Class SRP6KeyAgreement

The Secure Remote Password (SRP) key agreement protocol, also known as SRP-6, is designed by Thomas J. Wu (see references). The protocol, and its elements are described as follows:

 N    A large safe prime (N = 2q+1, where q is prime)
      All arithmetic is done modulo N.
 g    A generator modulo N
 s    User's salt
 I    Username
 p    Cleartext Password
 H()  One-way hash function
 ^    (Modular) Exponentiation
 u    Random scrambling parameter
 a,b  Secret ephemeral values
 A,B  Public ephemeral values
 x    Private key (derived from p and s)
 v    Password verifier

 The host stores passwords using the following formula:
 x = H(s | H(I ":" p))           (s is chosen randomly)
 v = g^x                   (computes password verifier)

 The host then keeps {I, s, v} in its password database.

 The authentication protocol itself goes as follows:
 User -> Host:  I, A = g^a         (identifies self, a = random number)
 Host -> User:  s, B = 3v + g^b    (sends salt, b = random number)

 Both:  u = H(A, B)

 User:  x = H(s, p)                (user enters password)
 User:  S = (B - 3g^x) ^ (a + ux)  (computes session key)
 User:  K = H(S)

 Host:  S = (Av^u) ^ b             (computes session key)
 Host:  K = H(S)
 

Reference:

1. SRP Protocol Design
   Thomas J. Wu.

Version: $Revision: 1.3 $