From f33302df91bb409224caeb3e2679858c44202344 Mon Sep 17 00:00:00 2001 From: Gerardo Pirla Diaz Date: Mon, 7 Sep 2015 15:23:26 +0200 Subject: [PATCH] Initial import --- LICENSE | 2 +- index.js | 3 + lib/jsbn.js | 1542 +++++++++++++++++++++++++++++++++++++ lib/params.js | 182 +++++ lib/srp.js | 456 +++++++++++ package.json | 22 + test/test_picl_vectors.js | 313 ++++++++ test/test_rfc_5054.js | 98 +++ test/test_srp.js | 194 +++++ 9 files changed, 2811 insertions(+), 1 deletion(-) create mode 100644 index.js create mode 100644 lib/jsbn.js create mode 100644 lib/params.js create mode 100644 lib/srp.js create mode 100644 package.json create mode 100644 test/test_picl_vectors.js create mode 100644 test/test_rfc_5054.js create mode 100644 test/test_srp.js diff --git a/LICENSE b/LICENSE index f4d749f..f1928f0 100644 --- a/LICENSE +++ b/LICENSE @@ -1,6 +1,6 @@ -The MIT License (MIT) Copyright (c) 2015 Zarmack Tanen +Copyright (c) 2012-2013 Jed Parsons Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal diff --git a/index.js b/index.js new file mode 100644 index 0000000..0282279 --- /dev/null +++ b/index.js @@ -0,0 +1,3 @@ +module.exports = require('./lib/srp'); + +module.exports.params = require('./lib/params'); diff --git a/lib/jsbn.js b/lib/jsbn.js new file mode 100644 index 0000000..7f2e624 --- /dev/null +++ b/lib/jsbn.js @@ -0,0 +1,1542 @@ +/* + * Basic JavaScript BN library - subset useful for RSA encryption. + * + * Copyright (c) 2003-2005 Tom Wu + * All Rights Reserved. + * + * Permission is hereby granted, free of charge, to any person obtaining + * a copy of this software and associated documentation files (the + * "Software"), to deal in the Software without restriction, including + * without limitation the rights to use, copy, modify, merge, publish, + * distribute, sublicense, and/or sell copies of the Software, and to + * permit persons to whom the Software is furnished to do so, subject to + * the following conditions: + * + * The above copyright notice and this permission notice shall be + * included in all copies or substantial portions of the Software. + * + * THE SOFTWARE IS PROVIDED "AS-IS" AND WITHOUT WARRANTY OF ANY KIND, + * EXPRESS, IMPLIED OR OTHERWISE, INCLUDING WITHOUT LIMITATION, ANY + * WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. + * + * IN NO EVENT SHALL TOM WU BE LIABLE FOR ANY SPECIAL, INCIDENTAL, + * INDIRECT OR CONSEQUENTIAL DAMAGES OF ANY KIND, OR ANY DAMAGES WHATSOEVER + * RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER OR NOT ADVISED OF + * THE POSSIBILITY OF DAMAGE, AND ON ANY THEORY OF LIABILITY, ARISING OUT + * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + * + * In addition, the following condition applies: + * + * All redistributions must retain an intact copy of this copyright notice + * and disclaimer. + */ + +/* + * Added Node.js Buffers support + * 2014 rzcoder + */ + +var crypt = require('crypto'); +var _ = require('lodash'); + +// Bits per digit +var dbits; + +// JavaScript engine analysis +var canary = 0xdeadbeefcafe; +var j_lm = ((canary & 0xffffff) == 0xefcafe); + +// (public) Constructor +function BigInteger(a, b) { + if (a != null) { + if ("number" == typeof a) { + this.fromNumber(a, b); + } else if (Buffer.isBuffer(a)) { + this.fromBuffer(a); + } else if (b == null && "string" != typeof a) { + this.fromByteArray(a); + } else { + this.fromString(a, b); + } + } +} + +// return new, unset BigInteger +function nbi() { + return new BigInteger(null); +} + +// am: Compute w_j += (x*this_i), propagate carries, +// c is initial carry, returns final carry. +// c < 3*dvalue, x < 2*dvalue, this_i < dvalue +// We need to select the fastest one that works in this environment. + +// am1: use a single mult and divide to get the high bits, +// max digit bits should be 26 because +// max internal value = 2*dvalue^2-2*dvalue (< 2^53) +function am1(i, x, w, j, c, n) { + while (--n >= 0) { + var v = x * this[i++] + w[j] + c; + c = Math.floor(v / 0x4000000); + w[j++] = v & 0x3ffffff; + } + return c; +} +// am2 avoids a big mult-and-extract completely. +// Max digit bits should be <= 30 because we do bitwise ops +// on values up to 2*hdvalue^2-hdvalue-1 (< 2^31) +function am2(i, x, w, j, c, n) { + var xl = x & 0x7fff, xh = x >> 15; + while (--n >= 0) { + var l = this[i] & 0x7fff; + var h = this[i++] >> 15; + var m = xh * l + h * xl; + l = xl * l + ((m & 0x7fff) << 15) + w[j] + (c & 0x3fffffff); + c = (l >>> 30) + (m >>> 15) + xh * h + (c >>> 30); + w[j++] = l & 0x3fffffff; + } + return c; +} +// Alternately, set max digit bits to 28 since some +// browsers slow down when dealing with 32-bit numbers. +function am3(i, x, w, j, c, n) { + var xl = x & 0x3fff, xh = x >> 14; + while (--n >= 0) { + var l = this[i] & 0x3fff; + var h = this[i++] >> 14; + var m = xh * l + h * xl; + l = xl * l + ((m & 0x3fff) << 14) + w[j] + c; + c = (l >> 28) + (m >> 14) + xh * h; + w[j++] = l & 0xfffffff; + } + return c; +} + +// We need to select the fastest one that works in this environment. +//if (j_lm && (navigator.appName == "Microsoft Internet Explorer")) { +// BigInteger.prototype.am = am2; +// dbits = 30; +//} else if (j_lm && (navigator.appName != "Netscape")) { +// BigInteger.prototype.am = am1; +// dbits = 26; +//} else { // Mozilla/Netscape seems to prefer am3 +// BigInteger.prototype.am = am3; +// dbits = 28; +//} + +// For node.js, we pick am3 with max dbits to 28. +BigInteger.prototype.am = am3; +dbits = 28; + +BigInteger.prototype.DB = dbits; +BigInteger.prototype.DM = ((1 << dbits) - 1); +BigInteger.prototype.DV = (1 << dbits); + +var BI_FP = 52; +BigInteger.prototype.FV = Math.pow(2, BI_FP); +BigInteger.prototype.F1 = BI_FP - dbits; +BigInteger.prototype.F2 = 2 * dbits - BI_FP; + +// Digit conversions +var BI_RM = "0123456789abcdefghijklmnopqrstuvwxyz"; +var BI_RC = new Array(); +var rr, vv; +rr = "0".charCodeAt(0); +for (vv = 0; vv <= 9; ++vv) BI_RC[rr++] = vv; +rr = "a".charCodeAt(0); +for (vv = 10; vv < 36; ++vv) BI_RC[rr++] = vv; +rr = "A".charCodeAt(0); +for (vv = 10; vv < 36; ++vv) BI_RC[rr++] = vv; + +function int2char(n) { + return BI_RM.charAt(n); +} +function intAt(s, i) { + var c = BI_RC[s.charCodeAt(i)]; + return (c == null) ? -1 : c; +} + +// (protected) copy this to r +function bnpCopyTo(r) { + for (var i = this.t - 1; i >= 0; --i) r[i] = this[i]; + r.t = this.t; + r.s = this.s; +} + +// (protected) set from integer value x, -DV <= x < DV +function bnpFromInt(x) { + this.t = 1; + this.s = (x < 0) ? -1 : 0; + if (x > 0) this[0] = x; + else if (x < -1) this[0] = x + DV; + else this.t = 0; +} + +// return bigint initialized to value +function nbv(i) { + var r = nbi(); + r.fromInt(i); + return r; +} + +// (protected) set from string and radix +function bnpFromString(data, radix, unsigned) { + var k; + switch (radix) { + case 2: + k = 1; + break; + case 4: + k = 2; + break; + case 8: + k = 3; + break; + case 16: + k = 4; + break; + case 32: + k = 5; + break; + case 256: + k = 8; + break; + default: + this.fromRadix(data, radix); + return; + } + + this.t = 0; + this.s = 0; + + var i = data.length; + var mi = false; + var sh = 0; + + while (--i >= 0) { + var x = (k == 8) ? data[i] & 0xff : intAt(data, i); + if (x < 0) { + if (data.charAt(i) == "-") mi = true; + continue; + } + mi = false; + if (sh === 0) + this[this.t++] = x; + else if (sh + k > this.DB) { + this[this.t - 1] |= (x & ((1 << (this.DB - sh)) - 1)) << sh; + this[this.t++] = (x >> (this.DB - sh)); + } + else + this[this.t - 1] |= x << sh; + sh += k; + if (sh >= this.DB) sh -= this.DB; + } + if ((!unsigned) && k == 8 && (data[0] & 0x80) != 0) { + this.s = -1; + if (sh > 0) this[this.t - 1] |= ((1 << (this.DB - sh)) - 1) << sh; + } + this.clamp(); + if (mi) BigInteger.ZERO.subTo(this, this); +} + +function bnpFromByteArray(a, unsigned) { + this.fromString(a, 256, unsigned) +} + +function bnpFromBuffer(a) { + this.fromString(a, 256, true) +} + +// (protected) clamp off excess high words +function bnpClamp() { + var c = this.s & this.DM; + while (this.t > 0 && this[this.t - 1] == c) --this.t; +} + +// (public) return string representation in given radix +function bnToString(b) { + if (this.s < 0) return "-" + this.negate().toString(b); + var k; + if (b == 16) k = 4; + else if (b == 8) k = 3; + else if (b == 2) k = 1; + else if (b == 32) k = 5; + else if (b == 4) k = 2; + else return this.toRadix(b); + var km = (1 << k) - 1, d, m = false, r = "", i = this.t; + var p = this.DB - (i * this.DB) % k; + if (i-- > 0) { + if (p < this.DB && (d = this[i] >> p) > 0) { + m = true; + r = int2char(d); + } + while (i >= 0) { + if (p < k) { + d = (this[i] & ((1 << p) - 1)) << (k - p); + d |= this[--i] >> (p += this.DB - k); + } + else { + d = (this[i] >> (p -= k)) & km; + if (p <= 0) { + p += this.DB; + --i; + } + } + if (d > 0) m = true; + if (m) r += int2char(d); + } + } + if(r.length == 1) + r = '0' + r; + return m ? r : "0"; +} + +// (public) -this +function bnNegate() { + var r = nbi(); + BigInteger.ZERO.subTo(this, r); + return r; +} + +// (public) |this| +function bnAbs() { + return (this.s < 0) ? this.negate() : this; +} + +// (public) return + if this > a, - if this < a, 0 if equal +function bnCompareTo(a) { + var r = this.s - a.s; + if (r != 0) return r; + var i = this.t; + r = i - a.t; + if (r != 0) return (this.s < 0) ? -r : r; + while (--i >= 0) if ((r = this[i] - a[i]) != 0) return r; + return 0; +} + +// returns bit length of the integer x +function nbits(x) { + var r = 1, t; + if ((t = x >>> 16) != 0) { + x = t; + r += 16; + } + if ((t = x >> 8) != 0) { + x = t; + r += 8; + } + if ((t = x >> 4) != 0) { + x = t; + r += 4; + } + if ((t = x >> 2) != 0) { + x = t; + r += 2; + } + if ((t = x >> 1) != 0) { + x = t; + r += 1; + } + return r; +} + +// (public) return the number of bits in "this" +function bnBitLength() { + if (this.t <= 0) return 0; + return this.DB * (this.t - 1) + nbits(this[this.t - 1] ^ (this.s & this.DM)); +} + +// (protected) r = this << n*DB +function bnpDLShiftTo(n, r) { + var i; + for (i = this.t - 1; i >= 0; --i) r[i + n] = this[i]; + for (i = n - 1; i >= 0; --i) r[i] = 0; + r.t = this.t + n; + r.s = this.s; +} + +// (protected) r = this >> n*DB +function bnpDRShiftTo(n, r) { + for (var i = n; i < this.t; ++i) r[i - n] = this[i]; + r.t = Math.max(this.t - n, 0); + r.s = this.s; +} + +// (protected) r = this << n +function bnpLShiftTo(n, r) { + var bs = n % this.DB; + var cbs = this.DB - bs; + var bm = (1 << cbs) - 1; + var ds = Math.floor(n / this.DB), c = (this.s << bs) & this.DM, i; + for (i = this.t - 1; i >= 0; --i) { + r[i + ds + 1] = (this[i] >> cbs) | c; + c = (this[i] & bm) << bs; + } + for (i = ds - 1; i >= 0; --i) r[i] = 0; + r[ds] = c; + r.t = this.t + ds + 1; + r.s = this.s; + r.clamp(); +} + +// (protected) r = this >> n +function bnpRShiftTo(n, r) { + r.s = this.s; + var ds = Math.floor(n / this.DB); + if (ds >= this.t) { + r.t = 0; + return; + } + var bs = n % this.DB; + var cbs = this.DB - bs; + var bm = (1 << bs) - 1; + r[0] = this[ds] >> bs; + for (var i = ds + 1; i < this.t; ++i) { + r[i - ds - 1] |= (this[i] & bm) << cbs; + r[i - ds] = this[i] >> bs; + } + if (bs > 0) r[this.t - ds - 1] |= (this.s & bm) << cbs; + r.t = this.t - ds; + r.clamp(); +} + +// (protected) r = this - a +function bnpSubTo(a, r) { + var i = 0, c = 0, m = Math.min(a.t, this.t); + while (i < m) { + c += this[i] - a[i]; + r[i++] = c & this.DM; + c >>= this.DB; + } + if (a.t < this.t) { + c -= a.s; + while (i < this.t) { + c += this[i]; + r[i++] = c & this.DM; + c >>= this.DB; + } + c += this.s; + } + else { + c += this.s; + while (i < a.t) { + c -= a[i]; + r[i++] = c & this.DM; + c >>= this.DB; + } + c -= a.s; + } + r.s = (c < 0) ? -1 : 0; + if (c < -1) r[i++] = this.DV + c; + else if (c > 0) r[i++] = c; + r.t = i; + r.clamp(); +} + +// (protected) r = this * a, r != this,a (HAC 14.12) +// "this" should be the larger one if appropriate. +function bnpMultiplyTo(a, r) { + var x = this.abs(), y = a.abs(); + var i = x.t; + r.t = i + y.t; + while (--i >= 0) r[i] = 0; + for (i = 0; i < y.t; ++i) r[i + x.t] = x.am(0, y[i], r, i, 0, x.t); + r.s = 0; + r.clamp(); + if (this.s != a.s) BigInteger.ZERO.subTo(r, r); +} + +// (protected) r = this^2, r != this (HAC 14.16) +function bnpSquareTo(r) { + var x = this.abs(); + var i = r.t = 2 * x.t; + while (--i >= 0) r[i] = 0; + for (i = 0; i < x.t - 1; ++i) { + var c = x.am(i, x[i], r, 2 * i, 0, 1); + if ((r[i + x.t] += x.am(i + 1, 2 * x[i], r, 2 * i + 1, c, x.t - i - 1)) >= x.DV) { + r[i + x.t] -= x.DV; + r[i + x.t + 1] = 1; + } + } + if (r.t > 0) r[r.t - 1] += x.am(i, x[i], r, 2 * i, 0, 1); + r.s = 0; + r.clamp(); +} + +// (protected) divide this by m, quotient and remainder to q, r (HAC 14.20) +// r != q, this != m. q or r may be null. +function bnpDivRemTo(m, q, r) { + var pm = m.abs(); + if (pm.t <= 0) return; + var pt = this.abs(); + if (pt.t < pm.t) { + if (q != null) q.fromInt(0); + if (r != null) this.copyTo(r); + return; + } + if (r == null) r = nbi(); + var y = nbi(), ts = this.s, ms = m.s; + var nsh = this.DB - nbits(pm[pm.t - 1]); // normalize modulus + if (nsh > 0) { + pm.lShiftTo(nsh, y); + pt.lShiftTo(nsh, r); + } + else { + pm.copyTo(y); + pt.copyTo(r); + } + var ys = y.t; + var y0 = y[ys - 1]; + if (y0 === 0) return; + var yt = y0 * (1 << this.F1) + ((ys > 1) ? y[ys - 2] >> this.F2 : 0); + var d1 = this.FV / yt, d2 = (1 << this.F1) / yt, e = 1 << this.F2; + var i = r.t, j = i - ys, t = (q == null) ? nbi() : q; + y.dlShiftTo(j, t); + if (r.compareTo(t) >= 0) { + r[r.t++] = 1; + r.subTo(t, r); + } + BigInteger.ONE.dlShiftTo(ys, t); + t.subTo(y, y); // "negative" y so we can replace sub with am later + while (y.t < ys) y[y.t++] = 0; + while (--j >= 0) { + // Estimate quotient digit + var qd = (r[--i] == y0) ? this.DM : Math.floor(r[i] * d1 + (r[i - 1] + e) * d2); + if ((r[i] += y.am(0, qd, r, j, 0, ys)) < qd) { // Try it out + y.dlShiftTo(j, t); + r.subTo(t, r); + while (r[i] < --qd) r.subTo(t, r); + } + } + if (q != null) { + r.drShiftTo(ys, q); + if (ts != ms) BigInteger.ZERO.subTo(q, q); + } + r.t = ys; + r.clamp(); + if (nsh > 0) r.rShiftTo(nsh, r); // Denormalize remainder + if (ts < 0) BigInteger.ZERO.subTo(r, r); +} + +// (public) this mod a +function bnMod(a) { + var r = nbi(); + this.abs().divRemTo(a, null, r); + if (this.s < 0 && r.compareTo(BigInteger.ZERO) > 0) a.subTo(r, r); + return r; +} + +// Modular reduction using "classic" algorithm +function Classic(m) { + this.m = m; +} +function cConvert(x) { + if (x.s < 0 || x.compareTo(this.m) >= 0) return x.mod(this.m); + else return x; +} +function cRevert(x) { + return x; +} +function cReduce(x) { + x.divRemTo(this.m, null, x); +} +function cMulTo(x, y, r) { + x.multiplyTo(y, r); + this.reduce(r); +} +function cSqrTo(x, r) { + x.squareTo(r); + this.reduce(r); +} + +Classic.prototype.convert = cConvert; +Classic.prototype.revert = cRevert; +Classic.prototype.reduce = cReduce; +Classic.prototype.mulTo = cMulTo; +Classic.prototype.sqrTo = cSqrTo; + +// (protected) return "-1/this % 2^DB"; useful for Mont. reduction +// justification: +// xy == 1 (mod m) +// xy = 1+km +// xy(2-xy) = (1+km)(1-km) +// x[y(2-xy)] = 1-k^2m^2 +// x[y(2-xy)] == 1 (mod m^2) +// if y is 1/x mod m, then y(2-xy) is 1/x mod m^2 +// should reduce x and y(2-xy) by m^2 at each step to keep size bounded. +// JS multiply "overflows" differently from C/C++, so care is needed here. +function bnpInvDigit() { + if (this.t < 1) return 0; + var x = this[0]; + if ((x & 1) === 0) return 0; + var y = x & 3; // y == 1/x mod 2^2 + y = (y * (2 - (x & 0xf) * y)) & 0xf; // y == 1/x mod 2^4 + y = (y * (2 - (x & 0xff) * y)) & 0xff; // y == 1/x mod 2^8 + y = (y * (2 - (((x & 0xffff) * y) & 0xffff))) & 0xffff; // y == 1/x mod 2^16 + // last step - calculate inverse mod DV directly; + // assumes 16 < DB <= 32 and assumes ability to handle 48-bit ints + y = (y * (2 - x * y % this.DV)) % this.DV; // y == 1/x mod 2^dbits + // we really want the negative inverse, and -DV < y < DV + return (y > 0) ? this.DV - y : -y; +} + +// Montgomery reduction +function Montgomery(m) { + this.m = m; + this.mp = m.invDigit(); + this.mpl = this.mp & 0x7fff; + this.mph = this.mp >> 15; + this.um = (1 << (m.DB - 15)) - 1; + this.mt2 = 2 * m.t; +} + +// xR mod m +function montConvert(x) { + var r = nbi(); + x.abs().dlShiftTo(this.m.t, r); + r.divRemTo(this.m, null, r); + if (x.s < 0 && r.compareTo(BigInteger.ZERO) > 0) this.m.subTo(r, r); + return r; +} + +// x/R mod m +function montRevert(x) { + var r = nbi(); + x.copyTo(r); + this.reduce(r); + return r; +} + +// x = x/R mod m (HAC 14.32) +function montReduce(x) { + while (x.t <= this.mt2) // pad x so am has enough room later + x[x.t++] = 0; + for (var i = 0; i < this.m.t; ++i) { + // faster way of calculating u0 = x[i]*mp mod DV + var j = x[i] & 0x7fff; + var u0 = (j * this.mpl + (((j * this.mph + (x[i] >> 15) * this.mpl) & this.um) << 15)) & x.DM; + // use am to combine the multiply-shift-add into one call + j = i + this.m.t; + x[j] += this.m.am(0, u0, x, i, 0, this.m.t); + // propagate carry + while (x[j] >= x.DV) { + x[j] -= x.DV; + x[++j]++; + } + } + x.clamp(); + x.drShiftTo(this.m.t, x); + if (x.compareTo(this.m) >= 0) x.subTo(this.m, x); +} + +// r = "x^2/R mod m"; x != r +function montSqrTo(x, r) { + x.squareTo(r); + this.reduce(r); +} + +// r = "xy/R mod m"; x,y != r +function montMulTo(x, y, r) { + x.multiplyTo(y, r); + this.reduce(r); +} + +Montgomery.prototype.convert = montConvert; +Montgomery.prototype.revert = montRevert; +Montgomery.prototype.reduce = montReduce; +Montgomery.prototype.mulTo = montMulTo; +Montgomery.prototype.sqrTo = montSqrTo; + +// (protected) true iff this is even +function bnpIsEven() { + return ((this.t > 0) ? (this[0] & 1) : this.s) === 0; +} + +// (protected) this^e, e < 2^32, doing sqr and mul with "r" (HAC 14.79) +function bnpExp(e, z) { + if (e > 0xffffffff || e < 1) return BigInteger.ONE; + var r = nbi(), r2 = nbi(), g = z.convert(this), i = nbits(e) - 1; + g.copyTo(r); + while (--i >= 0) { + z.sqrTo(r, r2); + if ((e & (1 << i)) > 0) z.mulTo(r2, g, r); + else { + var t = r; + r = r2; + r2 = t; + } + } + return z.revert(r); +} + +// (public) this^e % m, 0 <= e < 2^32 +function bnModPowInt(e, m) { + var z; + if (e < 256 || m.isEven()) z = new Classic(m); else z = new Montgomery(m); + return this.exp(e, z); +} + +// Copyright (c) 2005-2009 Tom Wu +// All Rights Reserved. +// See "LICENSE" for details. + +// Extended JavaScript BN functions, required for RSA private ops. + +// Version 1.1: new BigInteger("0", 10) returns "proper" zero +// Version 1.2: square() API, isProbablePrime fix + +//(public) +function bnClone() { + var r = nbi(); + this.copyTo(r); + return r; +} + +//(public) return value as integer +function bnIntValue() { + if (this.s < 0) { + if (this.t == 1) return this[0] - this.DV; + else if (this.t === 0) return -1; + } + else if (this.t == 1) return this[0]; + else if (this.t === 0) return 0; +// assumes 16 < DB < 32 + return ((this[1] & ((1 << (32 - this.DB)) - 1)) << this.DB) | this[0]; +} + +//(public) return value as byte +function bnByteValue() { + return (this.t == 0) ? this.s : (this[0] << 24) >> 24; +} + +//(public) return value as short (assumes DB>=16) +function bnShortValue() { + return (this.t == 0) ? this.s : (this[0] << 16) >> 16; +} + +//(protected) return x s.t. r^x < DV +function bnpChunkSize(r) { + return Math.floor(Math.LN2 * this.DB / Math.log(r)); +} + +//(public) 0 if this === 0, 1 if this > 0 +function bnSigNum() { + if (this.s < 0) return -1; + else if (this.t <= 0 || (this.t == 1 && this[0] <= 0)) return 0; + else return 1; +} + +//(protected) convert to radix string +function bnpToRadix(b) { + if (b == null) b = 10; + if (this.signum() === 0 || b < 2 || b > 36) return "0"; + var cs = this.chunkSize(b); + var a = Math.pow(b, cs); + var d = nbv(a), y = nbi(), z = nbi(), r = ""; + this.divRemTo(d, y, z); + while (y.signum() > 0) { + r = (a + z.intValue()).toString(b).substr(1) + r; + y.divRemTo(d, y, z); + } + return z.intValue().toString(b) + r; +} + +//(protected) convert from radix string +function