Why is SRP considered to be resistant to MITM attack? Documentation says

A man-in-the-middle attack, which requires an attacker to fool both sides of a legitimate conversation, cannot be carried out by an attacker who does not know Carol's password. An attacker who does not know x cannot fool Steve into thinking he is talking to Carol, so at least one half of the deception fails. If the attacker doesn't know v either, he is in worse shape, because he also can't fool Carol into believing that she is communicating with Steve.

But let's assume Carol, Steve and MITM have salt, generator and safe prime. And imagine the Carol trying to log in, but MITM stands between Carol and Steve.

1) Carol sends A, but MITM takes it and sends to Steve.

2) Steve responds to MITM with B. MITM sends it back to Carol.

3) Both Carol and Steve create a common key(K).

4) Carol sends Steve h(K,s1), where h is a one way hash function and s1 is some salt that was given to Carol by Steve. MITM takes it and sends it to Steve.

5) Steve checks it and say "Hello Carol, nice to meet you".

So MITM can log to the server by sending requests back and forth.

  • 1
    $\begingroup$ In your attack, what does the MITM learn? As far as I can see, he's forwarding all messages unaltered (and so he's just acting as a passive evesdropper). He is certainly allowed to do that, however unless he achieves something from the exercise, there's no point... $\endgroup$
    – poncho
    Mar 14, 2017 at 16:34
  • $\begingroup$ MITM can log to the server after that. $\endgroup$
    – Tony
    Mar 14, 2017 at 16:42
  • $\begingroup$ The MITM doesn't learn the negotiated key from that, so how can he log in? $\endgroup$
    – SEJPM
    Mar 14, 2017 at 16:43
  • $\begingroup$ If key is used just to know if both sides have the same value and no further encryption is provided, MITM can log. $\endgroup$
    – Tony
    Mar 14, 2017 at 16:51
  • 1
    $\begingroup$ It is assumed that Carol and Steve will continue to communicate securely, using K as a key to protect the communication. $\endgroup$
    – poncho
    Mar 14, 2017 at 16:57

1 Answer 1


As has already been commented:

The fact that you can intercept and relay all messages does not actually constitute an attack on the protocol because you do not know the shared key afterwards. If the protocol partners encrypt their traffic with that key you cannot eavesdrop on it.

If this was an attack on the protocol none of the network hardware that is commonly used would be allowed to work because forwarding messages is exactly what it does.

Indeed, that means that participating in the protocol by relaying messages does not suffice for authentication.

Edit: It would be like thinking that all of your letters have been sent by the mail man. ;)


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.