SRP (Secure Remote Password)
SRP is a 1990s password-authenticated key exchange that lets clients log in without sending the password. It was the workhorse aPAKE for two decades and is now superseded by OPAQUE (RFC 9807).
Encryption and sign-in
SRP-6a advanced the state of the art enormously: the server stores a verifier rather than the password, and eavesdroppers learn nothing usable. Its age shows in the details — it lacks a modern security proof, leaks the salt to unauthenticated parties (enabling precomputation against a later breach), resists safe instantiation on modern elliptic curves, and its verifier is offline-crackable once stolen.
OPAQUE addresses each of those: proofs in the UC framework (random oracle model), no salt disclosure (the OPRF hides it), curve-native operation, and breach resistance (a stolen database alone gives nothing to test guesses against). Ciphera’s sign-in ran SRP-6a until June 2026, when it completed the move to OPAQUE; SRP remains in this glossary because so much deployed software still speaks it.