glusk / srp6-variables Goto Github PK
View Code? Open in Web Editor NEWA Java library of cryptographic primitives required for the implementation of the SRP-6 protocol.
License: MIT License
A Java library of cryptographic primitives required for the implementation of the SRP-6 protocol.
License: MIT License
The two parties also employ the following safeguards:
- The user will abort if he receives B == 0 (mod N) or u == 0.
- The host will abort if it detects that A == 0 (mod N).
Lets add the following:
The above mentioned project implements some version of SRP-6. Lets add its test vectors!
Tool used to generate Test Vectors: mysrp.py
Also take note of the checks in #28.
Improve this coverage:
Add WoW authentication SRP-6 test vectors, dumped from a private server session.
Implement:
u
Random scrambling parameter -- #16A,B
Public ephemeral values -- #22 #24a,b
Private ephemeral values -- #26x
Private key (derived from p and s) -- #12v
Password verifier -- #9k
Multiplier parameter (k = H(N, g) in SRP-6a, k = 3 for legacy SRP-6) -- #30It's not really clear what the -1
is for in the following snippet:
new SRP6RandomEphemeral(rng, -1, N);
Let's document that in the SRP6RandomEphemeral constructor.
Also take note of the checks in #28
Add an interface that will represent SRP-6 variables and a default implementation.
After we implement #77, this should be much easier.
State that the exception is thrown when trying to cut off byte sequences, representing numbers, to a shorter length instead of zero-padding them to longer ones.
Provide an example.
Correct the description:
Corrections for #18.
Library should at least log whenever a user is using too short, and thus cryptographically-unsafe, variables.
Limits:
a, b
:
The private values a and b SHOULD be at least 256-bit random numbers, ... [RFC 5054]
Let's try to add repoToken
to the configuration file.
Rename base interface that was added in #3.
We want something like this:
// SRP6IntegerVariable x = ...
// SRP6IntegerVariable y = ...
// bytes of x in BIG_ENDIAN byte order
Bytes b1 = new SRP6IntegerVariableBytes(x, ByteOrder.BIG_ENDIAN);
// bytes of x in BIG_ENDIAN byte order, zero-padded to the byte length of y
Bytes b2 = new SRP6IntegerVariableBytes(x, ByteOrder.BIG_ENDIAN, y);
instead of in addtion to this:
// SRP6IntegerVariable x = ...
Bytes b1 = x.bytes(ByteOrder.BIG_ENDIAN);
Bytes b1 = x.bytes(ByteOrder.BIG_ENDIAN, 32);
in order to enhance object composition and defer execution.
Some of the existing open source SRP-6 Java libraries include:
What I've found is that such libraries are not easy to extend.
Most of them work only with big-endian byte array representations and some of them aren't compliant with RFC 5054.
With that in mind, I decided to create a library of basic building blocks (SRP-6 Variables) that one can use to implement the protocol.
Zero-padd Public Keys (A, B) to the byte length of Nt:
u = H(PAD(A) | PAD(B))
Currently, we have the following conde snippet as part of our README.md:
if (!(cM2.equals(M2))) {
throw new SRP6Exception("Server proof mismatch!");
}
This is not an exceptional behaviour. It's perfectly normal that an SRP6 authentication fails (ie, wong credentials). Let's not use exceptions for flow control in our examples. Fix the example; re-think where to throw an exception and what type.
Should be done after/with #78.
p = 2q + 1
, where p
and q
are prime numbersLet's do the same as here: Glusk/caesar#67.
The method equals()
in SRP6IntegerVariable
should have a different signature. See also: Java8: Why is it forbidden to define a default method for a method from java.lang.Object.
Lets do something similar as here: Glusk/caesar#59
SRP6RandomEphemeral was first implemented as part of #26.
Remove synchronized
from method declaration. In project Loom, a synchronized block or a method blocks the underlying platform thread. Assuming SRP6 authentication runs in a virtual thread, this could potentially slow the application.
Fix the typo in the code comment.
extends
Exception
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.