feat(crypto): SRP-6a, the register's half and the device's
ADR 0017's step 1. Generic over group and hash (SrpGroup); production takes RFC 5054's 3072-bit group with SHA-256. k = H(N | PAD(g)), u = H(PAD(A) | PAD(B)), K = H(PAD(S)), M1 = H(H(N) xor H(g) | H(I) | s | PAD(A) | PAD(B) | K), M2 = H(PAD(A) | M1 | K). A and B must lie in 1..N-1 and u must not be 0; a and b are 256 bits from Random.secure(); proofs are compared in constant time. x comes from the caller (halkyon_keys makes it); RFC 5054's own x is there for the vectors only. - The register's half in halkyon_base_server (base.dart: srpChallenge, srpVerify), the device's written by hand in halkyon_base_client (srp.dart: SrpClient, srpVerifier). Serverpod's generator cleans and writes only a client's lib/src/protocol/ (serverpod_cli 4.0.4's _getDirectoriesRequiringCleaning; a generate leaves srp/ untouched). - Tests: RFC 5054 Appendix B on both halves; the client against the register, succeeding and every refusal. - The module's tests depend on its client, and pub resolves every member's dev dependencies, so Learn's server image takes the module's client into its workspace too. - The format check covers the hand-written half. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
This commit is contained in:
parent
ae0d88818b
commit
bc499713b8
GPG key ID:
07F6FCF405488B64
8 changed files with 1369 additions and 27 deletions
|
|
@ -101,6 +101,32 @@ the same ID. Sessions stay each service's own: every app signs in itself.
|
|||
- **The register being down:** members can't sign anyone in, change profiles or delete
|
||||
accounts; their open sessions go on working.
|
||||
|
||||
## SRP-6a (ADR 0017)
|
||||
|
||||
The password never reaches the register: the device proves it knows it with SRP-6a
|
||||
(RFC 5054), and the register keeps only the verifier v = g^x mod N, which `halkyon_keys`'
|
||||
x makes on the device (Argon2id, so a stolen verifier costs an Argon2id per guess). The
|
||||
two halves share the arithmetic, generic over the group and the hash (`SrpGroup`):
|
||||
|
||||
- the register's in `package:halkyon_base_server/base.dart`: `srpChallenge(group,
|
||||
verifier)` gives `SrpChallenge` (B for the client; b kept for this sign-in only), and
|
||||
`srpVerify(group, identity:, salt:, verifier:, challenge:, clientValue:, clientProof:)`
|
||||
gives `SrpAccepted` (M2 and K) or `SrpRefused` (`invalidClientValue`, `wrongProof`);
|
||||
- the device's in `package:halkyon_base_client/srp.dart`, written by hand beside the
|
||||
generated client (the generator writes only `lib/src/protocol/`): `SrpClient(group)`
|
||||
with its `publicValue` A, `respond(identity:, salt:, privateValue:, serverValue:)`
|
||||
giving `SrpClientProof` (M1, K, `verifiesServer(M2)`) or `SrpClientRefused`, and
|
||||
`srpVerifier(group, x)` for sign-up.
|
||||
|
||||
Production uses `SrpGroup.rfc5054Group3072` (RFC 5054's 3072-bit group, g = 5) with
|
||||
SHA-256. k = H(N | PAD(g)), u = H(PAD(A) | PAD(B)), K = H(PAD(S)),
|
||||
M1 = H(H(N) xor H(g) | H(I) | s | PAD(A) | PAD(B) | K), M2 = H(PAD(A) | M1 | K), numbers as
|
||||
unsigned big-endian bytes, PAD to N's length. A and B must lie in 1..N−1 (so neither is
|
||||
≡ 0 mod N) and u must not be 0; a and b are 256 bits from `Random.secure()`; proofs are
|
||||
compared in constant time. RFC 5054 Appendix B's vectors check both halves
|
||||
(`SrpGroup.rfc5054TestVectorGroup`, SHA-1), and `test/unit/srp/srp_interop_test.dart` runs
|
||||
the client against the register, every refusal included.
|
||||
|
||||
## Taking it into a host
|
||||
|
||||
1. Depend on both packages by path, within the repository's workspace (an app's
|
||||
|
|
|
|||
|
|
@ -2,7 +2,7 @@
|
|||
/// (`HalkyonBase.configure`), how people authenticate, the account's
|
||||
/// deletion and the pruning, email sign-in's helpers, the instance's
|
||||
/// basics, people's public profiles and their pages, the instance's register
|
||||
/// (ADR 0016), and the module's models.
|
||||
/// (ADR 0016), SRP's register side (ADR 0017), and the module's models.
