What is SRP?

Many password authentication solutions claim to solve this exact problem, and new ones are constantly being proposed. Although one can claim security by devising a protocol that avoids sending the plaintext password unencrypted, it is much more difficult to devise a protocol that remains secure when:

Attackers have complete knowledge of the protocol.

Attackers have access to a large dictionary of commonly used passwords.

Attackers can eavesdrop on all communications between client and server.

Attackers can intercept, modify, and forge arbitrary messages between client and server.

A mutually trusted third party is not available.

SRP is available to commercial and non-commercial users under a royalty-free license. The Internet played a significant role in SRP's early development; without it, SRP would not have received anywhere near the amount of analysis and feedback that it has gotten since it was first proposed and refined. It is thus fitting that the Internet at large can benefit from the fruits of this endeavor. Since SRP is specifically designed to work around existing patents in the area, it gives everybody access to strong, unencumbered password authentication technology that can be put to a wide variety of uses.

The SRP distribution is available under Open Source-friendly licensing terms (for the net.savvy reader, it's a "BSD-style" license). More information about the SRP project is available at this site, and a reference implementation, which includes versions of Telnet and FTP that incorporate SRP support, can be downloaded as well. The links page has pointers to a wide range of projects and products, both commercial and non-commercial, that use SRP, as well as related work and papers that cover strong password authentication.