bnpFromRadix(s, b) { + this.fromInt(0); + if (b == null) b = 10; + var cs = this.chunkSize(b); + var d = Math.pow(b, cs), mi = false, j = 0, w = 0; + for (var i = 0; i < s.length; ++i) { + var x = intAt(s, i); + if (x < 0) { + if (s.charAt(i) == "-" && this.signum() === 0) mi = true; + continue; + } + w = b * w + x; + if (++j >= cs) { + this.dMultiply(d); + this.dAddOffset(w, 0); + j = 0; + w = 0; + } + } + if (j > 0) { + this.dMultiply(Math.pow(b, j)); + this.dAddOffset(w, 0); + } + if (mi) BigInteger.ZERO.subTo(this, this); +} + +//(protected) alternate constructor +function bnpFromNumber(a, b) { + if ("number" == typeof b) { + // new BigInteger(int,int,RNG) + if (a < 2) this.fromInt(1); + else { + this.fromNumber(a); + if (!this.testBit(a - 1)) // force MSB set + this.bitwiseTo(BigInteger.ONE.shiftLeft(a - 1), op_or, this); + if (this.isEven()) this.dAddOffset(1, 0); // force odd + while (!this.isProbablePrime(b)) { + this.dAddOffset(2, 0); + if (this.bitLength() > a) this.subTo(BigInteger.ONE.shiftLeft(a - 1), this); + } + } + } else { + // new BigInteger(int,RNG) + var x = crypt.randomBytes((a >> 3) + 1) + var t = a & 7; + + if (t > 0) + x[0] &= ((1 << t) - 1); + else + x[0] = 0; + + this.fromByteArray(x); + } +} + +//(public) convert to bigendian byte array +function bnToByteArray() { + var i = this.t, r = new Array(); + r[0] = this.s; + var p = this.DB - (i * this.DB) % 8, d, k = 0; + if (i-- > 0) { + if (p < this.DB && (d = this[i] >> p) != (this.s & this.DM) >> p) + r[k++] = d | (this.s << (this.DB - p)); + while (i >= 0) { + if (p < 8) { + d = (this[i] & ((1 << p) - 1)) << (8 - p); + d |= this[--i] >> (p += this.DB - 8); + } + else { + d = (this[i] >> (p -= 8)) & 0xff; + if (p <= 0) { + p += this.DB; + --i; + } + } + if ((d & 0x80) != 0) d |= -256; + if (k === 0 && (this.s & 0x80) != (d & 0x80)) ++k; + if (k > 0 || d != this.s) r[k++] = d; + } + } + return r; +} + +/** + * return Buffer object + * @param trim {boolean} slice buffer if first element == 0 + * @returns {Buffer} + */ +function bnToBuffer(trimOrSize) { + var res = new Buffer(this.toByteArray()); + if (trimOrSize === true && res[0] === 0) { + res = res.slice(1); + } else if (_.isNumber(trimOrSize)) { + if (res.length > trimOrSize) { + for (var i = 0; i < res.length - trimOrSize; i++) { + if (res[i] !== 0) { + return null; + } + } + return res.slice(res.length - trimOrSize); + } else if (res.length < trimOrSize) { + var padded = new Buffer(trimOrSize); + padded.fill(0, 0, trimOrSize - res.length); + res.copy(padded, trimOrSize - res.length); + return padded; + } + } + return res; +} + +function bnEquals(a) { + return (this.compareTo(a) == 0); +} +function bnMin(a) { + return (this.compareTo(a) < 0) ? this : a; +} +function bnMax(a) { + return (this.compareTo(a) > 0) ? this : a; +} + +//(protected) r = this op a (bitwise) +function bnpBitwiseTo(a, op, r) { + var i, f, m = Math.min(a.t, this.t); + for (i = 0; i < m; ++i) r[i] = op(this[i], a[i]); + if (a.t < this.t) { + f = a.s & this.DM; + for (i = m; i < this.t; ++i) r[i] = op(this[i], f); + r.t = this.t; + } + else { + f = this.s & this.DM; + for (i = m; i < a.t; ++i) r[i] = op(f, a[i]); + r.t = a.t; + } + r.s = op(this.s, a.s); + r.clamp(); +} + +//(public) this & a +function op_and(x, y) { + return x & y; +} +function bnAnd(a) { + var r = nbi(); + this.bitwiseTo(a, op_and, r); + return r; +} + +//(public) this | a +function op_or(x, y) { + return x | y; +} +function bnOr(a) { + var r = nbi(); + this.bitwiseTo(a, op_or, r); + return r; +} + +//(public) this ^ a +function op_xor(x, y) { + return x ^ y; +} +function bnXor(a) { + var r = nbi(); + this.bitwiseTo(a, op_xor, r); + return r; +} + +//(public) this & ~a +function op_andnot(x, y) { + return x & ~y; +} +function bnAndNot(a) { + var r = nbi(); + this.bitwiseTo(a, op_andnot, r); + return r; +} + +//(public) ~this +function bnNot() { + var r = nbi(); + for (var i = 0; i < this.t; ++i) r[i] = this.DM & ~this[i]; + r.t = this.t; + r.s = ~this.s; + return r; +} + +//(public) this << n +function bnShiftLeft(n) { + var r = nbi(); + if (n < 0) this.rShiftTo(-n, r); else this.lShiftTo(n, r); + return r; +} + +//(public) this >> n +function bnShiftRight(n) { + var r = nbi(); + if (n < 0) this.lShiftTo(-n, r); else this.rShiftTo(n, r); + return r; +} + +//return index of lowest 1-bit in x, x < 2^31 +function lbit(x) { + if (x === 0) return -1; + var r = 0; + if ((x & 0xffff) === 0) { + x >>= 16; + r += 16; + } + if ((x & 0xff) === 0) { + x >>= 8; + r += 8; + } + if ((x & 0xf) === 0) { + x >>= 4; + r += 4; + } + if ((x & 3) === 0) { + x >>= 2; + r += 2; + } + if ((x & 1) === 0) ++r; + return r; +} + +//(public) returns index of lowest 1-bit (or -1 if none) +function bnGetLowestSetBit() { + for (var i = 0; i < this.t; ++i) + if (this[i] != 0) return i * this.DB + lbit(this[i]); + if (this.s < 0) return this.t * this.DB; + return -1; +} + +//return number of 1 bits in x +function cbit(x) { + var r = 0; + while (x != 0) { + x &= x - 1; + ++r; + } + return r; +} + +//(public) return number of set bits +function bnBitCount() { + var r = 0, x = this.s & this.DM; + for (var i = 0; i < this.t; ++i) r += cbit(this[i] ^ x); + return r; +} + +//(public) true iff nth bit is set +function bnTestBit(n) { + var j = Math.floor(n / this.DB); + if (j >= this.t) return (this.s != 0); + return ((this[j] & (1 << (n % this.DB))) != 0); +} + +//(protected) this op (1<>= this.DB; + } + if (a.t < this.t) { + c += a.s; + while (i < this.t) { + c += this[i]; + r[i++] = c & this.DM; + c >>= this.DB; + } + c += this.s; + } + else { + c += this.s; + while (i < a.t) { + c += a[i]; + r[i++] = c & this.DM; + c >>= this.DB; + } + c += a.s; + } + r.s = (c < 0) ? -1 : 0; + if (c > 0) r[i++] = c; + else if (c < -1) r[i++] = this.DV + c; + r.t = i; + r.clamp(); +} + +//(public) this + a +function bnAdd(a) { + var r = nbi(); + this.addTo(a, r); + return r; +} + +//(public) this - a +function bnSubtract(a) { + var r = nbi(); + this.subTo(a, r); + return r; +} + +//(public) this * a +function bnMultiply(a) { + var r = nbi(); + this.multiplyTo(a, r); + return r; +} + +// (public) this^2 +function bnSquare() { + var r = nbi(); + this.squareTo(r); + return r; +} + +//(public) this / a +function bnDivide(a) { + var r = nbi(); + this.divRemTo(a, r, null); + return r; +} + +//(public) this % a +function bnRemainder(a) { + var r = nbi(); + this.divRemTo(a, null, r); + return r; +} + +//(public) [this/a,this%a] +function bnDivideAndRemainder(a) { + var q = nbi(), r = nbi(); + this.divRemTo(a, q, r); + return new Array(q, r); +} + +//(protected) this *= n, this >= 0, 1 < n < DV +function bnpDMultiply(n) { + this[this.t] = this.am(0, n - 1, this, 0, 0, this.t); + ++this.t; + this.clamp(); +} + +//(protected) this += n << w words, this >= 0 +function bnpDAddOffset(n, w) { + if (n === 0) return; + while (this.t <= w) this[this.t++] = 0; + this[w] += n; + while (this[w] >= this.DV) { + this[w] -= this.DV; + if (++w >= this.t) this[this.t++] = 0; + ++this[w]; + } +} + +//A "null" reducer +function NullExp() { +} +function nNop(x) { + return x; +} +function nMulTo(x, y, r) { + x.multiplyTo(y, r); +} +function nSqrTo(x, r) { + x.squareTo(r); +} + +NullExp.prototype.convert = nNop; +NullExp.prototype.revert = nNop; +NullExp.prototype.mulTo = nMulTo; +NullExp.prototype.sqrTo = nSqrTo; + +//(public) this^e +function bnPow(e) { + return this.exp(e, new NullExp()); +} + +//(protected) r = lower n words of "this * a", a.t <= n +//"this" should be the larger one if appropriate. +function bnpMultiplyLowerTo(a, n, r) { + var i = Math.min(this.t + a.t, n); + r.s = 0; // assumes a,this >= 0 + r.t = i; + while (i > 0) r[--i] = 0; + var j; + for (j = r.t - this.t; i < j; ++i) r[i + this.t] = this.am(0, a[i], r, i, 0, this.t); + for (j = Math.min(a.t, n); i < j; ++i) this.am(0, a[i], r, i, 0, n - i); + r.clamp(); +} + +//(protected) r = "this * a" without lower n words, n > 0 +//"this" should be the larger one if appropriate. +function bnpMultiplyUpperTo(a, n, r) { + --n; + var i = r.t = this.t + a.t - n; + r.s = 0; // assumes a,this >= 0 + while (--i >= 0) r[i] = 0; + for (i = Math.max(n - this.t, 0); i < a.t; ++i) + r[this.t + i - n] = this.am(n - i, a[i], r, 0, 0, this.t + i - n); + r.clamp(); + r.drShiftTo(1, r); +} + +//Barrett modular reduction +function Barrett(m) { +// setup Barrett + this.r2 = nbi(); + this.q3 = nbi(); + BigInteger.ONE.dlShiftTo(2 * m.t, this.r2); + this.mu = this.r2.divide(m); + this.m = m; +} + +function barrettConvert(x) { + if (x.s < 0 || x.t > 2 * this.m.t) return x.mod(this.m); + else if (x.compareTo(this.m) < 0) return x; + else { + var r = nbi(); + x.copyTo(r); + this.reduce(r); + return r; + } +} + +function barrettRevert(x) { + return x; +} + +//x = x mod m (HAC 14.42) +function barrettReduce(x) { + x.drShiftTo(this.m.t - 1, this.r2); + if (x.t > this.m.t + 1) { + x.t = this.m.t + 1; + x.clamp(); + } + this.mu.multiplyUpperTo(this.r2, this.m.t + 1, this.q3); + this.m.multiplyLowerTo(this.q3, this.m.t + 1, this.r2); + while (x.compareTo(this.r2) < 0) x.dAddOffset(1, this.m.t + 1); + x.subTo(this.r2, x); + while (x.compareTo(this.m) >= 0) x.subTo(this.m, x); +} + +//r = x^2 mod m; x != r +function barrettSqrTo(x, r) { + x.squareTo(r); + this.reduce(r); +} + +//r = x*y mod m; x,y != r +function barrettMulTo(x, y, r) { + x.multiplyTo(y, r); + this.reduce(r); +} + +Barrett.prototype.convert = barrettConvert; +Barrett.prototype.revert = barrettRevert; +Barrett.prototype.reduce = barrettReduce; +Barrett.prototype.mulTo = barrettMulTo; +Barrett.prototype.sqrTo = barrettSqrTo; + +//(public) this^e % m (HAC 14.85) +function bnModPow(e, m) { + var i = e.bitLength(), k, r = nbv(1), z; + if (i <= 0) return r; + else if (i < 18) k = 1; + else if (i < 48) k = 3; + else if (i < 144) k = 4; + else if (i < 768) k = 5; + else k = 6; + if (i < 8) + z = new Classic(m); + else if (m.isEven()) + z = new Barrett(m); + else + z = new Montgomery(m); + +// precomputation + var g = new Array(), n = 3, k1 = k - 1, km = (1 << k) - 1; + g[1] = z.convert(this); + if (k > 