In SRP-6 $B$ is calculated as $B=kv+ g^b, k=3$. What is the purpose of $k$, and why was it fixed as $3$?

(In SRP-6a, this value $3$ is replaced by $k = H(N,g)$, but this question is about SRP-6.)

  • 2
    $\begingroup$ related: Why does SRP-6a use k = H(N, g) instead of the k = 3 in SRP-6? $\endgroup$ Commented Feb 12, 2013 at 9:48
  • $\begingroup$ Are you talking about SRP-6 or SRP-6a? It seems like 6a doesn't use k=3 like you claim. $\endgroup$ Commented Feb 12, 2013 at 9:59
  • $\begingroup$ Sorry my mistake SRP6 using k = 3, in SRP6a using k $\endgroup$
    – user236501
    Commented Feb 12, 2013 at 11:02
  • 1
    $\begingroup$ I edited the question to be more clear – please check that it still fits to your actual question. For SRP 6a, please refer to the question linked by ChodesInChaos. $\endgroup$ Commented Feb 12, 2013 at 20:03
  • $\begingroup$ Yes, I did went through the post already, but still don't quite get the answer. $\endgroup$
    – user236501
    Commented Feb 13, 2013 at 4:47

1 Answer 1


The purpose is to prevent a two-for-one guessing attack, where an active adversary, impersonating the server, can test two password guesses per attempt. The attack and why the multiplier prevents it is described in Section 2 of the SRP-6 paper (ps). (According to MacKenzie, it was discovered by Bleichenbacher.)

In brief, the attack goes like this:

  • Instead of $B = v + g^b = g^x + g^b$ with a random $b$, the attacker calculates $B = g^{x_1} + g^{x_2}$ with two password guesses.
  • The client uses the value $B - g^x$, meaning if $x=x_1$ they get $g^{x_2}$ and if $x=x_2$ they get $g^{x_1}$.
  • The attacker calculates two session keys, based on $x=x_1, b=x_2$ and $x=x_2, b=x_1$. If either of these matches with the $M_1$ sent by the client, they have found the password.

If the attacker does not know the discrete logarithm of $k$, i.e. the number $l$ for which $g^l = k$, they cannot try two guesses at once with the version 6 protocol where $v$ is multiplied by $k$.

The paper shows why $k=3$ is a safe choice for generic $g$ and $N$.

(The hashed $k$ fixes it for maliciously chosen $g$ and $N$ as well.)

  • $\begingroup$ I notice that there necessarily still exists a fast classical attack for any given $g$ and $N\hspace{-0.02 in}$. $\:$ It seems to me that using k = 3 + H(N,g,A) would make it plausible that there is no fast classical attack. $\:$ Is there a better reason than "it takes slightly more computation" for not doing that? $\;\;\;\;$ $\endgroup$
    – user991
    Commented Aug 19, 2014 at 20:46
  • $\begingroup$ @RickyDemer, isn't that just equivalent to switching to another $H$? I don't think it can help. $\endgroup$
    – otus
    Commented Aug 20, 2014 at 5:32
  • $\begingroup$ That's certainly not obviously equivalent, since it makes $k$ depend on the client's message. $\hspace{.91 in}$ $\endgroup$
    – user991
    Commented Aug 20, 2014 at 5:41
  • 1
    $\begingroup$ @RickyDemer, oh I missed that you added the $A$. I don't think the $3$ in your formula matters, but how is adding $A$ better than what SRP-6a does? $\endgroup$
    – otus
    Commented Aug 20, 2014 at 5:46
  • 1
    $\begingroup$ Whereas for SRP-6a one exists, but cannot be found quickly? I guess that would be an advantage, but not necessarily worth the cost of an extra hash on each run and serializing the protocol ($B$ cannot be calculated in advance). $\endgroup$
    – otus
    Commented Aug 20, 2014 at 6:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.