|
||||
library;
|
||||
|
||||
export 'src/auth/account.dart';
|
||||
|
|
@ -37,3 +37,13 @@ export 'src/register/deletion_notices.dart'
|
|||
export 'src/register/instance_routes.dart';
|
||||
export 'src/register/member_pruning.dart';
|
||||
export 'src/register/people.dart' show issueSession;
|
||||
export 'src/srp/srp_group.dart';
|
||||
export 'src/srp/srp_server.dart'
|
||||
show
|
||||
SrpAccepted,
|
||||
SrpChallenge,
|
||||
SrpRefusal,
|
||||
SrpRefused,
|
||||
SrpVerification,
|
||||
srpChallenge,
|
||||
srpVerify;
|
||||
|
|
|
|||
59
packages/halkyon_base_server/lib/src/srp/srp_group.dart
Normal file
59
packages/halkyon_base_server/lib/src/srp/srp_group.dart
Normal file
|
|
@ -0,0 +1,59 @@
|
|||
import 'package:crypto/crypto.dart';
|
||||
|
||||
/// A group SRP-6a computes in: a safe prime [n], a generator [g] of it, and
|
||||
/// the [hash] every step uses. The same groups as halkyon_base_client's
|
||||
/// (`lib/src/srp/srp_group.dart`), which the interoperability test holds
|
||||
/// them to.
|
||||
final class SrpGroup {
|
||||
SrpGroup({required this.n, required this.g, required this.hash});
|
||||
|
||||
/// RFC 5054's 3072-bit group (generator 5) with SHA-256: what Halkyon signs
|
||||
/// in with.
|
||||
static final rfc5054Group3072 = SrpGroup(
|
||||
n: BigInt.parse(_n3072, radix: 16),
|
||||
g: BigInt.from(5),
|
||||
hash: sha256,
|
||||
);
|
||||
|
||||
/// RFC 5054's 1024-bit group (generator 2) with SHA-1: only for the test
|
||||
/// vectors of RFC 5054's Appendix B, never to sign in with.
|
||||
static final rfc5054TestVectorGroup = SrpGroup(
|
||||
n: BigInt.parse(_n1024, radix: 16),
|
||||
g: BigInt.two,
|
||||
hash: sha1,
|
||||
);
|
||||
|
||||
/// The safe prime N.
|
||||
final BigInt n;
|
||||
|
||||
/// The generator g.
|
||||
final BigInt g;
|
||||
|
||||
/// H, SHA-256 in production.
|
||||
final Hash hash;
|
||||
|
||||
/// How many bytes N takes: what PAD() fills to.
|
||||
int get length => (n.bitLength + 7) ~/ 8;
|
||||
}
|
||||
|
||||
/// RFC 5054, Appendix A, the 3072-bit group's N.
|
||||
const _n3072 =
|
||||
'FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74'
|
||||
'020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F1437'
|
||||
'4FE1356D6D51C245E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7ED'
|
||||
'EE386BFB5A899FA5AE9F24117C4B1FE649286651ECE45B3DC2007CB8A163BF05'
|
||||
'98DA48361C55D39A69163FA8FD24CF5F83655D23DCA3AD961C62F356208552BB'
|
||||
'9ED529077096966D670C354E4ABC9804F1746C08CA18217C32905E462E36CE3B'
|
||||
'E39E772C180E86039B2783A2EC07A28FB5C55DF06F4C52C9DE2BCBF695581718'
|
||||
'3995497CEA956AE515D2261898FA051015728E5A8AAAC42DAD33170D04507A33'
|
||||
'A85521ABDF1CBA64ECFB850458DBEF0A8AEA71575D060C7DB3970F85A6E1E4C7'
|
||||
'ABF5AE8CDB0933D71E8C94E04A25619DCEE3D2261AD2EE6BF12FFA06D98A0864'
|
||||
'D87602733EC86A64521F2B18177B200CBBE117577A615D6C770988C0BAD946E2'
|
||||
'08E24FA074E5AB3143DB5BFCE0FD108E4B82D120A93AD2CAFFFFFFFFFFFFFFFF';
|
||||
|
||||
/// RFC 5054, Appendix A, the 1024-bit group's N.
|
||||
const _n1024 =
|
||||
'EEAF0AB9ADB38DD69C33F80AFA8FC5E86072618775FF3C0B9EA2314C9C256576'
|
||||
'D674DF7496EA81D3383B4813D692C6E0E0D5D8E250B98BE48E495C1D6089DAD1'
|
||||
'5DC7D7B46154D6B6CE8EF4AD69B15D4982559B297BCF1885C529F566660E57EC'
|
||||
'68EDBC3C05726CC02FD4CBF4976EAA9AFD5138FE8376435B9FC61D2FC0EB06E3';
|
||||
129
packages/halkyon_base_server/lib/src/srp/srp_math.dart
Normal file
129
packages/halkyon_base_server/lib/src/srp/srp_math.dart
Normal file
|
|
@ -0,0 +1,129 @@
|
|||
import 'dart:math';
|
||||
import 'dart:typed_data';
|
||||
|
||||
import 'package:halkyon_base_server/src/srp/srp_group.dart';
|
||||
|
||||
/// The arithmetic both sides of SRP-6a share, as the client's half has it
|
||||
/// too (halkyon_base_client's `srp_math.dart`, which must compute alike: an
|
||||
/// interoperability test here holds them to each other).
|
||||
///
|
||||
/// Byte strings are unsigned and big-endian; PAD(x) is x filled with leading
|
||||
/// zeros to the length of N.
|
||||
|
||||
/// [value] as the fewest unsigned big-endian bytes (one zero byte for zero).
