# Does SRP also authenticate the server to the client?

The Secure Remote Password (SRP) protocol lets a client prove to a server that it knows a specific password without revealing that password to the server. The server stores a cryptographic verifier for the user account. If an attacker impersonates as the server it cannot learn the user's password.

Now, does it also work the other way around. If a SRP password authentication succeeds, does that also prove to the client that the server knows the correct verifier, and thus assuming that the verifier was kept secret that the client is talking to the real server? (Or at least to the server that it originally gave the verifier to?)

Reading the protocol description I think it does, but as far as I can see the description nowhere mentions this property as something SRP is supposed to do. So maybe there is something I'm missing.

• The terminology you are looking for is "mutual authentication". This page at the Stanford site mentions that mutual authentication can be achieved. Sep 17 '15 at 13:31

According to the Stanford page mutual authentication can be provided if both sides keep their secrets secret. Thanks mikeazo.

• It requires a proof that the keys match, like described here. If only one party shows the other that they can use the key, the other is not authenticated.
– otus
Sep 17 '15 at 15:42

SRP confirms that the server knows the verifier. To elaborate on the comment by @otus the design document the server steps are:

    Host:  S = (Av^u) ^ b              (computes session key)
Host:  K = H(S)


Where K is the shared session key. Then the client and server prove that they have the same verifier:

 One possible way:
User -> Host:  M = H(H(N) xor H(g), H(I), s, A, B, K)
Host -> User:  H(A, M, K)
...
The user must show his proof of K first. If the server detects
that the user's proof is incorrect, it must abort without showing
its own proof of K.


If the server is fake then the client sends it A, M and it must respond to the client H(A, M, K). This means it must compute the correct K which requires the users verifier v matching the password being used by the user. If the server doesn't know the client verifier then it won't be able to send the client a good proof of K.

Whilst that is not authentication of the server it does protect the user from using a fake server that has not been able to steal verifiers from the real server.

• Thanks, this answer is better than the other because the "mutual authentication" property on srp.stanford.edu/advantages.html requires having a secret and verifier on each side.
– Labo
Aug 27 '20 at 12:07