Secure Remote Password is a authentication protocol to prove your identity to another party, using a password, but without ever revealing that password to other parties. Not even the party you are proving your identity. See Secure Remote Password protocol for more information on this protocol.
// This is a database of users, along with their salted verification keys
let userStore: [String: (salt: Data, verificationKey: Data)] = [
"alice": createSaltedVerificationKey(username: "alice", password: "password123"),
"bob": createSaltedVerificationKey(username: "bob", password: "qwerty12345"),
]
// Alice wants to authenticate, she sends her username to the server.
let client = Client(username: "alice", password: "password123")
let (username, clientPublicKey) = client.startAuthentication()
// The server shares Alice's salt and its public key (the challenge).
let (salt, serverPublicKey) = server.getChallenge()
// Alice generates a sessionKey and proofs she generated the correct
// session key based on her password and the challenge.
let clientKeyProof = try client.processChallenge(salt: salt, publicKey: serverPublicKey)
// The client verifies the server's proof.
try client.verifySession(keyProof: serverKeyProof)More information can be found in the documentation.
Swift 4 is required with version 3 of this package. Use version 2 if you need Swift 3 compatibility.
I like to believe this implementation correctly implements the RFC. However not all implementations do and might result in not being able to authenticate accross implementations. And subtle differences might result in low failure rates due to the randomness this protocol includes.
- Python: ❌ srp is not compatible; it doesn't correctly calculate
k. - Python: ✅ srptools is compatible.
- Nimbus: ✅ nimbus is compatible.
- Thinbus: ✅ thinbus is compatible.
- RFC 2945 - The SRP Authentication and Key Exchange System
- RFC 5054 - Using the Secure Remote Password (SRP) Protocol for TLS Authentication
This library was written originally by Bouke Haarsma and improved by Karim Karimov.