About the SRP Protocol: http://en.wikipedia.org/wiki/Secure_remote_password_protocol
I can see that the generation of the session key (K) is perfectly safe, but in the last step the user sends proof of K (M). If the network is insecure and the attacker in the midlle captures M, he would be able to authenticate without having K. right?
Well known values (established beforehand):
n A large prime number. All computations are performed modulo n.
g A primitive root modulo n (often called a generator).
The users password is established as:
x = H(s, P)
v = g^x
H() One-way hash function
s A random string used as the user's salt
P The user's password
x A private key derived from the password and salt
v The host's password verifier
The authentication:
+---+------------------------+--------------+----------------------+
| | Alice | Public Wire | Bob |
+---+------------------------+--------------+----------------------+
| 1 | | C --> | (lookup s, v) |
| 2 | x = H(s, P) | <-- s | |
| 3 | A = g^a | A --> | |
| 4 | | <-- B, u | B = v + g^b |
| 5 | S = (B - g^x)^(a + ux) | | S = (A · v^u)^b |
| 6 | K = H(S) | | K = H(S) |
| 7 | M[1] = H(A, B, K) | M[1] --> | (verify M[1]) |
| 8 | (verify M[2]) | <-- M[2] | M[2] = H(A, M[1], K) |
+---+------------------------+--------------+----------------------+
u Random scrambling parameter, publicly revealed
a,b Ephemeral private keys, generated randomly and not publicly revealed
A,B Corresponding public keys
m,n The two quantities (strings) m and n concatenated
S Calculated exponential value
K Session key
As you can see, both parties calculate K (=the session key) separately, based upon the values available to each of them.
If Alice's password P entered in Step 2 matches the one she originally used to generate v, then both values of S will match.
The actual session key K is however never send over the wire, only the proof that both parties have successfully calculated the same session key. So a man-in-the middle could resend the proof, but since he does not have the actual session key, he would not be able to do anything with the intercepted data.