Client should show proof first

[helgardmeyer]

According to the SRP design specification, you reference the client should show it's proof first. However in the ClientProof() you check if the server is proved first?

if !s.isServer && !s.isServerProved {
    return nil, fmt.Errorf("don't construct client proof until server is proved")
}

[jpgoldberg]

Ah. I assume you are referring to

Now the two parties have a shared, strong session key K. To complete authentication, they need to prove to each other that their keys match. One possible way:

User -> Host: M = H(H(N) xor H(g), H(I), s, A, B, K)
Host -> User: H(A, M, K)

I probably read that backwards. I do not believe that this matters at this point in the authentication process, but unless I am certain that order doesn't matter here, we should have this code follow that "spec".

[helgardmeyer]

Yes and the comment at the top of the file also mentions client proof first

Client -> Server: M = H(H(N) xor H(g), H(I), s, A, B, Key)
Server >- Client: H(A, M, K)

The client must show its proof first

I believe in most cases server proof is not required or at least for my use case, I am only interested in the client proof so this adds an additional round trip to the authentication process.

[jpgoldberg]

This should be fixed, but I want to be careful about breaking changes.