Skip to content

Latest commit

 

History

History
41 lines (25 loc) · 1.43 KB

README.md

File metadata and controls

41 lines (25 loc) · 1.43 KB

OPAQUE.NET

Overview

DON'T STORE PASSWORDS!

This library is a .NET 5 / Core implementation of the OPAQUE protocol - a 2021 successor to the Secure Remote Password (SRP) protocol and others.

Targets:

  • .NET 5.0
  • .NET 2.0

Development Status

This library is under construction and is not yet ready for use.

Background

It is 2021 - you don't need to store passwords!

Perhaps you are using the Secure Remote Password (SRP) protocol, and that is better, BUT, SRP has a number of issues.

There is better mechanism available for password authentication - the OPAQUE protocol!

OPAQUE is an Asymmetric Password Authenticated Key Exchange (aPAKE) protocol that:

  • provides password authentication and mutually authenticated key exchange in a client-server setting;
  • does NOT rely on PKI (except during initial registration);
  • does NOT disclose passwords to servers or other entities other than the client machine;
  • is secure against pre-computation attacks; and
  • is capable of using a secret salt.

Resources