Glossary · Cryptography & authentication
SRP (Secure Remote Password)
SRP is a 1990s password-authenticated key exchange that lets clients log in without sending the password. It was the workhorse aPAKE for two decades and is now superseded by OPAQUE (RFC 9807).
SRP-6a advanced the state of the art enormously: the server stores a verifier rather than the password, and eavesdroppers learn nothing usable. Its age shows in the details — it lacks a modern security proof, leaks the salt to unauthenticated parties (enabling precomputation against a later breach), resists safe instantiation on modern elliptic curves, and its verifier is offline-crackable once stolen.
OPAQUE addresses each of those: proofs in a standard model, no salt disclosure (the OPRF hides it), curve-native operation, and breach resistance that forces per-guess online interaction. Ciphera ID ran SRP-6a historically and completed a full migration to OPAQUE in June 2026; SRP remains in this glossary because so much deployed software still speaks it.