Research: EC-SRP5 authentication fully reverse-engineered

Key findings:
- btest EC-SRP5 uses [len][payload] framing (NO 0x06 handler byte)
- Winbox uses [len][0x06][payload] — that one byte was the difference
- Crypto is identical: Curve25519 Weierstrass, SHA256, SRP-like key exchange
- Python prototype successfully authenticates against MikroTik RouterOS 7.x

Files:
- docs/ecsrp5-research.md: complete protocol spec, captured exchange, impl plan
- proto-test/btest_ecsrp5_client.py: working Python EC-SRP5 btest client
- proto-test/btest_mitm.py: MITM proxy used to discover the framing
- proto-test/elliptic_curves.py: Curve25519 Weierstrass (from MarginResearch)

Based on MarginResearch/mikrotik_authentication (MIT License).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

docs/architecture.md

@@ -50,12 +50,20 @@ sequenceDiagram
 
     alt No auth configured
         SRV->>TCP: AUTH_OK [01 00 00 00]
-    else MD5 auth
+    else MD5 auth (RouterOS < 6.43)
         SRV->>TCP: AUTH_REQUIRED [02 00 00 00]
         SRV->>TCP: Challenge [16 random bytes]
         MK->>TCP: Response [16 hash + 32 username]
         Note over SRV: Verify MD5(pass + MD5(pass + challenge))
         SRV->>TCP: AUTH_OK or AUTH_FAILED
+    else EC-SRP5 auth (RouterOS >= 6.43)
+        SRV->>TCP: EC-SRP5 [03 00 00 00]
+        MK->>TCP: [len][username\0][client_pubkey:32][parity:1]
+        SRV->>TCP: [len][server_pubkey:32][parity:1][salt:16]
+        MK->>TCP: [len][client_proof:32]
+        SRV->>TCP: [len][server_proof:32]
+        Note over SRV: Curve25519 Weierstrass EC-SRP5<br/>See docs/ecsrp5-research.md
+        SRV->>TCP: AUTH_OK [01 00 00 00]
     end
 
     alt TCP mode
@@ -178,7 +186,7 @@ btest-rs/
 │   ├── main.rs          # CLI entry point, argument parsing
 │   ├── lib.rs           # Public API (used by integration tests)
 │   ├── protocol.rs      # Wire format: Command, StatusMessage, constants
-│   ├── auth.rs          # MD5 challenge-response authentication
+│   ├── auth.rs          # Authentication (MD5 + EC-SRP5)
 │   ├── server.rs        # Server mode: listener, TCP/UDP handlers
 │   ├── client.rs        # Client mode: connector, TCP/UDP handlers
 │   └── bandwidth.rs     # Rate limiting, formatting, shared state
@@ -193,6 +201,7 @@ btest-rs/
 ├── docs/
 │   ├── architecture.md      # This file
 │   ├── protocol.md          # Protocol specification
+│   ├── ecsrp5-research.md   # EC-SRP5 reverse-engineering findings
 │   ├── user-guide.md        # Usage documentation
 │   └── docker.md            # Docker & deployment guide
 ├── Dockerfile               # Production Docker image