Does SRP also authenticate the server to the client? The Secure Remote Password (SRP) protocol lets a client prove to a server that it knows a specific password without revealing that password to the server. The server stores a cryptographic verifier for the user account. If an attacker impersonates as the server it cannot learn the user's password. 

Now, does it also work the other way around. If a SRP password authentication succeeds, does that also prove to the client that the server knows the correct verifier, and thus assuming that the verifier was kept secret that the client is talking to the real server? (Or at least to the server that it originally gave the verifier to?)

Reading the protocol description I think it does, but as far as I can see the description nowhere mentions this property as something SRP is supposed to do. So maybe there is something I'm missing.


SRP protocol on Wikipedia
The Stanford SRP Homepage
According to the Stanford page mutual authentication can be provided if both sides keep their secrets secret. Thanks mikeazo.