Investigate using modern ZKPPs

[KellerFuchs]

It seems that newer ZKPPs than SRP, namely SPAKE2+, use modern crypto and are provably secure.
Moreover, there is a pull request to add an implementation in the Stanford JS Crypto Library.

The goal is to have both:

• not relying on the communication channel to the (auth) server being secure;
• not storing information on the server that is sufficient to impersonate a user.

[KellerFuchs]

Looks like what we would want here is a so-called Augmented PAKE.

[KellerFuchs]

@lrvick I'm tempted to simply modify AugPAKE to use an elliptic curve instead of a Z/nZ group.
This would trivially preserve the security proof, to boot.
(We lose pwh's current “post-quantumness”, but only for preventing people with the DB from impersonating clients; the passwords still get a pretty-much “Oh My God” security level)

On the other hand, homebaked crypto is not something I would relish recommending...