I'm deploying a secure remote password protocol implementation and I'm wondering what the consequences are when the client generated verifier gets leaked to an attacker. I've read Thomas Wu's paper and as nice as it is, it doesn't talk about that scenario. I also read RFC 5054 and it has the assertion:
If an attacker learns a user's SRP verifier (e.g., by gaining access to a server's password file), the attacker can masquerade as the real server to that user, and can also attempt a dictionary attack to recover that user's password.
If the client is using the verifier as assurance of the server's identity, I can see how that would go badly. It's the second assertion of a dictionary attack that makes me wonder.
x = H(s, P) v = g^x mod n
How much effort would it take to solve for P without knowing x? It seems like the implied mod of n totally obscures x. And then, there should be many values of P that could generate a v, but a much smaller set that would pass the verification stage.
And if a dictionary attack could find the password, how is this better than a shared secret protocol? Is the dictionary attack mentioned in the RFC just saying "if I had an infinite speed computer I could really ruin your day?" Or does it mean it could run a dictionary attack on the client while pretending to be the server?