Why does the Secure Remote Protocol have resistance of dictionary attack?

Question

Assume that Eeve who masquerades as a legitimate host and convinces Carol to make an authentication attempt. (Carol wants to handshake with Steve – a host)

Thus, Eve can get values $A = g^a, M1 = H(A,B',K')$

For a guessing password $P'$, Eve can calculate the following :

$x' = H(s,P') \rightarrow v' = g^{x'}$ (Eve can get random string $s$ in previous run)
$S' = (A(v')^u )^b = (g^a \times g^{ux'} )^b = g^{(ab +bux')}$
$K' = H(S')$.

If Carol's proof of key and Eve's are matched, the password guessed is correct. Hence, If the correct password of Carol is in Eve's dictionary, Eve can get the password.

I read “Thomas Wu, The Secure Remote Password Protocol”… but that paper tells me SRP is safe against dictionary attack.

What am I missing?

Answer 1

The property of SRP is that:

• If the attacker is a passive listener to an exchange between a client and a server, he learns nothing about the shared password

• If the attacker is a participant in the exchange with either a client or a server with the password (or modifies the exchange between the client and the server), the attacker learns nothing except for the validity of one password.

What you point out is that, if the attacker mimics the server, he can check on a single guess to the password. There is a similar attack if the attacker mimics the client; he takes this guess at the password, and runs through the protocol with his guess; if he succeeds, his guess was correct.

Why do we accept such a vulnerability? It's because it is inevitable given the assumptions. For any protocol whose sole authentication is based on a shared password, the attacker could always take his guess at the password, and run the protocol with someone with the valid password. If it succeeds, his guess was right.

Now, why is this vulnerability considered acceptable? Well, if the attacker's dictionary contained one million entries, then this would require one million exchanges with someone. This is considerably more costly then being able to do one (or several) exchanges, take the results, and then use a GPU farm (or botnet) to attack it offline.