1) { + var g2 = nbi(); + z.sqrTo(g[1], g2); + while (n <= km) { + g[n] = nbi(); + z.mulTo(g2, g[n - 2], g[n]); + n += 2; + } + } + + var j = e.t - 1, w, is1 = true, r2 = nbi(), t; + i = nbits(e[j]) - 1; + while (j >= 0) { + if (i >= k1) w = (e[j] >> (i - k1)) & km; + else { + w = (e[j] & ((1 << (i + 1)) - 1)) << (k1 - i); + if (j > 0) w |= e[j - 1] >> (this.DB + i - k1); + } + + n = k; + while ((w & 1) === 0) { + w >>= 1; + --n; + } + if ((i -= n) < 0) { + i += this.DB; + --j; + } + if (is1) { // ret == 1, don't bother squaring or multiplying it + g[w].copyTo(r); + is1 = false; + } + else { + while (n > 1) { + z.sqrTo(r, r2); + z.sqrTo(r2, r); + n -= 2; + } + if (n > 0) z.sqrTo(r, r2); else { + t = r; + r = r2; + r2 = t; + } + z.mulTo(r2, g[w], r); + } + + while (j >= 0 && (e[j] & (1 << i)) === 0) { + z.sqrTo(r, r2); + t = r; + r = r2; + r2 = t; + if (--i < 0) { + i = this.DB - 1; + --j; + } + } + } + return z.revert(r); +} + +//(public) gcd(this,a) (HAC 14.54) +function bnGCD(a) { + var x = (this.s < 0) ? this.negate() : this.clone(); + var y = (a.s < 0) ? a.negate() : a.clone(); + if (x.compareTo(y) < 0) { + var t = x; + x = y; + y = t; + } + var i = x.getLowestSetBit(), g = y.getLowestSetBit(); + if (g < 0) return x; + if (i < g) g = i; + if (g > 0) { + x.rShiftTo(g, x); + y.rShiftTo(g, y); + } + while (x.signum() > 0) { + if ((i = x.getLowestSetBit()) > 0) x.rShiftTo(i, x); + if ((i = y.getLowestSetBit()) > 0) y.rShiftTo(i, y); + if (x.compareTo(y) >= 0) { + x.subTo(y, x); + x.rShiftTo(1, x); + } + else { + y.subTo(x, y); + y.rShiftTo(1, y); + } + } + if (g > 0) y.lShiftTo(g, y); + return y; +} + +//(protected) this % n, n < 2^26 +function bnpModInt(n) { + if (n <= 0) return 0; + var d = this.DV % n, r = (this.s < 0) ? n - 1 : 0; + if (this.t > 0) + if (d === 0) r = this[0] % n; + else for (var i = this.t - 1; i >= 0; --i) r = (d * r + this[i]) % n; + return r; +} + +//(public) 1/this % m (HAC 14.61) +function bnModInverse(m) { + var ac = m.isEven(); + if ((this.isEven() && ac) || m.signum() === 0) return BigInteger.ZERO; + var u = m.clone(), v = this.clone(); + var a = nbv(1), b = nbv(0), c = nbv(0), d = nbv(1); + while (u.signum() != 0) { + while (u.isEven()) { + u.rShiftTo(1, u); + if (ac) { + if (!a.isEven() || !b.isEven()) { + a.addTo(this, a); + b.subTo(m, b); + } + a.rShiftTo(1, a); + } + else if (!b.isEven()) b.subTo(m, b); + b.rShiftTo(1, b); + } + while (v.isEven()) { + v.rShiftTo(1, v); + if (ac) { + if (!c.isEven() || !d.isEven()) { + c.addTo(this, c); + d.subTo(m, d); + } + c.rShiftTo(1, c); + } + else if (!d.isEven()) d.subTo(m, d); + d.rShiftTo(1, d); + } + if (u.compareTo(v) >= 0) { + u.subTo(v, u); + if (ac) a.subTo(c, a); + b.subTo(d, b); + } + else { + v.subTo(u, v); + if (ac) c.subTo(a, c); + d.subTo(b, d); + } + } + if (v.compareTo(BigInteger.ONE) != 0) return BigInteger.ZERO; + if (d.compareTo(m) >= 0) return d.subtract(m); + if (d.signum() < 0) d.addTo(m, d); else return d; + if (d.signum() < 0) return d.add(m); else return d; +} + +var lowprimes = [2, 3, 5, 7, 11, 13, 17, 19, 23, 29, 31, 37, 41, 43, 47, 53, 59, 61, 67, 71, 73, 79, 83, 89, 97, 101, 103, 107, 109, 113, 127, 131, 137, 139, 149, 151, 157, 163, 167, 173, 179, 181, 191, 193, 197, 199, 211, 223, 227, 229, 233, 239, 241, 251, 257, 263, 269, 271, 277, 281, 283, 293, 307, 311, 313, 317, 331, 337, 347, 349, 353, 359, 367, 373, 379, 383, 389, 397, 401, 409, 419, 421, 431, 433, 439, 443, 449, 457, 461, 463, 467, 479, 487, 491, 499, 503, 509, 521, 523, 541, 547, 557, 563, 569, 571, 577, 587, 593, 599, 601, 607, 613, 617, 619, 631, 641, 643, 647, 653, 659, 661, 673, 677, 683, 691, 701, 709, 719, 727, 733, 739, 743, 751, 757, 761, 769, 773, 787, 797, 809, 811, 821, 823, 827, 829, 839, 853, 857, 859, 863, 877, 881, 883, 887, 907, 911, 919, 929, 937, 941, 947, 953, 967, 971, 977, 983, 991, 997]; +var lplim = (1 << 26) / lowprimes[lowprimes.length - 1]; + +//(public) test primality with certainty >= 1-.5^t +function bnIsProbablePrime(t) { + var i, x = this.abs(); + if (x.t == 1 && x[0] <= lowprimes[lowprimes.length - 1]) { + for (i = 0; i < lowprimes.length; ++i) + if (x[0] == lowprimes[i]) return true; + return false; + } + if (x.isEven()) return false; + i = 1; + while (i < lowprimes.length) { + var m = lowprimes[i], j = i + 1; + while (j < lowprimes.length && m < lplim) m *= lowprimes[j++]; + m = x.modInt(m); + while (i < j) if (m % lowprimes[i++] === 0) return false; + } + return x.millerRabin(t); +} + +//(protected) true if probably prime (HAC 4.24, Miller-Rabin) +function bnpMillerRabin(t) { + var n1 = this.subtract(BigInteger.ONE); + var k = n1.getLowestSetBit(); + if (k <= 0) return false; + var r = n1.shiftRight(k); + t = (t + 1) >> 1; + if (t > lowprimes.length) t = lowprimes.length; + var a = nbi(); + for (var i = 0; i < t; ++i) { + //Pick bases at random, instead of starting at 2 + a.fromInt(lowprimes[Math.floor(Math.random() * lowprimes.length)]); + var y = a.modPow(r, this); + if (y.compareTo(BigInteger.ONE) != 0 && y.compareTo(n1) != 0) { + var j = 1; + while (j++ < k && y.compareTo(n1) != 0) { + y = y.modPowInt(2, this); + if (y.compareTo(BigInteger.ONE) === 0) return false; + } + if (y.compareTo(n1) != 0) return false; + } + } + return true; +} + +// protected +BigInteger.prototype.copyTo = bnpCopyTo; +BigInteger.prototype.fromInt = bnpFromInt; +BigInteger.prototype.fromString = bnpFromString; +BigInteger.prototype.fromByteArray = bnpFromByteArray; +BigInteger.prototype.fromBuffer = bnpFromBuffer; +BigInteger.prototype.clamp = bnpClamp; +BigInteger.prototype.dlShiftTo = bnpDLShiftTo; +BigInteger.prototype.drShiftTo = bnpDRShiftTo; +BigInteger.prototype.lShiftTo = bnpLShiftTo; +BigInteger.prototype.rShiftTo = bnpRShiftTo; +BigInteger.prototype.subTo = bnpSubTo; +BigInteger.prototype.multiplyTo = bnpMultiplyTo; +BigInteger.prototype.squareTo = bnpSquareTo; +BigInteger.prototype.divRemTo = bnpDivRemTo; +BigInteger.prototype.invDigit = bnpInvDigit; +BigInteger.prototype.isEven = bnpIsEven; +BigInteger.prototype.exp = bnpExp; + +BigInteger.prototype.chunkSize = bnpChunkSize; +BigInteger.prototype.toRadix = bnpToRadix; +BigInteger.prototype.fromRadix = bnpFromRadix; +BigInteger.prototype.fromNumber = bnpFromNumber; +BigInteger.prototype.bitwiseTo = bnpBitwiseTo; +BigInteger.prototype.changeBit = bnpChangeBit; +BigInteger.prototype.addTo = bnpAddTo; +BigInteger.prototype.dMultiply = bnpDMultiply; +BigInteger.prototype.dAddOffset = bnpDAddOffset; +BigInteger.prototype.multiplyLowerTo = bnpMultiplyLowerTo; +BigInteger.prototype.multiplyUpperTo = bnpMultiplyUpperTo; +BigInteger.prototype.modInt = bnpModInt; +BigInteger.prototype.millerRabin = bnpMillerRabin; + + +// public +BigInteger.prototype.toString = bnToString; +BigInteger.prototype.negate = bnNegate; +BigInteger.prototype.abs = bnAbs; +BigInteger.prototype.compareTo = bnCompareTo; +BigInteger.prototype.bitLength = bnBitLength; +BigInteger.prototype.mod = bnMod; +BigInteger.prototype.modPowInt = bnModPowInt; + +BigInteger.prototype.clone = bnClone; +BigInteger.prototype.intValue = bnIntValue; +BigInteger.prototype.byteValue = bnByteValue; +BigInteger.prototype.shortValue = bnShortValue; +BigInteger.prototype.signum = bnSigNum; +BigInteger.prototype.toByteArray = bnToByteArray; +BigInteger.prototype.toBuffer = bnToBuffer; +BigInteger.prototype.equals = bnEquals; +BigInteger.prototype.min = bnMin; +BigInteger.prototype.max = bnMax; +BigInteger.prototype.and = bnAnd; +BigInteger.prototype.or = bnOr; +BigInteger.prototype.xor = bnXor; +BigInteger.prototype.andNot = bnAndNot; +BigInteger.prototype.not = bnNot; +BigInteger.prototype.shiftLeft = bnShiftLeft; +BigInteger.prototype.shiftRight = bnShiftRight; +BigInteger.prototype.getLowestSetBit = bnGetLowestSetBit; +BigInteger.prototype.bitCount = bnBitCount; +BigInteger.prototype.testBit = bnTestBit; +BigInteger.prototype.setBit = bnSetBit; +BigInteger.prototype.clearBit = bnClearBit; +BigInteger.prototype.flipBit = bnFlipBit; +BigInteger.prototype.add = bnAdd; +BigInteger.prototype.subtract = bnSubtract; +BigInteger.prototype.multiply = bnMultiply; +BigInteger.prototype.divide = bnDivide; +BigInteger.prototype.remainder = bnRemainder; +BigInteger.prototype.divideAndRemainder = bnDivideAndRemainder; +BigInteger.prototype.modPow = bnModPow; +BigInteger.prototype.modInverse = bnModInverse; +BigInteger.prototype.pow = bnPow; +BigInteger.prototype.gcd = bnGCD; +BigInteger.prototype.isProbablePrime = bnIsProbablePrime; +BigInteger.int2char = int2char; + +// "constants" +BigInteger.ZERO = nbv(0); +BigInteger.ONE = nbv(1); + +// JSBN-specific extension +BigInteger.prototype.square = bnSquare; + +//BigInteger interfaces not implemented in jsbn: + +//BigInteger(int signum, byte[] magnitude) +//double doubleValue() +//float floatValue() +//int hashCode() +//long longValue() +//static BigInteger valueOf(long val) + +module.exports = BigInteger; diff --git a/lib/params.js b/lib/params.js new file mode 100644 index 0000000..7111a4a --- /dev/null +++ b/lib/params.js @@ -0,0 +1,182 @@ +/* + * SRP Group Parameters + * http://tools.ietf.org/html/rfc5054#appendix-A + * + * The 1024-, 1536-, and 2048-bit groups are taken from software + * developed by Tom Wu and Eugene Jhong for the Stanford SRP + * distribution, and subsequently proven to be prime. The larger primes + * are taken from [MODP], but generators have been calculated that are + * primitive roots of N, unlike the generators in [MODP]. + * + * The 1024-bit and 1536-bit groups MUST be supported. + */ + +// since these are meant to be used internally, all values are numbers. If +// you want to add parameter sets, you'll need to convert them to bignums. + +"use strict"; + +var BigInteger = require('./jsbn'); + + +function hex(s) { + return new BigInteger(s.split(/\s/).join(''), 16); +} + +module.exports = { + + 1024: { + N_length_bits: 1024, + N: hex(' EEAF0AB9 ADB38DD6 9C33F80A FA8FC5E8 60726187 75FF3C0B 9EA2314C' + +'9C256576 D674DF74 96EA81D3 383B4813 D692C6E0 E0D5D8E2 50B98BE4' + +'8E495C1D 6089DAD1 5DC7D7B4 6154D6B6 CE8EF4AD 