# Why is SRP considered to be resistant to MITM attack?

Why is SRP considered to be resistant to MITM attack? Documentation says

A man-in-the-middle attack, which requires an attacker to fool both sides of a legitimate conversation, cannot be carried out by an attacker who does not know Carol's password. An attacker who does not know x cannot fool Steve into thinking he is talking to Carol, so at least one half of the deception fails. If the attacker doesn't know v either, he is in worse shape, because he also can't fool Carol into believing that she is communicating with Steve.

But let's assume Carol, Steve and MITM have salt, generator and safe prime. And imagine the Carol trying to log in, but MITM stands between Carol and Steve.

1) Carol sends A, but MITM takes it and sends to Steve.

2) Steve responds to MITM with B. MITM sends it back to Carol.

3) Both Carol and Steve create a common key(K).

4) Carol sends Steve h(K,s1), where h is a one way hash function and s1 is some salt that was given to Carol by Steve. MITM takes it and sends it to Steve.

5) Steve checks it and say "Hello Carol, nice to meet you".

So MITM can log to the server by sending requests back and forth.

• In your attack, what does the MITM learn? As far as I can see, he's forwarding all messages unaltered (and so he's just acting as a passive evesdropper). He is certainly allowed to do that, however unless he achieves something from the exercise, there's no point... – poncho Mar 14 '17 at 16:34
• MITM can log to the server after that. – Tony Mar 14 '17 at 16:42
• The MITM doesn't learn the negotiated key from that, so how can he log in? – SEJPM Mar 14 '17 at 16:43
• If key is used just to know if both sides have the same value and no further encryption is provided, MITM can log. – Tony Mar 14 '17 at 16:51
• It is assumed that Carol and Steve will continue to communicate securely, using K as a key to protect the communication. – poncho Mar 14 '17 at 16:57