srp – A Go package for Secure Remote Password
srp is a Go language package for Secure Remote Password (SRP). It is an implementation of:
- RFC 2945: The SRP Authentication and Key Exchange System
- RFC 5054: Using the Secure Remote Password (SRP) Protocol for TLS Authentication
However, the hashing and padding scheme in this package is not interoperable with those specs.
It was developed by AgileBits to support part of the 1Password authentication process. Although there are some hooks and interfaces designed specifically for those purposes, this golang package may be of general use to others.
Get started
To install srp, use go get
:
go get github.com/1Password/srp
Although the focus of this implementation is safety and ease of use (as opposed to speed), like all cryptographic tools, some understanding of its operation is required to not shoot yourself in the foot.
Read the package documentation for a discussion of user security responsibilities.
Contribute
Issues are appreciated. Forks leading to pull requests are appreciated even more. 😎
Gosec scans
To run the securego/gosec tool you need to have that installed. Then simply
gosec -fmt=json -out=path/to/where/you/want/results.json ./...