69B15D49 82559B29' + +'7BCF1885 C529F566 660E57EC 68EDBC3C 05726CC0 2FD4CBF4 976EAA9A' + +'FD5138FE 8376435B 9FC61D2F C0EB06E3'), + g: hex('02'), + hash: 'sha1'}, + + 1536: { + N_length_bits: 1536, + N: hex(' 9DEF3CAF B939277A B1F12A86 17A47BBB DBA51DF4 99AC4C80 BEEEA961' + +'4B19CC4D 5F4F5F55 6E27CBDE 51C6A94B E4607A29 1558903B A0D0F843' + +'80B655BB 9A22E8DC DF028A7C EC67F0D0 8134B1C8 B9798914 9B609E0B' + +'E3BAB63D 47548381 DBC5B1FC 764E3F4B 53DD9DA1 158BFD3E 2B9C8CF5' + +'6EDF0195 39349627 DB2FD53D 24B7C486 65772E43 7D6C7F8C E442734A' + +'F7CCB7AE 837C264A E3A9BEB8 7F8A2FE9 B8B5292E 5A021FFF 5E91479E' + +'8CE7A28C 2442C6F3 15180F93 499A234D CF76E3FE D135F9BB'), + g: hex('02'), + hash: 'sha1'}, + + 2048: { + N_length_bits: 2048, + N: hex(' AC6BDB41 324A9A9B F166DE5E 1389582F AF72B665 1987EE07 FC319294' + +'3DB56050 A37329CB B4A099ED 8193E075 7767A13D D52312AB 4B03310D' + +'CD7F48A9 DA04FD50 E8083969 EDB767B0 CF609517 9A163AB3 661A05FB' + +'D5FAAAE8 2918A996 2F0B93B8 55F97993 EC975EEA A80D740A DBF4FF74' + +'7359D041 D5C33EA7 1D281E44 6B14773B CA97B43A 23FB8016 76BD207A' + +'436C6481 F1D2B907 8717461A 5B9D32E6 88F87748 544523B5 24B0D57D' + +'5EA77A27 75D2ECFA 032CFBDB F52FB378 61602790 04E57AE6 AF874E73' + +'03CE5329 9CCC041C 7BC308D8 2A5698F3 A8D0C382 71AE35F8 E9DBFBB6' + +'94B5C803 D89F7AE4 35DE236D 525F5475 9B65E372 FCD68EF2 0FA7111F' + +'9E4AFF73'), + g: hex('02'), + hash: 'sha256'}, + + 3072: { + N_length_bits: 3072, + N: hex(' FFFFFFFF FFFFFFFF C90FDAA2 2168C234 C4C6628B 80DC1CD1 29024E08' + +'8A67CC74 020BBEA6 3B139B22 514A0879 8E3404DD EF9519B3 CD3A431B' + +'302B0A6D F25F1437 4FE1356D 6D51C245 E485B576 625E7EC6 F44C42E9' + +'A637ED6B 0BFF5CB6 F406B7ED EE386BFB 5A899FA5 AE9F2411 7C4B1FE6' + +'49286651 ECE45B3D C2007CB8 A163BF05 98DA4836 1C55D39A 69163FA8' + +'FD24CF5F 83655D23 DCA3AD96 1C62F356 208552BB 9ED52907 7096966D' + +'670C354E 4ABC9804 F1746C08 CA18217C 32905E46 2E36CE3B E39E772C' + +'180E8603 9B2783A2 EC07A28F B5C55DF0 6F4C52C9 DE2BCBF6 95581718' + +'3995497C EA956AE5 15D22618 98FA0510 15728E5A 8AAAC42D AD33170D' + +'04507A33 A85521AB DF1CBA64 ECFB8504 58DBEF0A 8AEA7157 5D060C7D' + +'B3970F85 A6E1E4C7 ABF5AE8C DB0933D7 1E8C94E0 4A25619D CEE3D226' + +'1AD2EE6B F12FFA06 D98A0864 D8760273 3EC86A64 521F2B18 177B200C' + +'BBE11757 7A615D6C 770988C0 BAD946E2 08E24FA0 74E5AB31 43DB5BFC' + +'E0FD108E 4B82D120 A93AD2CA FFFFFFFF FFFFFFFF'), + g: hex('05'), + hash: 'sha256'}, + + 4096: { + N_length_bits: 4096, + N: hex(' FFFFFFFF FFFFFFFF C90FDAA2 2168C234 C4C6628B 80DC1CD1 29024E08' + +'8A67CC74 020BBEA6 3B139B22 514A0879 8E3404DD EF9519B3 CD3A431B' + +'302B0A6D F25F1437 4FE1356D 6D51C245 E485B576 625E7EC6 F44C42E9' + +'A637ED6B 0BFF5CB6 F406B7ED EE386BFB 5A899FA5 AE9F2411 7C4B1FE6' + +'49286651 ECE45B3D C2007CB8 A163BF05 98DA4836 1C55D39A 69163FA8' + +'FD24CF5F 83655D23 DCA3AD96 1C62F356 208552BB 9ED52907 7096966D' + +'670C354E 4ABC9804 F1746C08 CA18217C 32905E46 2E36CE3B E39E772C' + +'180E8603 9B2783A2 EC07A28F B5C55DF0 6F4C52C9 DE2BCBF6 95581718' + +'3995497C EA956AE5 15D22618 98FA0510 15728E5A 8AAAC42D AD33170D' + +'04507A33 A85521AB DF1CBA64 ECFB8504 58DBEF0A 8AEA7157 5D060C7D' + +'B3970F85 A6E1E4C7 ABF5AE8C DB0933D7 1E8C94E0 4A25619D CEE3D226' + +'1AD2EE6B F12FFA06 D98A0864 D8760273 3EC86A64 521F2B18 177B200C' + +'BBE11757 7A615D6C 770988C0 BAD946E2 08E24FA0 74E5AB31 43DB5BFC' + +'E0FD108E 4B82D120 A9210801 1A723C12 A787E6D7 88719A10 BDBA5B26' + +'99C32718 6AF4E23C 1A946834 B6150BDA 2583E9CA 2AD44CE8 DBBBC2DB' + +'04DE8EF9 2E8EFC14 1FBECAA6 287C5947 4E6BC05D 99B2964F A090C3A2' + +'233BA186 515BE7ED 1F612970 CEE2D7AF B81BDD76 2170481C D0069127' + +'D5B05AA9 93B4EA98 8D8FDDC1 86FFB7DC 90A6C08F 4DF435C9 34063199' + +'FFFFFFFF FFFFFFFF'), + g: hex('05'), + hash: 'sha256'}, + + 6244: { + N_length_bits: 6244, + N: hex(' FFFFFFFF FFFFFFFF C90FDAA2 2168C234 C4C6628B 80DC1CD1 29024E08' + +'8A67CC74 020BBEA6 3B139B22 514A0879 8E3404DD EF9519B3 CD3A431B' + +'302B0A6D F25F1437 4FE1356D 6D51C245 E485B576 625E7EC6 F44C42E9' + +'A637ED6B 0BFF5CB6 F406B7ED EE386BFB 5A899FA5 AE9F2411 7C4B1FE6' + +'49286651 ECE45B3D C2007CB8 A163BF05 98DA4836 1C55D39A 69163FA8' + +'FD24CF5F 83655D23 DCA3AD96 1C62F356 208552BB 9ED52907 7096966D' + +'670C354E 4ABC9804 F1746C08 CA18217C 32905E46 2E36CE3B E39E772C' + +'180E8603 9B2783A2 EC07A28F B5C55DF0 6F4C52C9 DE2BCBF6 95581718' + +'3995497C EA956AE5 15D22618 98FA0510 15728E5A 8AAAC42D AD33170D' + +'04507A33 A85521AB DF1CBA64 ECFB8504 58DBEF0A 8AEA7157 5D060C7D' + +'B3970F85 A6E1E4C7 ABF5AE8C DB0933D7 1E8C94E0 4A25619D CEE3D226' + +'1AD2EE6B F12FFA06 D98A0864 D8760273 3EC86A64 521F2B18 177B200C' + +'BBE11757 7A615D6C 770988C0 BAD946E2 08E24FA0 74E5AB31 43DB5BFC' + +'E0FD108E 4B82D120 A9210801 1A723C12 A787E6D7 88719A10 BDBA5B26' + +'99C32718 6AF4E23C 1A946834 B6150BDA 2583E9CA 2AD44CE8 DBBBC2DB' + +'04DE8EF9 2E8EFC14 1FBECAA6 287C5947 4E6BC05D 99B2964F A090C3A2' + +'233BA186 515BE7ED 1F612970 CEE2D7AF B81BDD76 2170481C D0069127' + +'D5B05AA9 93B4EA98 8D8FDDC1 86FFB7DC 90A6C08F 4DF435C9 34028492' + +'36C3FAB4 D27C7026 C1D4DCB2 602646DE C9751E76 3DBA37BD F8FF9406' + +'AD9E530E E5DB382F 413001AE B06A53ED 9027D831 179727B0 865A8918' + +'DA3EDBEB CF9B14ED 44CE6CBA CED4BB1B DB7F1447 E6CC254B 33205151' + +'2BD7AF42 6FB8F401 378CD2BF 5983CA01 C64B92EC F032EA15 D1721D03' + +'F482D7CE 6E74FEF6 D55E702F 46980C82 B5A84031 900B1C9E 59E7C97F' + +'BEC7E8F3 23A97A7E 36CC88BE 0F1D45B7 FF585AC5 4BD407B2 2B4154AA' + +'CC8F6D7E BF48E1D8 14CC5ED2 0F8037E0 A79715EE F29BE328 06A1D58B' + +'B7C5DA76 F550AA3D 8A1FBFF0 EB19CCB1 A313D55C DA56C9EC 2EF29632' + +'387FE8D7 6E3C0468 043E8F66 3F4860EE 12BF2D5B 0B7474D6 E694F91E' + +'6DCC4024 FFFFFFFF FFFFFFFF'), + g: hex('05'), + hash: 'sha256'}, + + 8192: { + N_length_bits: 8192, + N: hex(' FFFFFFFF FFFFFFFF C90FDAA2 2168C234 C4C6628B 80DC1CD1 29024E08' + +'8A67CC74 020BBEA6 3B139B22 514A0879 8E3404DD EF9519B3 CD3A431B' + +'302B0A6D F25F1437 4FE1356D 6D51C245 E485B576 625E7EC6 F44C42E9' + +'A637ED6B 0BFF5CB6 F406B7ED EE386BFB 5A899FA5 AE9F2411 7C4B1FE6' + +'49286651 ECE45B3D C2007CB8 A163BF05 98DA4836 1C55D39A 69163FA8' + +'FD24CF5F 83655D23 DCA3AD96 1C62F356 208552BB 9ED52907 7096966D' + +'670C354E 4ABC9804 F1746C08 CA18217C 32905E46 2E36CE3B E39E772C' + +'180E8603 9B2783A2 EC07A28F B5C55DF0 6F4C52C9 DE2BCBF6 95581718' + +'3995497C EA956AE5 15D22618 98FA0510 15728E5A 8AAAC42D AD33170D' + +'04507A33 A85521AB DF1CBA64 ECFB8504 58DBEF0A 8AEA7157 5D060C7D' + +'B3970F85 A6E1E4C7 ABF5AE8C DB0933D7 1E8C94E0 4A25619D CEE3D226' + +'1AD2EE6B F12FFA06 D98A0864 D8760273 3EC86A64 521F2B18 177B200C' + +'BBE11757 7A615D6C 770988C0 BAD946E2 08E24FA0 74E5AB31 43DB5BFC' + +'E0FD108E 4B82D120 A9210801 1A723C12 A787E6D7 88719A10 BDBA5B26' + +'99C32718 6AF4E23C 1A946834 B6150BDA 2583E9CA 2AD44CE8 DBBBC2DB' + +'04DE8EF9 2E8EFC14 1FBECAA6 287C5947 4E6BC05D 99B2964F A090C3A2' + +'233BA186 515BE7ED 1F612970 CEE2D7AF B81BDD76 2170481C D0069127' + +'D5B05AA9 93B4EA98 8D8FDDC1 86FFB7DC 90A6C08F 4DF435C9 34028492' + +'36C3FAB4 D27C7026 C1D4DCB2 602646DE C9751E76 3DBA37BD F8FF9406' + +'AD9E530E E5DB382F 413001AE B06A53ED 9027D831 179727B0 865A8918' + +'DA3EDBEB CF9B14ED 44CE6CBA CED4BB1B DB7F1447 E6CC254B 33205151' + +'2BD7AF42 6FB8F401 378CD2BF 5983CA01 C64B92EC F032EA15 D1721D03' + +'F482D7CE 6E74FEF6 D55E702F 46980C82 B5A84031 900B1C9E 59E7C97F' + +'BEC7E8F3 23A97A7E 36CC88BE 0F1D45B7 FF585AC5 4BD407B2 2B4154AA' + +'CC8F6D7E BF48E1D8 14CC5ED2 0F8037E0 A79715EE F29BE328 06A1D58B' + +'B7C5DA76 F550AA3D 8A1FBFF0 EB19CCB1 A313D55C DA56C9EC 2EF29632' + +'387FE8D7 6E3C0468 043E8F66 3F4860EE 12BF2D5B 0B7474D6 E694F91E' + +'6DBE1159 74A3926F 12FEE5E4 38777CB6 A932DF8C D8BEC4D0 73B931BA' + +'3BC832B6 8D9DD300 741FA7BF 8AFC47ED 2576F693 6BA42466 3AAB639C' + +'5AE4F568 3423B474 2BF1C978 238F16CB E39D652D E3FDB8BE FC848AD9' + +'22222E04 A4037C07 13EB57A8 1A23F0C7 3473FC64 6CEA306B 4BCBC886' + +'2F8385DD FA9D4B7F A2C087E8 79683303 ED5BDD3A 062B3CF5 B3A278A6' + +'6D2A13F8 3F44F82D DF310EE0 74AB6A36 4597E899 A0255DC1 64F31CC5' + +'0846851D F9AB4819 5DED7EA1 B1D510BD 7EE74D73 FAF36BC3 1ECFA268' + +'359046F4 EB879F92 4009438B 481C6CD7 889A002E D5EE382B C9190DA6' + +'FC026E47 9558E447 5677E9AA 9E3050E2 765694DF C81F56E8 80B96E71' + +'60C980DD 98EDD3DF FFFFFFFF FFFFFFFF'), + g: hex('13'), + hash: 'sha256'} +}; diff --git a/lib/srp.js b/lib/srp.js new file mode 100644 index 0000000..616ca0b --- /dev/null +++ b/lib/srp.js @@ -0,0 +1,456 @@ +"use strict"; + +var crypto = require('crypto'); +var assert = require('assert'); +var util = require('util'); +var BigInteger = require('./jsbn'); + +var zero = new BigInteger(0); + +function assert_(val, msg) { + if (!val) + throw new Error(msg||"assertion"); +} + +/* + * If a conversion is explicitly specified with the operator PAD(), + * the integer will first be implicitly converted, then the resultant + * byte-string will be left-padded with zeros (if necessary) until its + * length equals the implicitly-converted length of N. + * + * params: + * n (buffer) Number to pad + * len (int) length of the resulting Buffer + * + * returns: buffer + */ +function padTo(n, len) { + assertIsBuffer(n, "n"); + var padding = len - n.length; +/* + console.log("n = " + n.toString('hex')); + console.log("n.length = " + n.length); + console.log("len = " + len); +*/ + assert_(padding > -1, "Negative padding. Very uncomfortable."); + var result = new Buffer(len); + result.fill(0, 0, padding); + n.copy(result, padding); + assert.equal(result.length, len); + return result; +}; + +function padToN(number, params) { + assertIsBigInteger(number); +//! return padTo(number.toBuffer(), params.N_length_bits/8); + var n = number.toString(16).length % 2 != 0 ? "0" + number.toString(16) : number.toString(16); + return padTo(new Buffer(n, 'hex'), params.N_length_bits / 8); +} + +function padToH(number, params) { + assertIsBigInteger(number); + var hashlen_bits; + if (params.hash === "sha1") + hashlen_bits = 160; + else if (params.hash === "sha256") + hashlen_bits = 256; + else if (params.hash === "sha512") + hashlen_bits = 512; + else + throw