1

Let's assume that attacker knows verifier, so now he can commit MitM attack.

1) Client sends A to Server

2) MITM takes it and sends B to client

While MITM knows the verifier, he also can compute the secret key. So every message from client encrypted by that key is not safe. How to deal with that?

If you don't know what is A and B, please take a look at documentation.

closed as off-topic by Matthew, Anders, Rory Alsop Mar 15 '17 at 15:41

  • This question does not appear to be about Information security within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

  • I think you may be better off asking this over on crypto. Edit: whoops, looks like you did. – MiaoHatola Mar 14 '17 at 19:17
  • 1
    I'm voting to close this question as off-topic because it is a cross post that fits better on Cryptography. – Anders Mar 15 '17 at 12:55