Subject: One 'minor' security risk for SRP

From: Robert Moskowitz <[email-masked]>
Date: Tue, 06 Nov 2001 09:26:59 -0500

Back in May, an improved password-guessing attack was described on 
sci.crypt.  Basically it cuts the round trips for password-guessing by a 
rogue server by 50%.

http://groups.google.com/groups?q=srp+attack&hl=en&rnum=1&selm=23LI6.211291%24lj4.6039965%40news6.giganews.com

gets you there.

David Jablon pointed this out to me at the NIST key management schemes 
meeting.  He is active in IEEE p1363 where there is work to standardize on 
some strong password exchanges that SRP embodies.  David had the following 
about this attack:

Yeah, the thing I'm most "impressed" with is that
I and other's didn't see this so much earlier.

A quick fix, which I think both Tom and I saw immediately,
is to use something like hash(V) instead of V as the
obfuscator to break the symmetry.  Not so sure if this
helps or hurts any proof, but the difficulty of computing
the discrete log base g of hash(V) certainly seems to stop
this particular threat.

We at least should add words about this attack, and perferably work with 
Tom on changes to 2945.