# Tag Info

2

Yes, it's okay. This is actually mentioned in passing in the SRP 6 design paper. Previous versions used a random $u$ where an attacker who saw (or could predict) it before revealing $A$ could compute $A = g^a v^{-u}$ and use this to effectively cancel out the long term secret. With $u$ derived from a hash, even if the attacker saw $B$, the dependence of $u$ ...

2

SRP with the user's key = 0 is identical to DH. SRP with a publicly known key is identical to DH with a constant multiplier. For private key $x$, user ephemeral value $a$, server ephemeral value $b$, and $u$ derived from shared values, SRP ends up calculating the value $g^{ab + uxa}$ (which is then typically hashed to get the shared key). If $x$ is zero, ...

1

SRP protocol is quite abstract so to provide matching implementation for version 6a you need to know following: N, g - group parameters H - hash function, there can be different hash functions used for different values how is private key x calculated how is shared session key K calculated how are evidence messages (M1, M2) calculated In addition you need ...

Only top voted, non community-wiki answers of a minimum length are eligible