Shared-key and anonymous authentication
***************************************

In addition to certificate authentication, the TLS protocol may be used with password, shared-key and anonymous authentication methods. The rest of this chapter discusses details of these methods.

SRP authentication
==================

Authentication using SRP
------------------------

GnuTLS supports authentication via the Secure Remote Password or SRP protocol (see RFC2945,TOMSRP for a description). The SRP key exchange is an extension to the TLS protocol, and it provides an authenticated with a password key exchange. The peers can be identified using a single password, or there can be combinations where the client is authenticated using SRP and the server using a certificate.

The advantage of SRP authentication, over other proposed secure password authentication schemes, is that SRP is not susceptible to off-line dictionary attacks. Moreover, SRP does not require the server to hold the user's password. This kind of protection is similar to the one used traditionally in the UNIX /etc/passwd file, where the contents of this file did not cause harm to the system security if they were revealed.  The SRP needs instead of the plain password something called a verifier, which is calculated using the user's password, and if stolen cannot be used to impersonate the user.

Typical conventions in SRP are a password file, called tpasswd that holds the SRP verifiers (encoded passwords) and another file, tpasswd.conf, which holds the allowed SRP parameters.  The included in GnuTLS helper follow those conventions. The srptool program, discussed in the next section is a tool to manipulate the SRP parameters.

The implementation in GnuTLS is based on TLSSRP. The supported key exchange methods are shown below.

SRP:
     Authentication using the SRP protocol.

SRP_DSS:
     Client authentication using the SRP protocol. Server is authenticated using a certificate with DSA parameters.

SRP_RSA:
     Client authentication using the SRP protocol. Server is authenticated using a certificate with RSA parameters.

gnutls_srp_verifier

gnutls_srp_base64_encode,gnutls_srp_base64_decode

     [file invoke-srptool.texi not included]

PSK authentication
==================

Authentication using PSK
------------------------

Authentication using Pre-shared keys is a method to authenticate using usernames and binary keys. This protocol avoids making use of public key infrastructure and expensive calculations, thus it is suitable for constraint clients.

The implementation in GnuTLS is based on TLSPSK. The supported PSK key exchange methods are:

PSK:
     Authentication using the PSK protocol.

DHE-PSK:
     Authentication using the PSK protocol and Diffie-Hellman key exchange.  This method offers perfect forward secrecy.

ECDHE-PSK:
     Authentication using the PSK protocol and Elliptic curve Diffie-Hellman key exchange.  This method offers perfect forward secrecy.

Helper functions to generate and maintain PSK keys are also included in GnuTLS.

gnutls_key_generate,gnutls_hex_encode,gnutls_hex_decode

     [file invoke-psktool.texi not included]

Anonymous authentication
========================

The anonymous key exchange offers encryption without any indication of the peer's identity.  This kind of authentication is vulnerable to a man in the middle attack, but can be used even if there is no prior communication or shared trusted parties with the peer. Moreover it is useful when complete anonymity is required. Unless in one of the above cases, do not use anonymous authentication.

The available key exchange algorithms for anonymous authentication are shown below, but note that few public servers support them. They typically have to be explicitly enabled.

ANON_DH:
     This algorithm exchanges Diffie-Hellman parameters.

ANON_ECDH:
     This algorithm exchanges elliptic curve Diffie-Hellman parameters. It is more efficient than ANON_DH on equivalent security levels.