Secure Remote Password (SRP)

[martinmcclure]

Many possible applications of RSR (and some existing applications) require authentication of connections. The SRP protocol has some good properties that make it desirable for this purpose:

• Already used by GemStone for username/password logins
• Supported by OpenSSL starting with version 1.0.1
• The server does not store any form of the password, just a salt and a verifier, from which the password cannot be derived
• The authentication handshake is immune to eavesdropping and man-in-the-middle attacks
• If desired, successful authentication results in an encrypted connection

This wouldn't necessarily have to be a part of the core RSR framework -- it seems likely to be possible to implement it as part of a suite of services that support various authentication methods. Some hooks into the RSR framework would likely be required.