Re: Some SRP issues

[nisse%lysator.liu.se@localhost (Niels Möller)]

Tom Wu <tom%arcot.com@localhost> writes:

> Worst case, if the attacker feeds the client a "booby-trapped" safe
> prime that he can do fast DL in, then he can extract the client's secret
> "a".  He then sends some random string in place of B, gets the client's
> response hash, and then can run through a list of passwords, guessing
> possible passwords and checking them against the client's response.  The
> defense is to accept only known, safe parameters (like the Oakley/IPSec
> moduli) or at least allow only parameters that pass verification *and*
> are sufficiently long.

Thanks.

I don't feel terribly good about requiring the client to check that
some prime provided by the server is safe. So I'd prefer a hard coded
list (which can be expanded as time goes by).

/Niels