Error("cannot determine length of hash '"+params.hash+"'"); + +//! return padTo(number.toBuffer(), hashlen_bits / 8); + return padTo(new Buffer(number.toString(16), 'hex'), hashlen_bits / 8); +} + +function assertIsBuffer(arg, argname) { + argname = argname || "arg"; + assert_(Buffer.isBuffer(arg), "Type error: "+argname+" must be a buffer"); +} + +function assertIsNBuffer(arg, params, argname) { + argname = argname || "arg"; + assert_(Buffer.isBuffer(arg), "Type error: "+argname+" must be a buffer"); + if (arg.length != params.N_length_bits/8) + assert_(false, argname+" was "+arg.length+", expected "+(params.N_length_bits/8)); +} + +function assertIsBigInteger(arg) { + assert_(arg.constructor.name === 'BigInteger', "Type error: " + arg.argname + " must be a BigInteger"); +} + +/* + * compute the intermediate value x as a hash of three buffers: + * salt, identity, and password. And a colon. FOUR buffers. + * + * x = H(s | H(I | ":" | P)) + * + * params: + * salt (buffer) salt + * I (buffer) user identity + * P (buffer) user password + * + * returns: x (bignum) user secret + */ +function getx(params, salt, I, P) { + assertIsBuffer(salt, "salt (salt)"); + assertIsBuffer(I, "identity (I)"); + assertIsBuffer(P, "password (P)"); + var hashIP = crypto.createHash(params.hash) + .update(Buffer.concat([I, new Buffer(':'), P])) + .digest(); + var hashX = crypto.createHash(params.hash) + .update(salt) + .update(hashIP) + .digest(); +//! return bignum.fromBuffer(hashX); + return(new BigInteger(hashX)); +}; + +/* + * The verifier is calculated as described in Section 3 of [SRP-RFC]. + * We give the algorithm here for convenience. + * + * The verifier (v) is computed based on the salt (s), user name (I), + * password (P), and group parameters (N, g). + * + * x = H(s | H(I | ":" | P)) + * v = g^x % N + * + * params: + * params (obj) group parameters, with .N, .g, .hash + * salt (buffer) salt + * I (buffer) user identity + * P (buffer) user password + * + * returns: buffer + */ +function computeVerifier(params, salt, I, P) { + assertIsBuffer(salt, "salt (salt)"); + assertIsBuffer(I, "identity (I)"); + assertIsBuffer(P, "password (P)"); +//* var v_num = params.g.powm(getx(params, salt, I, P), params.N); + var v_num = params.g.modPow(getx(params, salt, I, P), params.N); + return padToN(v_num, params); +}; + +/* + * calculate the SRP-6 multiplier + * + * params: + * params (obj) group parameters, with .N, .g, .hash + * + * returns: bignum + */ +function getk(params) { + var k_buf = crypto + .createHash(params.hash) + .update(padToN(params.N, params)) + .update(padToN(params.g, params)) + .digest(); + return(new BigInteger(k_buf.toString('hex'), 16)); +}; + +/* + * Generate a random key + * + * params: + * bytes (int) length of key (default=32) + * callback (func) function to call with err,key + * + * returns: nothing, but runs callback with a Buffer + */ +function genKey(bytes, callback) { + // bytes is optional + if (arguments.length < 2) { + callback = bytes; + bytes = 32; + } + if (typeof callback !== 'function') { + throw("Callback required"); + } + crypto.randomBytes(bytes, function(err, buf) { + if (err) return callback (err); + return callback(null, buf); + }); +}; + +/* + * The server key exchange message also contains the server's public + * value (B). The server calculates this value as B = k*v + g^b % N, + * where b is a random number that SHOULD be at least 256 bits in length + * and k = H(N | PAD(g)). + * + * Note: as the tests imply, the entire expression is mod N. + * + * params: + * params (obj) group parameters, with .N, .g, .hash + * v (bignum) verifier (stored) + * b (bignum) server secret exponent + * + * returns: B (buffer) the server public message + */ +function getB(params, k, v, b) { + assertIsBigInteger(v); + assertIsBigInteger(k); + assertIsBigInteger(b); + var N = params.N; +//* var r = k.mul(v).add(params.g.powm(b, N)).mod(N); + var r = k.multiply(v).add(params.g.modPow(b, N)).mod(N); + return padToN(r, params); +}; + +/* + * The client key exchange message carries the client's public value + * (A). The client calculates this value as A = g^a % N, where a is a + * random number that SHOULD be at least 256 bits in length. + * + * Note: for this implementation, we take that to mean 256/8 bytes. + * + * params: + * params (obj) group parameters, with .N, .g, .hash + * a (bignum) client secret exponent + * + * returns A (bignum) the client public message + */ +function getA(params, a_num) { + assertIsBigInteger(a_num); +//! if (Math.ceil(a_num.bitLength() / 8) < 256/8) { + if (Math.ceil(a_num.toString(16).length / 2) < 32) { + console.warn("getA: client key length", a_num.bitLength(), "is less than the recommended 256 bits"); + } +//* return padToN(params.g.powm(a_num, params.N), params); + return padToN(params.g.modPow(a_num, params.N), params); +}; + +/* + * getu() hashes the two public messages together, to obtain a scrambling + * parameter "u" which cannot be predicted by either party ahead of time. + * This makes it safe to use the message ordering defined in the SRP-6a + * paper, in which the server reveals their "B" value before the client + * commits to their "A" value. + * + * params: + * params (obj) group parameters, with .N, .g, .hash + * A (Buffer) client ephemeral public key + * B (Buffer) server ephemeral public key + * + * returns: u (bignum) shared scrambling parameter + */ +function getu(params, A, B) { + assertIsNBuffer(A, params, "A"); + assertIsNBuffer(B, params, "B"); + var u_buf = crypto.createHash(params.hash) + .update(A).update(B) + .digest(); +//! return bignum.fromBuffer(u_buf); + return(new BigInteger(u_buf.toString('hex'), 16)); +}; + +/* + * The TLS premaster secret as calculated by the client + * + * params: + * params (obj) group parameters, with .N, .g, .hash + * salt (buffer) salt (read from server) + * I (buffer) user identity (read from user) + * P (buffer) user password (read from user) + * a (bignum) ephemeral private key (generated for session) + * B (bignum) server ephemeral public key (read from server) + * + * returns: buffer + */ + +function client_getS(params, k_num, x_num, a_num, B_num, u_num) { + assertIsBigInteger(k_num); + assertIsBigInteger(x_num); + assertIsBigInteger(a_num); + assertIsBigInteger(B_num); + assertIsBigInteger(u_num); + var g = params.g; + var N = params.N; +// if (zero.greater(B_num) || N.lesser(B_num)) + if((zero.compareTo(B_num) > 0) && (N.compareTo(B_num) < 0)) + throw new Error("invalid server-supplied 'B', must be 1..N-1"); +//* var S_num = B_num.sub(k_num.mul(g.powm(x_num, N))).powm(a_num.add(u_num.mul(x_num)), N).mod(N); + var S_num = B_num.subtract(k_num.multiply(g.modPow(x_num, N))).modPow(a_num.add(u_num.multiply(x_num)), N).mod(N); + + return padToN(S_num, params); +}; + +/* + * The TLS premastersecret as calculated by the server + * + * params: + * params (obj) group parameters, with .N, .g, .hash + * v (bignum) verifier (stored on server) + * A (bignum) ephemeral client public key (read from client) + * b (bignum) server ephemeral private key (generated for session) + * + * returns: bignum + */ + +function server_getS(params, v_num, A_num, b_num, u_num) { + assertIsBigInteger(v_num); + assertIsBigInteger(A_num); + assertIsBigInteger(b_num); + assertIsBigInteger(u_num); + var N = params.N; +//! if (zero.greater(A_num) || N.lesser(A_num)) + if((zero.compareTo(A_num) > 0) && (N.compareTo(A_num) < 0)) + throw new Error("invalid client-supplied 'A', must be 1..N-1"); +//* var S_num = A_num.mul(v_num.powm(u_num, N)).powm(b_num, N).mod(N); + var S_num = A_num.multiply(v_num.modPow(u_num, N)).modPow(b_num, N).mod(N); + return padToN(S_num, params); +}; + +/* + * Compute the shared session key K from S + * + * params: + * params (obj) group parameters, with .N, .g, .hash + * S (buffer) Session key + * + * returns: buffer + */ +function getK(params, S_buf) { + assertIsNBuffer(S_buf, params, "S"); + return crypto.createHash(params.hash) + .update(S_buf) + .digest(); +}; + +function getM1(params, A_buf, B_buf, S_buf) { + assertIsNBuffer(A_buf, params, "A"); + assertIsNBuffer(B_buf, params, "B"); + assertIsNBuffer(S_buf, params, "S"); + return crypto.createHash(params.hash) + .update(A_buf).update(B_buf).update(S_buf) + .digest(); +} + +function getM2(params, A_buf, M_buf, K_buf) { + assertIsNBuffer(A_buf, params, "A"); + assertIsBuffer(M_buf, "M"); + assertIsBuffer(K_buf, "K"); + return crypto.createHash(params.hash) + .update(A_buf).update(M_buf).update(K_buf) + .digest(); +} + +function equal(buf1, buf2) { + // constant-time comparison. A drop in the ocean compared to our + // non-constant-time modexp operations, but still good practice. + var mismatch = buf1.length - buf2.length; + if (mismatch) { + return false; + } + for (var i = 0; i < buf1.length; i++) { + mismatch |= buf1[i] ^ buf2[i]; + } + return mismatch === 0; +} + +function Client(params, salt_buf, identity_buf, password_buf, secret1_buf) { + if (!(this instanceof Client)) { + return new Client(params, salt_buf, identity_buf, password_buf, secret1_buf); + } + assertIsBuffer(salt_buf, "salt (salt)"); + assertIsBuffer(identity_buf, "identity (I)"); + assertIsBuffer(password_buf, "password (P)"); + assertIsBuffer(secret1_buf, "secret1"); + this._private = { params: params, + k_num: getk(params), + x_num: getx(params, salt_buf, identity_buf, password_buf), +//! a_num: bignum.fromBuffer(secret1_buf) }; + a_num: new BigInteger(secret1_buf.toString('hex'), 16) }; + this._private.A_buf = getA(params, this._private.a_num); +} + +Client.prototype = { + computeA: function computeA() { + return this._private.A_buf; + }, + setB: function setB(B_buf) { + var p = this._private; +//! var B_num = bignum.fromBuffer(B_buf); + var B_num = new BigInteger(B_buf.toString('hex'), 16); + var u_num = getu(p.params, p.A_buf, B_buf); +// console.log(util.inspect(p)); + var S_buf_x = client_getS(p.params, p.k_num, p.x_num, p.a_num, B_num, u_num); + p.K_buf = getK(p.params, S_buf_x); + p.M1_buf = getM1(p.params, p.A_buf, B_buf, S_buf_x); + p.M2_buf = getM2(p.params, p.A_buf, p.M1_buf, p.K_buf); + p.u_num = u_num; // only for tests + p.S_buf = S_buf_x; // only for tests + }, + computeM1: function computeM1() { + if (this._private.M1_buf === undefined) + throw new Error("incomplete protocol"); + return this._private.M1_buf; + }, + checkM2: function checkM2(serverM2_buf) { + if (!equal(this._private.M2_buf, serverM2_buf)) + throw new Error("server is not authentic"); + }, + computeK: function computeK() { + if (this._private.K_buf === undefined) + throw new Error("incomplete protocol"); + return this._private.K_buf; + } +}; + +function Server(params, verifier_buf, secret2_buf) { + if (!