Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

RFC 2945 (The SRP Authentication and Key Exchange System) states,

The parameter u is a 32-bit unsigned integer which takes its value from the first 32 bits of the SHA1 hash of B, MSB first.

whereas the original publication describing SRP states that u is random.

What benefit is gained from using bits from a hash of B and restricting the size, rather than straight pseudorandom data?

share|improve this question
up vote 3 down vote accepted

The original article also states that: "For example, both sides can compute u as a simple function of B", which is what occurs in RFC 2945. u could be generated randomly and also transmitted, but deriving u from B (which is already transmitted) is harmless (security wise) and saves a few bytes (which is always good).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.