5
$\begingroup$

The Secure Remote Password (SRP) protocol lets a client prove to a server that it knows a specific password without revealing that password to the server. The server stores a cryptographic verifier for the user account. If an attacker impersonates as the server it cannot learn the user's password.

Now, does it also work the other way around. If a SRP password authentication succeeds, does that also prove to the client that the server knows the correct verifier, and thus assuming that the verifier was kept secret that the client is talking to the real server? (Or at least to the server that it originally gave the verifier to?)

Reading the protocol description I think it does, but as far as I can see the description nowhere mentions this property as something SRP is supposed to do. So maybe there is something I'm missing.

Improve this question
$\endgroup$
1
  • 1
    $\begingroup$ The terminology you are looking for is "mutual authentication". This page at the Stanford site mentions that mutual authentication can be achieved. $\endgroup$
    – mikeazo
    Commented Sep 17, 2015 at 13:31

2 Answers 2

Reset to default
1
$\begingroup$

According to the Stanford page mutual authentication can be provided if both sides keep their secrets secret. Thanks mikeazo.

Improve this answer
$\endgroup$
1
  • 1
    $\begingroup$ It requires a proof that the keys match, like described here. If only one party shows the other that they can use the key, the other is not authenticated. $\endgroup$
    – otus
    Commented Sep 17, 2015 at 15:42
1
$\begingroup$

SRP confirms that the server knows the verifier. To elaborate on the comment by @otus the design document the server steps are: 

    Host:  S = (Av^u) ^ b              (computes session key)
    Host:  K = H(S)

Where K is the shared session key. Then the client and server prove that they have the same verifier: 

 One possible way:
 User -> Host:  M = H(H(N) xor H(g), H(I), s, A, B, K)
 Host -> User:  H(A, M, K)
 ...
 The user must show his proof of K first. If the server detects 
 that the user's proof is incorrect, it must abort without showing 
 its own proof of K.

If the server is fake then the client sends it A, M and it must respond to the client H(A, M, K). This means it must compute the correct K which requires the users verifier v matching the password being used by the user. If the server doesn't know the client verifier then it won't be able to send the client a good proof of K.

Whilst that is not authentication of the server it does protect the user from using a fake server that has not been able to steal verifiers from the real server.

Improve this answer
$\endgroup$
1
  • $\begingroup$ Thanks, this answer is better than the other because the "mutual authentication" property on srp.stanford.edu/advantages.html requires having a secret and verifier on each side. $\endgroup$
    – Labo
    Commented Aug 27, 2020 at 12:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.