On 11/14/2010 5:35 PM, Brad Pepers wrote:

>
> The original SRP was 3 round trips but you can trivially get it down to 2 so you are only paying for one more round trip to get mutual authentication. If you really want to save the latency, you can get it down to 1.5 round trips so you are only paying for one extra message but this only gives you one-way authentication of the client to the server. To me the added latency of one extra round trip isn't much of an issues when it's only needed at the start and it gives you mutual authentication and a secure session key.
>
> Here is a good link on SRP including the round-trip optimization:
>
> http://srp.stanford.edu/ndss.html
>

That is an excellent article, indeed. I recommend it highly to anyone
with even a passing interest in the subject.


--
Jim Starkey
Founder, NimbusDB, Inc.
978 526-1376