|
||||
Uint8List bytesOf(BigInt value) {
|
||||
if (value.isNegative) {
|
||||
throw ArgumentError.value(value, 'value', 'must not be negative');
|
||||
}
|
||||
var hex = value.toRadixString(16);
|
||||
if (hex.length.isOdd) {
|
||||
hex = '0$hex';
|
||||
}
|
||||
return Uint8List.fromList([
|
||||
for (var i = 0; i < hex.length; i += 2)
|
||||
int.parse(hex.substring(i, i + 2), radix: 16),
|
||||
]);
|
||||
}
|
||||
|
||||
/// PAD([value]): its bytes filled with leading zeros to [length].
|
||||
Uint8List padded(BigInt value, int length) {
|
||||
final bytes = bytesOf(value);
|
||||
if (bytes.length > length) {
|
||||
throw ArgumentError.value(value, 'value', 'is longer than $length bytes');
|
||||
}
|
||||
return Uint8List(length)..setRange(length - bytes.length, length, bytes);
|
||||
}
|
||||
|
||||
/// The unsigned big-endian number [bytes] stand for.
|
||||
BigInt numberOf(List<int> bytes) {
|
||||
var value = BigInt.zero;
|
||||
for (final byte in bytes) {
|
||||
value = (value << 8) | BigInt.from(byte);
|
||||
}
|
||||
return value;
|
||||
}
|
||||
|
||||
/// H over [parts], one after the other.
|
||||
Uint8List hashOf(SrpGroup group, Iterable<List<int>> parts) =>
|
||||
Uint8List.fromList(
|
||||
group.hash.convert([for (final part in parts) ...part]).bytes,
|
||||
);
|
||||
|
||||
/// k = H(N | PAD(g)).
|
||||
BigInt multiplierOf(SrpGroup group) =>
|
||||
numberOf(hashOf(group, [bytesOf(group.n), padded(group.g, group.length)]));
|
||||
|
||||
/// u = H(PAD(A) | PAD(B)).
|
||||
BigInt scramblerOf(SrpGroup group, BigInt clientValue, BigInt serverValue) =>
|
||||
numberOf(
|
||||
hashOf(group, [
|
||||
padded(clientValue, group.length),
|
||||
padded(serverValue, group.length),
|
||||
]),
|
||||
);
|
||||
|
||||
/// K = H(PAD(S)), the key both sides end up with.
|
||||
Uint8List sessionKeyOf(SrpGroup group, BigInt premasterSecret) =>
|
||||
hashOf(group, [padded(premasterSecret, group.length)]);
|
||||
|
||||
/// M1 = H(H(N) xor H(g) | H(I) | s | PAD(A) | PAD(B) | K): the client's
|
||||
/// proof that it knows the password.
|
||||
Uint8List clientProofOf(
|
||||
SrpGroup group, {
|
||||
required List<int> identity,
|
||||
required List<int> salt,
|
||||
required BigInt clientValue,
|
||||
required BigInt serverValue,
|
||||
required List<int> sessionKey,
|
||||
}) {
|
||||
final hashOfN = hashOf(group, [bytesOf(group.n)]);
|
||||
final hashOfG = hashOf(group, [bytesOf(group.g)]);
|
||||
return hashOf(group, [
|
||||
[for (var i = 0; i < hashOfN.length; i++) hashOfN[i] ^ hashOfG[i]],
|
||||
hashOf(group, [identity]),
|
||||
salt,
|
||||
padded(clientValue, group.length),
|
||||
padded(serverValue, group.length),
|
||||
sessionKey,
|
||||
]);
|
||||
}
|
||||
|
||||
/// M2 = H(PAD(A) | M1 | K): the server's proof that it holds the verifier.
|
||||
Uint8List serverProofOf(
|
||||
SrpGroup group, {
|
||||
required BigInt clientValue,
|
||||
required List<int> clientProof,
|
||||
required List<int> sessionKey,
|
||||
}) => hashOf(group, [
|
||||
padded(clientValue, group.length),
|
||||
clientProof,
|
||||
sessionKey,
|
||||
]);
|
||||
|
||||
/// Whether a public value lies in 1 … N − 1: zero (mod N) would let the
|
||||
/// other side's key be known without the password.
|
||||
bool isPublicValue(SrpGroup group, BigInt value) =>
|
||||
value > BigInt.zero && value < group.n;
|
||||
|
||||
/// Whether [a] and [b] are equal, in a time that depends only on their
|
||||
/// lengths, which are public.
|
||||
bool constantTimeEquals(List<int> a, List<int> b) {
|
||||
if (a.length != b.length) {
|
||||
return false;
|
||||
}
|
||||
var difference = 0;
|
||||
for (var i = 0; i < a.length; i++) {
|
||||
difference |= a[i] ^ b[i];
|
||||
}
|
||||
return difference == 0;
|
||||
}
|
||||
|
||||
/// A fresh secret exponent of 256 bits from [random], never zero.