(this instanceof Server)) { + return new Server(params, verifier_buf, secret2_buf); + } + assertIsBuffer(verifier_buf, "verifier"); + assertIsBuffer(secret2_buf, "secret2"); + this._private = { params: params, + k_num: getk(params), +//! b_num: bignum.fromBuffer(secret2_buf), +//! v_num: bignum.fromBuffer(verifier_buf) }; + b_num: new BigInteger(secret2_buf.toString('hex'), 16), + v_num: new BigInteger(verifier_buf.toString('hex'), 16) }; + + this._private.B_buf = getB(params, this._private.k_num, + this._private.v_num, this._private.b_num); +} + +Server.prototype = { + computeB: function computeB() { + return this._private.B_buf; + }, + setA: function setA(A_buf) { + var p = this._private; +//! var A_num = bignum.fromBuffer(A_buf); + var A_num = new BigInteger(A_buf.toString('hex'), 16); + var u_num = getu(p.params, A_buf, p.B_buf); + var S_buf = server_getS(p.params, p.v_num, A_num, p.b_num, u_num); + p.K_buf = getK(p.params, S_buf); + p.M1_buf = getM1(p.params, A_buf, p.B_buf, S_buf); + p.M2_buf = getM2(p.params, A_buf, p.M1_buf, p.K_buf); + p.u_num = u_num; // only for tests + p.S_buf = S_buf; // only for tests + }, + checkM1: function checkM1(clientM1_buf) { + if (this._private.M1_buf === undefined) + throw new Error("incomplete protocol"); + if (!equal(this._private.M1_buf, clientM1_buf)) + throw new Error("client did not use the same password"); + return this._private.M2_buf; + }, + computeK: function computeK() { + if (this._private.K_buf === undefined) + throw new Error("incomplete protocol"); + return this._private.K_buf; + } +}; + +module.exports = { + params: require('./params'), + genKey: genKey, + computeVerifier: computeVerifier, + Client: Client, + Server: Server +}; diff --git a/package.json b/package.json new file mode 100644 index 0000000..13fc2a7 --- /dev/null +++ b/package.json @@ -0,0 +1,22 @@ +{ + "name": "fast-srp", + "description": "Secure Remote Password (SRP)", + "version": "0.9.0", + "main": "index.js", + "scripts": { + "test": "vows test/test_*.js --spec" + }, + "repository": { + "type": "git", + "url": "https://github.com/zarmack/fast-srp" + }, + "author": "Zarmack Tanen", + "licence": "MIT", + "readmeFilename": "README.md", + "dependencies": { + "lodash": "^3.10.1" + }, + "devDependencies": { + "vows": "0.7.0" + } +} diff --git a/test/test_picl_vectors.js b/test/test_picl_vectors.js new file mode 100644 index 0000000..829b784 --- /dev/null +++ b/test/test_picl_vectors.js @@ -0,0 +1,313 @@ +"use strict"; + +var vows = require('vows'); +var assert = require('assert'); +var BigInteger = require('../lib/jsbn'); +var srp = require('../lib/srp'); +var util = require('util'); + +/* + * Vectors from https://wiki.mozilla.org/Identity/AttachedServices/KeyServerProtocol + * + * Verify that we are inter-compatible with the SRP implementation used by + * Mozilla's Identity-Attached Services, aka PiCl (Profile in the Cloud). + * + * Note that P is the HKDF-stretched key, computed elsewhere. + */ + +function join(s) { + return s.split(/\s/).join(''); +} + +function h(s) { + return new Buffer(join(s), 'hex'); +} + +var params = srp.params['2048']; + +/* inputs_1/expected_1 are the main PiCl test vectors. They were mechanically + * generated to force certain derived values (stretched-password "P", v, A, + * B, and S) to begin with a 0x00 byte (to exercise padding bugs). + */ + +var inputs_1 = { + I: new Buffer('andré@example.org', 'utf8'), + P: h('00f9b71800ab5337 d51177d8fbc682a3 653fa6dae5b87628 eeec43a18af59a9d'), + salt: h('00f1000000000000000000000000000000000000000000000000000000000179'), + // a and b are usually random. For testing, we force them to specific values. + a: h(' 00f2000000000000 0000000000000000 0000000000000000 0000000000000000' + +'0000000000000000 0000000000000000 0000000000000000 0000000000000000' + +'0000000000000000 0000000000000000 0000000000000000 0000000000000000' + +'0000000000000000 0000000000000000 0000000000000000 0000000000000000' + +'0000000000000000 0000000000000000 0000000000000000 0000000000000000' + +'0000000000000000 0000000000000000 0000000000000000 0000000000000000' + +'0000000000000000 0000000000000000 0000000000000000 0000000000000000' + +'0000000000000000 0000000000000000 0000000000000000 000000000000d3d7' + ), + b: h(' 00f3000000000000 0000000000000000 0000000000000000 0000000000000000' + +'0000000000000000 0000000000000000 0000000000000000 0000000000000000' + +'0000000000000000 0000000000000000 0000000000000000 0000000000000000' + +'0000000000000000 0000000000000000 0000000000000000 0000000000000000' + +'0000000000000000 0000000000000000 0000000000000000 0000000000000000' + +'0000000000000000 0000000000000000 0000000000000000 0000000000000000' + +'0000000000000000 0000000000000000 0000000000000000 0000000000000000' + +'0000000000000000 0000000000000000 0000000000000000 000000000000000f' + ) +}; + +var expected_1 = { + // 'k' encodes the group (N and g), used in SRP-6a + k: h('05b9e8ef059c6b32 ea59fc1d322d37f0 4aa30bae5aa9003b 8321e21ddb04e300'), + // 'x' is derived from the salt and password + // 'v' is the SRP verifier + x: h('b5200337cc3f3f92 6cdddae0b2d31029 c069936a844aff58 779a545be89d0abe'), + v: h(' 00173ffa0263e63c cfd6791b8ee2a40f 048ec94cd95aa8a3 125726f9805e0c82' + +'83c658dc0b607fbb 25db68e68e93f265 8483049c68af7e82 14c49fde2712a775' + +'b63e545160d64b00 189a86708c69657d a7a1678eda0cd79f 86b8560ebdb1ffc2' + +'21db360eab901d64 3a75bf1205070a57 91230ae56466b8c3 c1eb656e19b794f1' + +'ea0d2a077b3a7553 50208ea0118fec8c 4b2ec344a05c66ae 1449b32609ca7189' + +'451c259d65bd15b3 4d8729afdb5faff8 af1f3437bbdc0c3d 0b069a8ab2a959c9' + +'0c5a43d42082c774 90f3afcc10ef5648 625c0605cdaace6c 6fdc9e9a7e6635d6' + +'19f50af773452247 0502cab26a52a198 f5b00a2798589165 07b0b4e9ef9524d6'), + // 'B' is the server's public message + B: h(' 0022ce5a7b9d8127 7172caa20b0f1efb 4643b3becc535664 73959b07b790d3c3' + +'f08650d5531c19ad 30ebb67bdb481d1d 9cf61bf272f84398 48fdda58a4e6abc5' + +'abb2ac496da5098d 5cbf90e29b4b110e 4e2c033c70af7392 5fa37457ee13ea3e' + +'8fde4ab516dff1c2 ae8e57a6b264fb9d b637eeeae9b5e43d faba9b329d3b8770' + +'ce89888709e02627 0e474eef822436e6 397562f284778673 a1a7bc12b6883d1c' + +'21fbc27ffb3dbeb8 5efda279a69a1941 4969113f10451603 065f0a0126666456' + +'51dde44a52f4d8de 113e2131321df1bf 4369d2585364f9e5 36c39a4dce33221b' + +'e57d50ddccb4384e 3612bbfd03a268a3 6e4f7e01de651401 e108cc247db50392'), + // 'A' is the client's public message + A: h(' 007da76cb7e77af5 ab61f334dbd5a958 513afcdf0f47ab99 271fc5f7860fe213' + +'2e5802ca79d2e5c0 64bb80a38ee08771 c98a937696698d87 8d78571568c98a1c' + +'40cc6e7cb101988a 2f9ba3d65679027d 4d9068cb8aad6ebf f0101bab6d52b5fd' + +'fa81d2ed48bba119 d4ecdb7f3f478bd2 36d5749f2275e948 4f2d0a9259d05e49' + +'d78a23dd26c60bfb a04fd346e5146469 a8c3f010a627be81 c58ded1caaef2363' + +'635a45f97ca0d895 cc92ace1d09a99d6 beb6b0dc0829535c 857a419e834db128' + +'64cd6ee8a843563b 0240520ff0195735 cd9d316842d5d3f8 ef7209a0bb4b54ad' + +'7374d73e79be2c39 75632de562c59647 0bb27bad79c3e2fc ddf194e1666cb9fc'), + // 'u' combines the two public messages + u: h('b284aa1064e87751 50da6b5e2147b47c a7df505bed94a6f4 bb2ad873332ad732'), + // 'S' is the shared secret + S: h(' 0092aaf0f527906a a5e8601f5d707907 a03137e1b601e04b 5a1deb02a981f4be' + +'037b39829a27dba5 0f1b27545ff2e287 29c2b79dcbdd32c9 d6b20d340affab91' + +'a626a8075806c26f e39df91d0ad979f9 b2ee8aad1bc783e7 097407b63bfe58d9' + +'118b9b0b2a7c5c4c debaf8e9a460f4bf 6247b0da34b760a5 9fac891757ddedca' + +'f08eed823b090586 c63009b2d740cc9f 5397be89a2c32cdc fe6d6251ce11e44e' + +'6ecbdd9b6d93f30e 90896d2527564c7e b9ff70aa91acc0ba c1740a11cd184ffb' + +'989554ab58117c21 96b353d70c356160 100ef5f4c28d19f6 e59ea2508e8e8aac' + +'6001497c27f362ed bafb25e0f045bfdf 9fb02db9c908f103 40a639fe84c31b27'), + // 'K' is the shared derived key + K: h('e68fd0112bfa31dc ffc8e9c96a1cbadb 4c3145978ff35c73 e5bf8d30bbc7499a'), + // 'M1' is the client's proof that it knows the shared key + M1: h('27949ec1e0f16256 33436865edb037e2 3eb6bf5cb91873f2 a2729373c2039008') +}; + +/* inputs_2/expected_2 have leading 0x00 bytes in 'x' and 'u' */ +var inputs_2 = { + I: inputs_1.I, P: inputs_1.P, + salt: h('00f1000000000000000000000000000000000000000000000000000000000021'), + a: h(' 00f2000000000000 0000000000000000 0000000000000000 0000000000000000' + +'0000000000000000 0000000000000000 0000000000000000 0000000000000000' + +'0000000000000000 0000000000000000 0000000000000000 0000000000000000' + +'0000000000000000 0000000000000000 0000000000000000 0000000000000000' + +'0000000000000000 0000000000000000 0000000000000000 0000000000000000' + +'0000000000000000 0000000000000000 0000000000000000 0000000000000000' + +'0000000000000000 0000000000000000 0000000000000000 0000000000000000' + +'0000000000000000 0000000000000000 0000000000000000 000000000000000d' + ), + b: h(' 00f3000000000000 0000000000000000 0000000000000000 0000000000000000' + +'0000000000000000 0000000000000000 0000000000000000 0000000000000000' + +'0000000000000000 0000000000000000 0000000000000000 0000000000000000' + +'0000000000000000 0000000000000000 0000000000000000 0000000000000000' + +'0000000000000000 0000000000000000 0000000000000000 0000000000000000' + +'0000000000000000 0000000000000000 0000000000000000 0000000000000000' + +'0000000000000000 0000000000000000 0000000000000000 0000000000000000' + +'0000000000000000 0000000000000000 0000000000000000 0000000000000001' + ) +}; +var