Secure Remote Password implementation for GWT
is an augmented password-authenticated key agreement (PAKE) protocol
An eavesdropper or man in the middle cannot obtain enough information to be able to brute force guess a password without further interactions with the parties for each guess. This means that strong security can be obtained using weak passwords. Furthermore, being an augmented PAKE protocol, the server does not store password-equivalent data. This means that an attacker who steals the server data cannot masquerade as the client unless they first perform a brute force search for the password. In layman's terms, during SRP (or any other PAKE protocol) authentication, one party (the "client" or "user") demonstrates to another party (the "server") that they know the password, without sending the password itself, nor any other information from which the password can be broken. The password never leaves the client and is unknown to the
The SRP protocol creates a large private key shared between the two parties in a manner similar to Diffie–Hellman key exchange based on the client side having the user password and the server side having a cryptographic verifier derived from the password. The shared public key is derived from two random numbers, one generated by the client, and the other generated by the server, which are unique to the login attempt. In cases where encrypted communications as well as authentication are required, the SRP protocol is more secure than the alternative SSH protocol and faster than using Diffie–Hellman key exchange with signed messages. It is also independent of third parties, unlike Kerberos. The SRP protocol, version 3 is described in RFC 2945. SRP version 6 is also used for strong password authentication in SSL/TLS[2] (in TLS-SRP) and other standards such as EAP[3] and SAML, and is being standardized in IEEE P1363 and ISO/IEC 11770-4.
It is necessary to always use SSL together with SRP since a man-in-the-middle could otherwise inject custom javascript that gets the password directly from the user. Do not use trust this code without carefully verifying that the implementation is in fact correct.
https://github.com/Legioth/Srp4Gwt
GwtCrypto https://code.google.com/archive/p/gwt-crypto/
https://gist.github.com/kevzlou7979/8e2ba1bf53c55614063800df1d4d142a