In SRP-6 $B$ is calculated as $B=kv+ g^b, k=3$. What is the purpose of $k$, and why was it fixed as $3$?
(In SRP-6a, this value $3$ is replaced by $k = H(N,g)$, but this question is about SRP-6.)
$\begingroup$
$\endgroup$
5
-
2$\begingroup$ related: Why does SRP-6a use k = H(N, g) instead of the k = 3 in SRP-6? $\endgroup$– CodesInChaosFeb 12, 2013 at 9:48
-
$\begingroup$ Are you talking about SRP-6 or SRP-6a? It seems like 6a doesn't use k=3 like you claim. $\endgroup$– CodesInChaosFeb 12, 2013 at 9:59
-
$\begingroup$ Sorry my mistake SRP6 using k = 3, in SRP6a using k $\endgroup$– user236501Feb 12, 2013 at 11:02
-
1$\begingroup$ I edited the question to be more clear – please check that it still fits to your actual question. For SRP 6a, please refer to the question linked by ChodesInChaos. $\endgroup$– Paŭlo EbermannFeb 12, 2013 at 20:03
-
$\begingroup$ Yes, I did went through the post already, but still don't quite get the answer. $\endgroup$– user236501Feb 13, 2013 at 4:47
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
6
The purpose is to prevent a two-for-one guessing attack, where an active adversary, impersonating the server, can test two password guesses per attempt. The attack and why the multiplier prevents it is described in Section 2 of the SRP-6 paper (ps). (According to MacKenzie, it was discovered by Bleichenbacher.)
In brief, the attack goes like this:
- Instead of $B = v + g^b = g^x + g^b$ with a random $b$, the attacker calculates $B = g^{x_1} + g^{x_2}$ with two password guesses.
- The client uses the value $B - g^x$, meaning if $x=x_1$ they get $g^{x_2}$ and if $x=x_2$ they get $g^{x_1}$.
- The attacker calculates two session keys, based on $x=x_1, b=x_2$ and $x=x_2, b=x_1$. If either of these matches with the $M_1$ sent by the client, they have found the password.
If the attacker does not know the discrete logarithm of $k$, i.e. the number $l$ for which $g^l = k$, they cannot try two guesses at once with the version 6 protocol where $v$ is multiplied by $k$.
The paper shows why $k=3$ is a safe choice for generic $g$ and $N$.
(The hashed $k$ fixes it for maliciously chosen $g$ and $N$ as well.)
-
$\begingroup$ I notice that there necessarily still exists a fast classical attack for any given $g$ and $N\hspace{-0.02 in}$. $\:$ It seems to me that using
k = 3 + H(N,g,A)would make it plausible that there is no fast classical attack. $\:$ Is there a better reason than "it takes slightly more computation" for not doing that? $\;\;\;\;$ $\endgroup$– user991Aug 19, 2014 at 20:46 -
$\begingroup$ @RickyDemer, isn't that just equivalent to switching to another $H$? I don't think it can help. $\endgroup$– otusAug 20, 2014 at 5:32
-
$\begingroup$ That's certainly not obviously equivalent, since it makes $k$ depend on the client's message. $\hspace{.91 in}$ $\endgroup$– user991Aug 20, 2014 at 5:41
-
1$\begingroup$ @RickyDemer, oh I missed that you added the $A$. I don't think the $3$ in your formula matters, but how is adding $A$ better than what SRP-6a does? $\endgroup$– otusAug 20, 2014 at 5:46
-
1$\begingroup$ Whereas for SRP-6a one exists, but cannot be found quickly? I guess that would be an advantage, but not necessarily worth the cost of an extra hash on each run and serializing the protocol ($B$ cannot be calculated in advance). $\endgroup$– otusAug 20, 2014 at 6:36