|
||||
BigInt randomExponent(Random random) {
|
||||
while (true) {
|
||||
final value = numberOf([for (var i = 0; i < 32; i++) random.nextInt(256)]);
|
||||
if (value != BigInt.zero) {
|
||||
return value;
|
||||
}
|
||||
}
|
||||
}
|
||||
155
packages/halkyon_base_server/lib/src/srp/srp_server.dart
Normal file
155
packages/halkyon_base_server/lib/src/srp/srp_server.dart
Normal file
|
|
@ -0,0 +1,155 @@
|
|||
import 'dart:math';
|
||||
import 'dart:typed_data';
|
||||
|
||||
import 'package:halkyon_base_server/src/srp/srp_group.dart';
|
||||
import 'package:halkyon_base_server/src/srp/srp_math.dart';
|
||||
import 'package:meta/meta.dart';
|
||||
|
||||
/// SRP-6a's register side (ADR 0017), in two steps a sign-in's two requests
|
||||
/// take: [srpChallenge] answers the client's A with B, keeping the secret b
|
||||
/// until [srpVerify] checks the client's proof M1 and answers with M2. The
|
||||
/// register keeps only the verifier v = g^x mod N the device made at sign-up:
|
||||
/// it never sees the password, nor anything that would sign in in its place.
|
||||
|
||||
/// B for the client, and the secret b that made it, which the register keeps
|
||||
/// (for this one sign-in, briefly) and never sends.
|
||||
final class SrpChallenge {
|
||||
SrpChallenge._(this.secret, this.publicValue);
|
||||
|
||||
/// b.
|
||||
final BigInt secret;
|
||||
|
||||
/// B = (k·v + g^b) mod N, sent to the client.
|
||||
final BigInt publicValue;
|
||||
}
|
||||
|
||||
/// The first step: B for the account whose [verifier] the register keeps,
|
||||
/// from a fresh secret b of 256 bits from [random] (the system's secure one
|
||||
/// by default).
|
||||
SrpChallenge srpChallenge(SrpGroup group, BigInt verifier, {Random? random}) {
|
||||
final source = random ?? Random.secure();
|
||||
while (true) {
|
||||
final challenge = srpChallengeWithSecret(
|
||||
group,
|
||||
verifier,
|
||||
randomExponent(source),
|
||||
);
|
||||
// B ≡ 0 (mod N) would make the key known; its chance is nil, its check
|
||||
// free.
|
||||
if (isPublicValue(group, challenge.publicValue)) {
|
||||
return challenge;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/// The first step with the secret [secret] given, only for RFC 5054's test
|
||||
/// vectors.
|
||||
@visibleForTesting
|
||||
SrpChallenge srpChallengeWithSecret(
|
||||
SrpGroup group,
|
||||
BigInt verifier,
|
||||
BigInt secret,
|
||||
) => SrpChallenge._(
|
||||
secret,
|
||||
(multiplierOf(group) * verifier + group.g.modPow(secret, group.n)) % group.n,
|
||||
);
|
||||
|
||||
/// The second step: whether the client's [clientProof] M1, made with its A
|
||||
/// ([clientValue]) against this [challenge], shows it knows the password of
|
||||
/// the account [identity] (whose [salt] and [verifier] the register keeps).
|
||||
/// Accepted, it gives M2 for the client and the key K both now share.
|
||||
SrpVerification srpVerify(
|
||||
SrpGroup group, {
|
||||
required List<int> identity,
|
||||
required List<int> salt,
|
||||
required BigInt verifier,
|
||||
required SrpChallenge challenge,
|
||||
required BigInt clientValue,
|
||||
required List<int> clientProof,
|
||||
}) {
|
||||
if (!isPublicValue(group, clientValue)) {
|
||||
return const SrpRefused(SrpRefusal.invalidClientValue);
|
||||
}
|
||||
final scrambler = scramblerOf(group, clientValue, challenge.publicValue);
|
||||
if (scrambler == BigInt.zero) {
|
||||
return const SrpRefused(SrpRefusal.invalidClientValue);
|
||||
}
|
||||
final sessionKey = sessionKeyOf(
|
||||
group,
|
||||
srpServerPremasterSecret(
|
||||
group,
|
||||
verifier: verifier,
|
||||
challenge: challenge,
|
||||
clientValue: clientValue,
|
||||
scrambler: scrambler,
|
||||
),
|
||||
);
|
||||
final expected = clientProofOf(
|
||||
group,
|
||||
identity: identity,
|
||||
salt: salt,
|
||||
clientValue: clientValue,
|
||||
serverValue: challenge.publicValue,
|
||||
sessionKey: sessionKey,
|
||||
);
|
||||
if (!constantTimeEquals(clientProof, expected)) {
|
||||
return const SrpRefused(SrpRefusal.wrongProof);
|
||||
}
|
||||
return SrpAccepted._(
|
||||
serverProofOf(
|
||||
group,
|
||||
clientValue: clientValue,
|
||||
clientProof: expected,
|
||||
sessionKey: sessionKey,
|
||||
),
|
||||
sessionKey,
|
||||
);
|
||||
}
|
||||
|
||||
/// S = (A·v^u)^b mod N, exposed for RFC 5054's vectors.
|
||||
@visibleForTesting
|
||||
BigInt srpServerPremasterSecret(
|
||||
SrpGroup group, {
|
||||
required BigInt verifier,
|
||||
required SrpChallenge challenge,
|
||||
required BigInt clientValue,
|
||||
required BigInt scrambler,
|
||||
}) => (clientValue * verifier.modPow(scrambler, group.n) % group.n).modPow(
|
||||
challenge.secret,
|
||||
group.n,
|
||||
);
|
||||
|
||||
/// What the register makes of a client's proof.
