go-tls-srp¶
go-tls-srp is a Go library for TLS-SRP: TLS 1.2 with the Secure Remote Password key exchange of
RFC 5054. Its package srptls has a client and a server.
The client proves that it knows a password. The server stores only a verifier derived from the
password, needs no certificate and proves to the client that it holds the verifier.
Go's crypto/tls has no SRP. This module is a trimmed copy of crypto/tls from Go 1.27.2 that keeps
only the SRP handshake, so its API follows crypto/tls: a Config, a Conn that implements
net.Conn, Client, Server, Listen and ConnectionState. It is written for systems that already
use TLS-SRP, such as EST enrollment (RFC 7030) with
certificate-less mutual authentication.
go get github.com/misiektoja/go-tls-srp
The module needs Go 1.27.3 or newer. It depends on
filippo.io/bigmod for the SRP arithmetic and on
golang.org/x/crypto/cryptobyte for message parsing. The package name differs from the module path,
so import it with a name:
import srptls "github.com/misiektoja/go-tls-srp"
Where to go next¶
| I want to | Page |
|---|---|
| Run a server and a client on my machine | Getting started |
| See which versions, cipher suites, groups and extensions are supported | Support matrix |
| Understand the handshake and how the code is organized | Architecture |
| Accept TLS-SRP clients | Running a server |
| Sign in to a TLS-SRP server | Connecting as a client |
| Create, store or import verifiers | Verifiers and groups |
| Hide which usernames exist or refuse a client | Unknown usernames and refusals |
| Bind an EST request to the TLS connection | Channel binding and Extended Master Secret |
| Look up a field, a default or an error | Configuration, Connection state and Errors and alerts |
| Find out which implementations were tested | Tested implementations |
| Know what the library protects and what it leaves to me | Security model |
| Check what is not supported | Known limitations |
| Look up a type or function | Package documentation |
| See what changed in a release | Release notes |
| Report a vulnerability | Security policy |
| Contribute | Contributing |
Related projects¶
Other PKI projects from the same maintainer:
- certrally: a command line client for certificate enrollment over CMP, EST and SCEP
- cmp-issuer: a cert-manager external issuer for CMP servers
- go-acme-server: an embeddable ACME server library for Go (RFC 8555)
- go-pki-cmp: a Go library for the Certificate Management Protocol (CMP) with a client and a server
- go-pki-est: a Go library for Enrollment over Secure Transport (EST, RFC 7030) with a client and a server
- go-pki-scep: a Go library for SCEP (RFC 8894) with a client and a server handler
- go-pkcs7: a Go library for PKCS #7 and CMS (RFC 5652) signed and enveloped data
- go-composite-mldsa: a Go library for post-quantum composite ML-DSA signatures