I trying to use SRP algorithm but I have some questions:
Is that a good choice to use for registration and authorization SRP algorithm with SSL/TLS? And for all other transmission using just SSL/TLS? I will use C# Sockets for implementation.
How to generate g, k, N? Is it safe to use these like app constants?
Is that SRP algorithm right?
//M-modulus, g-generator, k-multiplier, I-username, p-password, s-salt, v-pass verifier
Registration:
Client: s = randomString(); x = Hash(s, p); v = g^x %N;
sendToServer(I, s, v);
Server: save(I, s, v);
Authorization:
Client: a = random(); A = g^a %N;
sendToServer(I, A);
Server: if(A != 0) { b=random(); B = k*v + g^b %N;}
sendToClient(B, s);
u = Hash(A, B);
if(u == 0) abortConnection();
Client: if(B == 0) abortConnection();
u = Hash(A, B);
if(u == 0) abortConnection();
x = Hash(s, p);
S = ((B - k*(g^x %N)) ^ (a + u*x)) %N;
K = Hash(S);
Mc = Hash( Hash(N) XOR Hash(g), Hash(I), s, A, B, K);
sendToServer(M);
Server: S = ((A*(v^u %N)) ^ B) %N; K = Hash(S);
Ms = Hash( Hash(N) XOR Hash(g), Hash(I), s, A, B, K);
if(Mc == Ms) {Rs = Hash(A, M, K); sendToClient(Rs);}
Client: Rc = Hash(A, M, K);
if(Rc == Rs) ALL_OK();