|
||||
sealed class SrpVerification {
|
||||
const SrpVerification();
|
||||
}
|
||||
|
||||
/// The proof showed the password: M2 for the client, K for both.
|
||||
final class SrpAccepted extends SrpVerification {
|
||||
SrpAccepted._(this.serverProof, this.sessionKey);
|
||||
|
||||
/// M2, sent to the client, which checks it.
|
||||
final Uint8List serverProof;
|
||||
|
||||
/// K, the key both sides now share; never sent.
|
||||
final Uint8List sessionKey;
|
||||
}
|
||||
|
||||
/// The proof didn't show it.
|
||||
final class SrpRefused extends SrpVerification {
|
||||
const SrpRefused(this.reason);
|
||||
|
||||
/// Why.
|
||||
final SrpRefusal reason;
|
||||
}
|
||||
|
||||
/// Why the register refused a client's proof.
|
||||
enum SrpRefusal {
|
||||
/// A is zero modulo N, or out of range, or makes u zero: accepting it
|
||||
/// would let anyone sign in.
|
||||
invalidClientValue,
|
||||
|
||||
/// M1 isn't the one the password would make: a wrong password, or a value
|
||||
/// tampered with on the way.
|
||||
wrongProof,
|
||||
}
|
||||
|
|
@ -21,9 +21,13 @@ dependencies:
|
|||
http: ^1.6.0
|
||||
# Mails email sign-in's codes over SMTP (Halkyon Learn's ADR 0010).
|
||||
mailer: ^7.2.0
|
||||
meta: ^1.16.0
|
||||
serverpod: 4.0.4
|
||||
serverpod_auth_idp_server: 4.0.4
|
||||
|
||||
dev_dependencies:
|
||||
# SRP's client half, to hold the register's half to it (test/unit/srp/).
|
||||
halkyon_base_client:
|
||||
path: ../halkyon_base_client
|
||||
serverpod_test: 4.0.4
|
||||
test: ^1.25.5
|
||||
|
|
|
|||
287
packages/halkyon_base_server/test/unit/srp/srp_interop_test.dart
Normal file
287
packages/halkyon_base_server/test/unit/srp/srp_interop_test.dart
Normal file
|
|
@ -0,0 +1,287 @@
|
|||
import 'dart:convert';
|
||||
import 'dart:math';
|
||||
|
||||
import 'package:halkyon_base_client/src/srp/srp_math.dart' as client_math;
|
||||
import 'package:halkyon_base_client/srp.dart' as client;
|
||||
import 'package:halkyon_base_server/src/srp/srp_group.dart';
|
||||
import 'package:halkyon_base_server/src/srp/srp_math.dart';
|
||||
import 'package:halkyon_base_server/src/srp/srp_server.dart';
|
||||
import 'package:test/test.dart';
|
||||
|
||||
/// The register's half (this package) against the device's
|
||||
/// (halkyon_base_client) in the group Halkyon signs in with: both compute
|
||||
/// alike, a right password signs in, and nothing else does.
|
||||
void main() {
|
||||
final production = SrpGroup.rfc5054Group3072;
|
||||
final clientGroup = client.SrpGroup.rfc5054Group3072;
|
||||
final random = Random(20261020);
|
||||
final identity = utf8.encode('3f2a9c1e-account');
|
||||
final salt = List.generate(16, (_) => random.nextInt(256));
|
||||
// x as halkyon_keys makes it: 256 bits from the password's Argon2id.
|
||||
final privateValue = client_math.numberOf(
|
||||
List.generate(32, (_) => random.nextInt(256)),
|
||||
);
|
||||
final verifier = client.srpVerifier(clientGroup, privateValue);
|
||||
|
||||
/// One sign-in up to the client's proof: the client, the register's
|
||||
/// challenge, and what the client answered.
