Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

SRP is designed to resist both active and passive attacks, how does SRP prevent man-in-middle and packet modification attacks?

share|improve this question
    
What do SRP mean? please give us reference or whole words! –  F. Hauri Feb 16 '13 at 11:53
    
@F.Hauri Secure Remote Password (SRP) is a well-known protocol. I guess OP assumed that most people would know what it is. –  Polynomial Feb 16 '13 at 12:43
    
If you read this page (with some elementary cryptography knowledge) you will get answers to most of your question : srp.stanford.edu/ndss.html –  user20851 Feb 16 '13 at 13:23
    
@Polynomial Sorry, I've heard about blackberry's Server Routing Protocol and Microsofts *Security Rollup Package`* for sample, who both could be subject of discuss on security.stackexchange.com... Anyway for disembiguation and readability, remember acronym meaning at least once in a question is not too mutch! –  F. Hauri Feb 16 '13 at 15:33
    
@user20851 yes I read that. –  user236501 Feb 17 '13 at 4:26

1 Answer 1

SRP is a Password-Authenticated Key Exchange algorithm. One flawed but simple way to see it is that client and server share a secret, on which the algorithm expands; an attacker trying a man-in-the-middle attack does not know the secret, and cannot successfully impersonate either the client or the server (or both, in a true MitM).

What I describe above is "just" using the password as a (pre-shared) key. PAKE algorithms go a bit further, with a lot of mathematics, to be able to tolerate a shared secret of low entropy (namely, the password): an attacker observing the exchange, or even trying to impersonate the client or the server, does not learn anything which would allow him to "try passwords at home" (i.e. he does not get out of the algorithm a hash of the password), something called an offline dictionary attack. This is done with a subtle dance with a classical key exchange and a commitment.

Simplest to understand is Encrypted Key Exchange in which the exchange is a normal Diffie-Hellman, but client and server both "encrypt" what they send with the password. The "encryption" algorithm must be such that decrypting with the wrong password still yields something which looks like a normal DH message (another element of the group). An attacker who wants to run an offline dictionary attack will want to "retarget" a given exchange, by doing something which amounts to "let's imagine that for this past exchange, I had used password P". With EKE, any "retarget" with another password than the one he indeed used leaves the attacker outside of the DH key exchange, preventing him from obtaining the DH session key and testing his password hypothesis.

(I said "simplest to understand", not "simple". It takes some time to cryptographers to wrap their mind around what really happens in PAKE algorithms, which a friend of mine had once described as "a small miracle".)

Anyway, a PAKE algorithm is a key exchange and results in a shared key K. It is still up to client and server to use K to encrypt and protect subsequent data packets, using the usual paraphernalia of symmetric encryption and MAC. This is why SRP is best used as part of SSL/TLS, the latter providing the mechanisms for tunneling long streams of data.

share|improve this answer
    
Can I claims that SRP can prevent attacker who trying impersonate either client or server. But it doesn't protect the data subsequently. Attacker still can perform packet modification attack? Using SRP/TLS, TLS will create a secure channel. –  user236501 Feb 17 '13 at 4:28
    
If the exchanged data will be encrypted using the shared key, it only prevent the mitm attack but not integrity right? –  user236501 Feb 17 '13 at 6:15
    
SRP is a key exchange algorithm; it establishes a shared key. SRP does not deal with "data". To protect data, you need a transmission protocol which will use a key exchange algorithm at its start (e.g. SRP) and then other algorithms for encryption and integrity of the actual data which is to be transmitted. TLS+SRP is such a protocol (and it applies both encryption and MAC on the data, so integrity is protected as well). –  Thomas Pornin Feb 17 '13 at 14:25
    
Yes I knew this just, said if not using the TLS, but the subsequently exchanged data will be encrypted using some of the encryption algorithm. –  user236501 Feb 17 '13 at 14:42

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.