srp – A Go package for Secure Remote Password

srp is a Go language package for Secure Remote Password (SRP). It is an implementation of:

• RFC 2945: The SRP Authentication and Key Exchange System
• RFC 5054: Using the Secure Remote Password (SRP) Protocol for TLS Authentication

However, the hashing and padding scheme in this package is not interoperable with those specs.

It was developed by AgileBits to support part of the 1Password authentication process. Although there are some hooks and interfaces designed specifically for those purposes, this golang package may be of general use to others.

Get started

To install srp, use go get:

go get github.com/1Password/srp

Although the focus of this implementation is safety and ease of use (as opposed to speed), like all cryptographic tools, some understanding of its operation is required to not shoot yourself in the foot.

Read the package documentation for a discussion of user security responsibilities.

Contribute

Issues are appreciated. Forks leading to pull requests are appreciated even more. 😎

Gosec scans

To run the securego/gosec tool you need to have that installed. Then simply

gosec -fmt=json -out=path/to/where/you/want/results.json ./...