|
||||
({
|
||||
client.SrpClient device,
|
||||
SrpChallenge challenge,
|
||||
client.SrpClientProof proof,
|
||||
})
|
||||
signIn({BigInt? withPrivateValue}) {
|
||||
final device = client.SrpClient(clientGroup);
|
||||
final challenge = srpChallenge(production, verifier);
|
||||
final step = device.respond(
|
||||
identity: identity,
|
||||
salt: salt,
|
||||
privateValue: withPrivateValue ?? privateValue,
|
||||
serverValue: challenge.publicValue,
|
||||
);
|
||||
return (
|
||||
device: device,
|
||||
challenge: challenge,
|
||||
proof: step as client.SrpClientProof,
|
||||
);
|
||||
}
|
||||
|
||||
SrpVerification verify(
|
||||
SrpChallenge challenge, {
|
||||
required BigInt clientValue,
|
||||
required List<int> clientProof,
|
||||
}) => srpVerify(
|
||||
production,
|
||||
identity: identity,
|
||||
salt: salt,
|
||||
verifier: verifier,
|
||||
challenge: challenge,
|
||||
clientValue: clientValue,
|
||||
clientProof: clientProof,
|
||||
);
|
||||
|
||||
group('both halves compute alike', () {
|
||||
test('the same group: N, g and H', () {
|
||||
expect(production.n, clientGroup.n);
|
||||
expect(production.g, clientGroup.g);
|
||||
expect(production.hash, same(clientGroup.hash));
|
||||
expect(
|
||||
SrpGroup.rfc5054TestVectorGroup.n,
|
||||
client.SrpGroup.rfc5054TestVectorGroup.n,
|
||||
);
|
||||
});
|
||||
|
||||
test('k, u, K, M1 and M2 alike for the same values', () {
|
||||
final clientValue = client.SrpClient(clientGroup).publicValue;
|
||||
final serverValue = srpChallenge(production, verifier).publicValue;
|
||||
final secret = client_math.numberOf(
|
||||
List.generate(48, (_) => random.nextInt(256)),
|
||||
);
|
||||
expect(
|
||||
multiplierOf(production),
|
||||
client_math.multiplierOf(clientGroup),
|
||||
);
|
||||
expect(
|
||||
scramblerOf(production, clientValue, serverValue),
|
||||
client_math.scramblerOf(clientGroup, clientValue, serverValue),
|
||||
);
|
||||
final key = sessionKeyOf(production, secret);
|
||||
expect(key, client_math.sessionKeyOf(clientGroup, secret));
|
||||
final m1 = clientProofOf(
|
||||
production,
|
||||
identity: identity,
|
||||
salt: salt,
|
||||
clientValue: clientValue,
|
||||
serverValue: serverValue,
|
||||
sessionKey: key,
|
||||
);
|
||||
expect(
|
||||
m1,
|
||||
client_math.clientProofOf(
|
||||
clientGroup,
|
||||
identity: identity,
|
||||
salt: salt,
|
||||
clientValue: clientValue,
|
||||
serverValue: serverValue,
|
||||
sessionKey: key,
|
||||
),
|
||||
);
|
||||
expect(
|
||||
serverProofOf(
|
||||
production,
|
||||
clientValue: clientValue,
|
||||
clientProof: m1,
|
||||
sessionKey: key,
|
||||
),
|
||||
client_math.serverProofOf(
|
||||
clientGroup,
|
||||
clientValue: clientValue,
|
||||
clientProof: m1,
|
||||
sessionKey: key,
|
||||
),
|
||||
);
|
||||
});
|
||||
});
|
||||
|
||||
test('the right password signs in: the register accepts M1, the client '
|
||||
'M2, and both share K', () {
|
||||
final (:device, :challenge, :proof) = signIn();
|
||||
final verification = verify(
|
||||
challenge,
|
||||
clientValue: device.publicValue,
|
||||
clientProof: proof.proof,
|
||||
);
|
||||
expect(verification, isA<SrpAccepted>());
|
||||
final accepted = verification as SrpAccepted;
|
||||
expect(proof.verifiesServer(accepted.serverProof), isTrue);
|
||||
expect(accepted.sessionKey, proof.sessionKey);
|
||||
// SHA-256: 32 bytes each.
|
||||
expect(proof.proof, hasLength(32));
|
||||
expect(accepted.serverProof, hasLength(32));
|
||||
});
|
||||
|
||||
test('every sign-in has new secrets: another A, B and K', () {
|
||||
final first = signIn();
|
||||
final second = signIn();
|
||||
expect(first.device.publicValue, isNot(second.device.publicValue));
|
||||
expect(
|
||||
first.challenge.publicValue,
|
||||
isNot(second.challenge.publicValue),
|
||||
);
|
||||
expect(first.proof.sessionKey, isNot(second.proof.sessionKey));
|
||||
});
|
||||
|
||||
group('refused', () {
|
||||
test('a wrong password', () {
|
||||
final (:device, :challenge, :proof) = signIn(
|
||||
withPrivateValue: privateValue + BigInt.one,
|
||||
);
|
||||
expect(
|
||||
verify(
|
||||
challenge,
|
||||
clientValue: device.publicValue,
|
||||
clientProof: proof.proof,
|
||||
),
|
||||
isA<SrpRefused>().having(
|
||||
