins@nabaus.com.au>

    To: java-security@web2.javasoft.com

    Subject: I would like to see SRP added

This is a multi-part message in MIME format.
--------------FC09A4C751A7694CE964446C
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

SRP is Secure Remote Password, find attached a html page
http://srp.stanford.edu/srp/

PS

I would also like to see added to java a final opensafe() function,
which would let an applet talk to the
local file system

This would pop a a user interface listing directories and files which
the user could select or
the user could enter a file name. If the applet is not secure
opensafe() ignores any file names or wild card
extensions passed as arguments. The use must select the file to open
from the root directory
or home directory. This way an applet has access to the local file
system user is prompted to give all the information about file names. ie
a use would have to select c:\command.com or \vmunix for the applet to
be able to write or read from it.

The opensafe() function ensure control is with the user and not the
programmer.

PSS Is there any list I could join on Java security.

Damon.

--------------FC09A4C751A7694CE964446C
Content-Type: text/html; charset=us-ascii
Content-Transfer-Encoding: 7bit
Content-Base: "http://srp.stanford.edu/srp/"

SRP: Secure Password Authentication for the Net

# SRP Authentication and Key Exchange

The networked password problem has been solved. Simple challenge-response authentication is dead.

SRP stands for the Secure Remote Password protocol, and it represents a new mechanism for performing password-based authentication and key exchange over potentially insecure networks. SRP offers both security and convenience improvements over authentication techniques currently in use.

- What does SRP do?
- Three Important Issues in Password Authentication
  - Dictionary Attacks
  - Plaintext-Equivalence
  - Forward Secrecy
- A Brief History of Password Authentication
  - Weak and Obsolete Authentication
  - Stronger Authentication
  - Inconvenient Authentication
- SRP Protocol Summary
- SRP technical paper - available as PostScript or HTML
  Accepted for presentation at the ISOC NDSS '98 symposium, it contains a proof of SRP's security against eavesdroppers and proves it to be more secure than challenge-response.
- SRP survives scrutiny on the Internet
- Advantages of SRP (or: How does SRP fit in?)
  - Security Advantages
  - Technical Advantages
  - Political Advantages
- The Case for Moving to SRP (or: Why should I care?)
- What about smart cards/SecurID/two-factor systems?
  - Common Myths Debunked
  - A Proposal for PIN handling in smart cards
- The Stanford Telnet/FTP distribution
- People and organizations using SRP
  - In addition to the dozens of individual requests, nearly twenty organizations (educational, corporate, etc.) have requested domain-wide permission for the SRP distribution.
  - The Application Authentication/Authorization Review Group (AAARG) is looking at standardizing SRP as an authentication mechanism for use in authenticated TCP/IP protocols. Internet Drafts for both the SRP Authentication Mechanism and the Telnet Authentication Option for SRP have been officially submitted to the IETF.
  - The Computer Science Department at Stanford is now using SRP to handle user authentication to its main login server.
  - SRP has been officially submitted to the IEEE P1363 Working Group as a contribution to the upcoming Public-Key Cryptography Standards.
  - The Java Telnet Applet now supports SRP.
- References and Links
- Download SRP-enabled software
- Research sponsorship information

Please direct all comments, questions, and suggestions to Tom Wu (tjw@cs.Stanford.EDU).

--------------FC09A4C751A7694CE964446C--

- Next message: John Roach: "warning: applet window"
- Previous message: Jan Luehe: "Re: Asymmetric Cipher"