The source I have is just like the Lua that runs the website. Everything else is standards based and totally open source. As I say in the about page, I'm using:
http://srp.stanford.edu/ as the protocol, specifically SRP6a but with a SHA256 since I couldn't get a MGF1 to work in javascript. Probably change that later.
Clipperz also has a PHP SRP implementation, but it accepts any A = 0 mod N and thus allows people to log in without knowing their passwords, which is a nice feature but maybe not what you want in a secure auth scheme.
Comments
The source I have is just like the Lua that runs the website. Everything else is standards based and totally open source. As I say in the about page, I'm using:
http://srp.stanford.edu/ as the protocol, specifically SRP6a but with a SHA256 since I couldn't get a MGF1 to work in javascript. Probably change that later.
http://srp.stanford.edu/download.html as the actual implementation. Yes, I'm using that C library.
http://crypto.stanford.edu/sjcl/ for the javascript crypto, also written by the same people doing SRP.
And you can read the javascript files on the site to see what it's doing.
So, it's based on entirely standards based (even has an RFC) open source protocols and uses implementations from the actual authors of said protocols.
The closed source part is just my lua Tir stuff and whatever else I make.
I've collected a few links related to JS cryptography, might be useful: http://disattention.com/13/javascript-cryptography/
There is another SRP implementation in JS+PHP: http://www.denksoft.com/wordpress/web-development/secure-aja...
We definitely need more SRP implementations, glad to see more people working on it.
Clipperz also has a PHP SRP implementation, but it accepts any A = 0 mod N and thus allows people to log in without knowing their passwords, which is a nice feature but maybe not what you want in a secure auth scheme.