(refused) => refused.reason,
|
||||
'reason',
|
||||
SrpRefusal.wrongProof,
|
||||
),
|
||||
);
|
||||
});
|
||||
|
||||
test('an A tampered with on the way', () {
|
||||
final (:device, :challenge, :proof) = signIn();
|
||||
expect(
|
||||
verify(
|
||||
challenge,
|
||||
clientValue: device.publicValue + BigInt.one,
|
||||
clientProof: proof.proof,
|
||||
),
|
||||
isA<SrpRefused>().having(
|
||||
(refused) => refused.reason,
|
||||
'reason',
|
||||
SrpRefusal.wrongProof,
|
||||
),
|
||||
);
|
||||
});
|
||||
|
||||
test("a B tampered with on the way: the client's proof then fails", () {
|
||||
final device = client.SrpClient(clientGroup);
|
||||
final challenge = srpChallenge(production, verifier);
|
||||
final proof = device.respond(
|
||||
identity: identity,
|
||||
salt: salt,
|
||||
privateValue: privateValue,
|
||||
serverValue: challenge.publicValue + BigInt.one,
|
||||
) as client.SrpClientProof;
|
||||
expect(
|
||||
verify(
|
||||
challenge,
|
||||
clientValue: device.publicValue,
|
||||
clientProof: proof.proof,
|
||||
),
|
||||
isA<SrpRefused>(),
|
||||
);
|
||||
});
|
||||
|
||||
test('an M1 tampered with', () {
|
||||
final (:device, :challenge, :proof) = signIn();
|
||||
final tampered = [...proof.proof]..[0] ^= 1;
|
||||
expect(
|
||||
verify(
|
||||
challenge,
|
||||
clientValue: device.publicValue,
|
||||
clientProof: tampered,
|
||||
),
|
||||
isA<SrpRefused>().having(
|
||||
(refused) => refused.reason,
|
||||
'reason',
|
||||
SrpRefusal.wrongProof,
|
||||
),
|
||||
);
|
||||
expect(
|
||||
verify(
|
||||
challenge,
|
||||
clientValue: device.publicValue,
|
||||
clientProof: proof.proof.sublist(1),
|
||||
),
|
||||
isA<SrpRefused>(),
|
||||
);
|
||||
});
|
||||
|
||||
test("an M2 tampered with: the client doesn't trust the register", () {
|
||||
final (:device, :challenge, :proof) = signIn();
|
||||
final accepted = verify(
|
||||
challenge,
|
||||
clientValue: device.publicValue,
|
||||
clientProof: proof.proof,
|
||||
) as SrpAccepted;
|
||||
final tampered = [...accepted.serverProof]..[31] ^= 0x80;
|
||||
expect(proof.verifiesServer(tampered), isFalse);
|
||||
expect(proof.verifiesServer(accepted.serverProof.sublist(1)), isFalse);
|
||||
});
|
||||
|
||||
for (final (name, value) in [
|
||||
('zero', BigInt.zero),
|
||||
('N', production.n),
|
||||
('a multiple of N', production.n * BigInt.from(3)),
|
||||
('above N', production.n + BigInt.two),
|
||||
('negative', -BigInt.one),
|
||||
]) {
|
||||
test('an A that is $name (which, ≡ 0 mod N, would sign anyone in)', () {
|
||||
final (:device, :challenge, :proof) = signIn();
|
||||
expect(
|
||||
verify(challenge, clientValue: value, clientProof: proof.proof),
|
||||
isA<SrpRefused>().having(
|
||||
(refused) => refused.reason,
|
||||
'reason',
|
||||
SrpRefusal.invalidClientValue,
|
||||
),
|
||||
);
|
||||
});
|
||||
}
|
||||
|
||||
test("an attacker's A ≡ 0 can't make a proof that passes: with S = 0 "
|
||||
"the proof it would make is refused before it's looked at", () {
|
||||
final challenge = srpChallenge(production, verifier);
|
||||
final forgedKey = sessionKeyOf(production, BigInt.zero);
|
||||
final forgedProof = clientProofOf(
|
||||
production,
|
||||
identity: identity,
|
||||
salt: salt,
|
||||
clientValue: BigInt.zero,
|
||||
serverValue: challenge.publicValue,
|
||||
sessionKey: forgedKey,
|
||||
);
|
||||
expect(
|
||||
verify(challenge, clientValue: production.n, clientProof: forgedProof),
|
||||
isA<SrpRefused>(),
|
||||
);
|
||||
expect(
|
||||
verify(challenge, clientValue: BigInt.zero, clientProof: forgedProof),
|
||||
isA<SrpRefused>(),
|
||||
);
|
||||
});
|
||||
});
|
||||
}
|
||||
118
packages/halkyon_base_server/test/unit/srp/srp_server_test.dart
Normal file
118
packages/halkyon_base_server/test/unit/srp/srp_server_test.dart
Normal file
|
|
@ -0,0 +1,118 @@
|
|||
import 'dart:convert';
|
||||
|
||||
import 'package:halkyon_base_client/srp.dart' as client;
|
||||
import 'package:halkyon_base_server/src/srp/srp_group.dart';
|
||||
import 'package:halkyon_base_server/src/srp/srp_math.dart';
|
||||
import 'package:halkyon_base_server/src/srp/srp_server.dart';
|
||||
import 'package:test/test.dart';
|
||||
|
||||
/// [hex] as RFC 5054 prints it (in groups, across lines) as a number.
