# Question on SRP implementation

I'm comparing the Wikipedia description of SRP to the BouncyCastle implementation and some differences and I want to be sure the BouncyCastle implementation is suitable for my purpose.

The article has a a description of how M1 and M2 are calculated:

M1 = H[H(N) XOR H(g) | H(I) | s | A | B | K_Carol] M2 = H(A | M1 | K_Steve)

Note that M1 is a rather elaborate calculation involving XOR'ing the hash of N and g, as well as including a hash of "I" inside the outer M1-hash etc. I always wondered about this strange occurence of XOR'ing etc. - it is probably OK but why not just N or g directly in the hash calculation, since all other calculations in the protocol are based around hash (not XOR) and it is going to be a constant anyway. Further, protocol even previously calculates k = H(N,g), which is exactly a hash of N and g, so it is strange why this could not be used here.

But the article also offers an alternative: "Alternatively, in a password-only proof the calculation of K can be skipped and the shared S proven with:

M1 = H(A | B | S) M2 = H(A | M1 | S)

Notable differences is that M1 doesn't include N and g at all (and so not the strange XOR expression). There are also other differences - the hash of I is not included either and instead of using K in the calculation (with K = hash(S)), S is used directly in this case.

In my case I need not just to prove knowledge of the password but also to end up with an encryption key the client can use to submit sensitive data (in the successful case). I would prefer to use BouncyCastle. BouncyCastle seems to implement it as the simplified password-proof only case, and then returns the session key as K = H(S).

Note that the constructions are also different with respect to how K and S is used. Wikipedia has M1 = H(A | B | K) and M2 = H(A | M1 | K) (again where K = H(S)) whereas in BouncyCastle has M1 = H(A | B | S) and M2 = H(A | M1 | S) and then releases K = H(S) as the session key to be used for encryption/decryption after authentication.

My question is basically: Is the BouncyCastle approach safe in this situation (using the protocol to prove mutual knowledge of the password and, if successful, using the resulting session key for sending data), despite the fact the BouncyCastle implementation seems to follow the case Wikipedia refers to as password-proof only (and doesn't have all the XOR goo etc.).