kellerfuchs / pwh Goto Github PK

Hash schemes may be serialized as JSON, in a format described in English.

We should:

1. define that the RFC 7493 interoperable subset of JSON is used;
2. provide JSON schemas and example validation code for:

• the (trivial) base format;
• the KDFs used by the recommended schemes.

The recommended hash schemes should come with performance figures on multiple platforms:

• amd64 server/desktop;
• arm64 mobile device;
• arm embedded device.

It seems that newer ZKPPs than SRP, namely SPAKE2+, use modern crypto and are provably secure.
Moreover, there is a pull request to add an implementation in the Stanford JS Crypto Library.

The goal is to have both:

• not relying on the communication channel to the (auth) server being secure;
• not storing information on the server that is sufficient to impersonate a user.