|
||||
BigInt _hex(String hex) =>
|
||||
BigInt.parse(hex.replaceAll(RegExp(r'\s'), ''), radix: 16);
|
||||
|
||||
void main() {
|
||||
group("RFC 5054's test vectors (Appendix B) on the register's side", () {
|
||||
final group = SrpGroup.rfc5054TestVectorGroup;
|
||||
final verifier = _hex('''
|
||||
7E273DE8 696FFC4F 4E337D05 B4B375BE B0DDE156 9E8FA00A 9886D812
|
||||
9BADA1F1 822223CA 1A605B53 0E379BA4 729FDC59 F105B478 7E5186F5
|
||||
C671085A 1447B52A 48CF1970 B4FB6F84 00BBF4CE BFBB1681 52E08AB5
|
||||
EA53D15C 1AFF87B2 B9DA6E04 E058AD51 CC72BFC9 033B564E 26480D78
|
||||
E955A5E2 9E7AB245 DB2BE315 E2099AFB''');
|
||||
final challenge = srpChallengeWithSecret(
|
||||
group,
|
||||
verifier,
|
||||
_hex('''
|
||||
E487CB59 D31AC550 471E81F0 0F6928E0 1DDA08E9 74A004F4 9E61F5D1
|
||||
05284D20'''),
|
||||
);
|
||||
final clientValue = _hex('''
|
||||
61D5E490 F6F1B795 47B0704C 436F523D D0E560F0 C64115BB 72557EC4
|
||||
4352E890 3211C046 92272D8B 2D1A5358 A2CF1B6E 0BFCF99F 921530EC
|
||||
8E393561 79EAE45E 42BA92AE ACED8251 71E1E8B9 AF6D9C03 E1327F44
|
||||
BE087EF0 6530E69F 66615261 EEF54073 CA11CF58 58F0EDFD FE15EFEA
|
||||
B349EF5D 76988A36 72FAC47B 0769447B''');
|
||||
|
||||
test('k = H(N | PAD(g))', () {
|
||||
expect(
|
||||
multiplierOf(group),
|
||||
_hex('7556AA04 5AEF2CDD 07ABAF0F 665C3E81 8913186F'),
|
||||
);
|
||||
});
|
||||
|
||||
test('B = (k·v + g^b) mod N', () {
|
||||
expect(
|
||||
challenge.publicValue,
|
||||
_hex('''
|
||||
BD0C6151 2C692C0C B6D041FA 01BB152D 4916A1E7 7AF46AE1 05393011
|
||||
BAF38964 DC46A067 0DD125B9 5A981652 236F99D9 B681CBF8 7837EC99
|
||||
6C6DA044 53728610 D0C6DDB5 8B318885 D7D82C7F 8DEB75CE 7BD4FBAA
|
||||
37089E6F 9C6059F3 88838E7A 00030B33 1EB76840 910440B1 B27AAEAE
|
||||
EB4012B7 D7665238 A8E3FB00 4B117B58'''),
|
||||
);
|
||||
});
|
||||
|
||||
test('u = H(PAD(A) | PAD(B))', () {
|
||||
expect(
|
||||
scramblerOf(group, clientValue, challenge.publicValue),
|
||||
_hex('CE38B959 3487DA98 554ED47D 70A7AE5F 462EF019'),
|
||||
);
|
||||
});
|
||||
|
||||
test('the premaster secret S = (A·v^u)^b mod N', () {
|
||||
expect(
|
||||
srpServerPremasterSecret(
|
||||
group,
|
||||
verifier: verifier,
|
||||
challenge: challenge,
|
||||
clientValue: clientValue,
|
||||
scrambler: scramblerOf(group, clientValue, challenge.publicValue),
|
||||
),
|
||||
_hex('''
|
||||
B0DC82BA BCF30674 AE450C02 87745E79 90A3381F 63B387AA F271A10D
|
||||
233861E3 59B48220 F7C4693C 9AE12B0A 6F67809F 0876E2D0 13800D6C
|
||||
41BB59B6 D5979B5C 00A172B4 A2A5903A 0BDCAF8A 709585EB 2AFAFA8F
|
||||
3499B200 210DCC1F 10EB3394 3CD67FC8 8A2F39A4 BE5BEC4E C0A3212D
|
||||
C346D7E4 74B29EDE 8A469FFE CA686E5A'''),
|
||||
);
|
||||
});
|
||||
|
||||
test("the client's half with RFC 5054's secrets is accepted, and its "
|
||||
"proof of the register's accepted in turn", () {
|
||||
final salt = bytesOf(_hex('BEB25379 D1A8581E B5A72767 3A2441EE'));
|
||||
final identity = utf8.encode('alice');
|
||||
final clientGroup = client.SrpGroup.rfc5054TestVectorGroup;
|
||||
final device = client.SrpClient.withSecret(
|
||||
clientGroup,
|
||||
_hex('''
|
||||
60975527 035CF2AD 1989806F 0407210B C81EDC04 E2762A56 AFD529DD
|
||||
DA2D4393'''),
|
||||
);
|
||||
expect(device.publicValue, clientValue);
|
||||
final proof = device.respond(
|
||||
identity: identity,
|
||||
salt: salt,
|
||||
privateValue: client.rfc5054PrivateValue(
|
||||
clientGroup,
|
||||
salt: salt,
|
||||
identity: 'alice',
|
||||
password: 'password123',
|
||||
),
|
||||
serverValue: challenge.publicValue,
|
||||
) as client.SrpClientProof;
|
||||
final verification = srpVerify(
|
||||
group,
|
||||
identity: identity,
|
||||
salt: salt,
|
||||
verifier: verifier,
|
||||
challenge: challenge,
|
||||
clientValue: clientValue,
|
||||
clientProof: proof.proof,
|
||||
);
|
||||
expect(verification, isA<SrpAccepted>());
|
||||
final accepted = verification as SrpAccepted;
|
||||
expect(proof.verifiesServer(accepted.serverProof), isTrue);
|
||||
expect(accepted.sessionKey, proof.sessionKey);
|
||||
});
|
||||
});
|
||||
}
|
||||
Loading…
Reference in a new issue