  We analyze the Secure Remote Password (SRP) protocol for structural
weaknesses using the Cryptographic Protocol Shapes Analyzer (CPSA) in the first
formal analysis of SRP (specifically, Version 3).
  SRP is a widely deployed Password Authenticated Key Exchange (PAKE) protocol
used in 1Password, iCloud Keychain, and other products. As with many PAKE
protocols, two participants use knowledge of a pre-shared password to
authenticate each other and establish a session key. SRP aims to resist
dictionary attacks, not store plaintext-equivalent passwords on the server,
avoid patent infringement, and avoid export controls by not using encryption.
Formal analysis of SRP is challenging in part because existing tools provide no
simple way to reason about its use of the mathematical expression $v + g^b \mod
q$.
  Modeling $v + g^b$ as encryption, we complete an exhaustive study of all
possible execution sequences of SRP. Ignoring possible algebraic attacks, this
analysis detects no major structural weakness, and in particular no leakage of
any secrets. We do uncover one notable weakness of SRP, which follows from its
design constraints. It is possible for a malicious server to fake an
authentication session with a client, without the client's participation. This
action might facilitate an escalation of privilege attack, if the client has
higher privileges than does the server. We conceived of this attack before we
used CPSA and confirmed it by generating corresponding execution shapes using
CPSA.