expected_2 = { + k: expected_1.k, + x: h('009b2740fb49284d 69cab7c916d449ee d7dcabf41332b8b8 d6928f529bd1a94e'), + v: h(' 1cd8b856685672ee 7a5895d897121234 6c17c3472f2696e4 8cdeec5533c06693' + +'179bc24802b762bc c1e1f8fc8abe607a f2f44aac9172e7dd 0c0110e45cf3b700' + +'f8db153b67fb0e76 3c6710b8c1c26baf c3b67a50652ee0d7 c6045a5c4b51ff33' + +'d0135065dca5d6bb 7e150e07414bd572 a954471059c1b466 d0530b0a80bd2d0c' + +'f1bedf5abfc05c3c f2736ac40b083dcf 62271e834042ecb0 d4882ddd35403c1e' + +'d24bc4ffe274c5f6 be50ec9b85aa0cfa 26d97e086ec45e06 3c29174d3dbe5490' + +'1d2a557b7eb46b18 9e17cc721fc098a0 baee2f364a2b409d 49d9372a9625db11' + +'acfd74ba7f41285f 9c1916d3caaf5238 852694bbde2a13f7 8fcc92d16658dd04'), + // 'B' is the server's public message + B: h(' 485d56912c60d9c1 7af15494d4d50006 45eefa2d41f6bcb5 785e08efad0833a1' + +'3cb43ee3869e78d4 c2006f42b9741782 a85c90a110cc9a74 4fc2a361d5535966' + +'2dc5fa4a8d0c7c0e 63e0cf32a28af655 863dd5d66f550557 eacd3e3e64d90f9f' + +'0d757403c9bbfb08 fcc9a35e1cb421d7 3bb93fa72d5b54ed bfa219d3867255ba' + +'f96223eef038f085 722b2d14457a5a13 1857a56e66d3011b b5aa7504c4b9a346' + +'8d0ebdd817d20105 be06ba261ea16740 723faa097f27ddc2 efe34cf8fe59451a' + +'5bb3987d7161085f b8fc28d5cc28c466 6a3ca486ad0ca83d 1984248ac838574e' + +'348fb9745ffd1163 f53b5566768a8971 237065d8f6e786be e15107125fb10df1'), + // 'A' is the client's public message + A: h(' a4b17836b1e7d6f1 5b9901f644bcdf5e 119e7a861c6ee88d 006d8420a5066f22' + +'d9bf5ccf3d380437 0d29d778ec40afcf c88de7bf22ec03fc 6ab12e0dd95d15e3' + +'a6249c94393435b0 0d23b1b0439dabed cce1726b2b3cdea2 647c8790d604d87d' + +'2ac890cfceec0dbe 434f09a9bc11d984 a1e1990f69956ae0 db6068992ad1715f' + +'b4381516da83637a 73de4211908c8f2f f8b3a09e8535acf3 c2b8de4e9a632f89' + +'9bfa08cee543b4ea 50d0aca0b3e4fbfa e49ffa2a1ab89a42 8bea928868828501' + +'2e8af13fcdd444ad da9ad1d0ab4c2069 91919e5391bd2b1a ab8c2d006baceaf8' + +'cdcb555a6b16e844 5b03e09776eba841 7576dac458afbbd5 2902dfb0282bed79'), + // 'u' combines the two public messages + u: h('000e4039be3989ad 088dc17d8ade899a 6409e7e57b3e8518 cee1cbc77e1de243'), + // 'S' is the shared secret + S: h(' 5c7f591d134d19f9 fcedc2b4e3eecd3d 5deadfe7dd42bd59 b1c960516c65ab61' + +'d007f8134e0a7ca3 0dd409128ef2c780 6784afd95985c8f3 c2d42cd73d26d315' + +'541645d28aefabc9 980c9a6e5714b178 aa69e5321828ca00 f3d10d742776cfe4' + +'4b7f5f5c0247addc 0ab0640b49b540ff 9bccea8702e1f996 49448680c00fb484' + +'51919224d44236ba 1b1e5cf62a5946bd 637f189ff7b8eba9 7b719f18ad9251f0' + +'a81c157604065388 d7bf4abbf774bfb2 d7b95ed8359b0d70 6ff5df0223992c81' + +'4aac506e1bace002 d134ed5e41d74f93 a8f410dfe7dc5954 f70b6bafcd0ddfde' + +'e75f0058f718ec14 f9bbeb29ff966e00 ddfdd2d38a1c7a68 ac455a57b972d528'), + // 'K' is the shared derived key + K: h('b637ede0b7a31c46 b2567e855eb8a7f7 a994937deee76479 62afbe35d6929709'), + // 'M1' is the client's proof that it knows the shared key + M1: h('67c83797eb1a3987 e2d48d287e3bd772 d25db2b3cd86ea22 c8cf3ae932a1e45b') +}; + +/* inputs_3/expected_3 have leading 0x00 bytes in 'x' and 'K' */ +var inputs_3 = { + I: inputs_2.I, P: inputs_2.P, + salt: h('00f1000000000000000000000000000000000000000000000000000000000021'), + a: h(' 00f2000000000000 0000000000000000 0000000000000000 0000000000000000' + +'0000000000000000 0000000000000000 0000000000000000 0000000000000000' + +'0000000000000000 0000000000000000 0000000000000000 0000000000000000' + +'0000000000000000 0000000000000000 0000000000000000 0000000000000000' + +'0000000000000000 0000000000000000 0000000000000000 0000000000000000' + +'0000000000000000 0000000000000000 0000000000000000 0000000000000000' + +'0000000000000000 0000000000000000 0000000000000000 0000000000000000' + +'0000000000000000 0000000000000000 0000000000000000 00000000000001a0' + ), + b: inputs_2.b +}; +var expected_3 = { + k: expected_2.k, + x: expected_2.x, + v: expected_2.v, + B: expected_2.B, + A: h(' 87b6da9e4162843b 4d5ee60c403ae3e1 e9fdab64883f13ab 4a44b0718a9ea1b6' + +'1ad17c675e0f0395 b37d58a046a2d5ab 1fb665a9777abe80 8077ccf6fd8ec583' + +'854eab98deb257d9 10e5bf5cafed4955 2a5cd9927c0979f7 5a21654644000173' + +'aef6f2244296439c 10b3c61a03e7146e f6c9c9564b1d2bf5 1ece84d115965f9c' + +'c82006bdb7a124da 3304bcc24c8f3724 522b748fb19a0cb6 b60e355acbf649b5' + +'40b4972e24077c29 32004a3ad9e59464 2e90a3bfc8de7085 f4a4efc195bd06c9' + +'6c7011f3c979eaab 469f06465a5b7239 afaee535aedc5bd2 1a220546e0e6b70b' + +'5b6f54db3fea46d5 7ebc7fe46156d793 c59e6290d3cf9bc2 4316528da34f4640'), + u: h('865d0efca6cf17d6 f489e129231f1a48 b20c83ec6581d11f 3a2fa48ea93cd305'), + S: h(' 0ae26456e1a0dec1 ce162fb2e5bc7300 3c285e17c0b44f03 7ebbc57f8020ceae' + +'5d10a9e6e44eab2a 6915b582ab5f6e7d 16002ce05e524015 e9bc7c56d5131da4' + +'d4c4d7c3debaffcd b60e58468bd2c0da 5de95855480190a3 5258c79032001882' + +'3d836ca91848c5b6 3ca4265c3329eb44 161af9ce64cf4468 ef0eb88a788a0d07' + +'52a69821278c94ae 7193161b5c638b55 bf732e2a5996ccc5 16335f9f3d00dfa9' + +'8ac1b1e4971c5417 d34eba1e2a90ed60 a07d1d8be5b9d773 d8f2cb03bfb75994' + +'249f7734081aa42d 58dd54f8f725b245 175cf7d102e1086c eba4cfe7e49a2d27' + +'ffd6aef7549d402f bfcea78b4f3398ac 9ab1ee199f70acb6 4d2a17e159ff500d'), + K: h('00217598a4008956 4b17196bd43422d6 03a0a88a545b61b3 98c42c9cbcc1d1b3'), + M1: h('96d815ecece1dff4 254cd77517b37b97 65e741c1a57169ab af538e867444ec7f') +}; + +/* inputs_4/expected_4 have leading 0x00 bytes in 'x' and 'M1' */ +var inputs_4 = { + I: inputs_2.I, P: inputs_2.P, + salt: h('00f1000000000000000000000000000000000000000000000000000000000021'), + a: h(' 00f2000000000000 0000000000000000 0000000000000000 0000000000000000' + +'0000000000000000 0000000000000000 0000000000000000 0000000000000000' + +'0000000000000000 0000000000000000 0000000000000000 0000000000000000' + +'0000000000000000 0000000000000000 0000000000000000 0000000000000000' + +'0000000000000000 0000000000000000 0000000000000000 0000000000000000' + +'0000000000000000 0000000000000000 0000000000000000 0000000000000000' + +'0000000000000000 0000000000000000 0000000000000000 0000000000000000' + +'0000000000000000 0000000000000000 0000000000000000 0000000000000190' + ), + b: inputs_2.b +}; +var expected_4 = { + k: expected_2.k, + x: expected_2.x, + v: expected_2.v, + B: expected_2.B, + A: h(' 4aee66beefb92d12 c8e341814809afcd 9ce083c11abcda70 0c03d5379c429cb9' + +'acbde6bb42a628f3 7a2536c864c40f74 f48a9d9356029a8b fe0e10cb9cf5a8a4' + +'2e591841f426d281 edf7c9b04112d8ef bf73f9768a4faace ddd351d3e9380bf1' + +'dcd0590c7ab50a95 bd23e9617e303bea 6f8fbe8a657b6417 4b60cdf5c059ba67' + +'1b6735324ae0c30a e7f3e361de8f273c af7b2513fa048ed1 0106c66ce460c5cc' + +'78544c790f5ffcce 378b79d5f02ec361 3a457b03fa0cc39c 80d6fdd645e24f65' + +'c690f9478d5b331d c00eef68670edbf3 629fd1a6c85267d2 cbb90f1670e7ba09' + +'cf2b5a9b00be8e11 f33e47a1c1f04eca f35bccb61af1116e 4d0f9d475017bad2'), + u: h('d0913eb75b61e15a 87756ffa04d4f967 e492bd0b330a2b11 fe8976aada2bb1ee'), + S: h(' 7ba3ce4a3d236b95 3c2d0fee42195c85 081664a44f55b82d a3abf66ac68bdbd7' + +'ad82d5ad95090782 5241fb706de8fc58 0a29e4579fbbedf3 0bec0138b3f76e06' + +'f9c86b16ad673890 3003ce8c86cb14ea 552db904a20970a9 7d9258a768087d30' + +'47a6e77520d32968 de3f64e94cd8c463 92c13e194194745c 8e53a9bb15a79473' + +'2a645068970fcdd9 a7c98b4aec19773a 5196802c2e932e71 d3a4a340e6f4fe16' + +'9e7ccc687f7246fe 20edeaf88d1125da c812751317f7213c d84f9efe2313d701' + +'d4a9bf0242bfe703 26fc19b68c90e83b 59b5cc21886ab602 f8bfa16fb50c3147' + +'9aad5e31698abf67 863b7ca6b6ac25a7 09a24d8f94c80bbf 691e38c81beb3c72'), + K: h('bd2a167a93b8496e 68c7e24b37956924 672eb8249d25c281 13984912d5cf27a6'), + M1: h('00cef66a047d506c bf941c236218e583 5343534ae08cf0cd 0fb7980bed242e05') +}; + + +function hexequal(a, b, msg) { + assert.equal(a.length, b.length, msg); + assert.equal(a.toString('hex'), b.toString('hex'), msg); +} + +function numequal(a, b, msg) { + assert(a.compareTo(b) == 0, msg); +} + +function checkVectors(params, inputs, expected) { + hexequal(inputs.I, new Buffer('616e6472c3a9406578616d706c652e6f7267', "hex"), "I"); + hexequal(srp.computeVerifier(params, inputs.salt, inputs.I, inputs.P), expected.v, "v"); + + var client = new srp.Client(params, inputs.salt, inputs.I, inputs.P, inputs.a); + var server = new srp.Server(params, expected.v, inputs.b); + +//! numequal(client._private.k_num, bignum.fromBuffer(expected.k), "k"); +//! numequal(client._private.x_num, bignum.fromBuffer(expected.x), "x"); +// console.log("k_num = " + client._private.k_num.toString(16) + ", expected k = " + bigInt(expected.k.toString('hex'), 16).toString(16)); + numequal(client._private.k_num, new BigInteger(expected.k.toString('hex'), 16), "k"); + numequal(client._private.x_num, new BigInteger(expected.x.toString('hex'), 16), "x"); + hexequal(client.computeA(), expected.A); + hexequal(server.computeB(), expected.B); + + assert.throws(function() {client.computeM1();}, /incomplete protocol/); + assert.throws(function() {client.computeK();}, /incomplete protocol/); + assert.throws(function() {server.checkM1(expected.M1);}, /incomplete protocol/); + assert.throws(function() {server.computeK();}, /incomplete protocol/); + + client.setB(expected.B); + + numequal(client._private.u_num, new BigInteger(expected.u.toString('hex'), 16)); + hexequal(client._private.S_buf, expected.S); + hexequal(client.computeM1(), expected.M1); + hexequal(client.computeK(), expected.K); + + server.setA(expected.A); + numequal(server._private.u_num, new BigInteger(expected.u.toString('hex'), 16)); + hexequal(server._private.S_buf, expected.S); + assert.throws(function() {server.checkM1(Buffer("notM1"));}, + /client did not use the same password/); + server.checkM1(expected.M1); // happy, not throwy + hexequal(server.computeK(), expected.K); +} + +vows.describe('picl vectors') + +.addBatch({ + 'vectors 1': function() { checkVectors(params, inputs_1, expected_1); }, + 'vectors 2': function() { checkVectors(params, inputs_2, expected_2); }, + 'vectors 3': function() { checkVectors(params, inputs_3, expected_3); }, + 'vectors 4': function() { checkVectors(params, inputs_4, expected_4); } +}) + +.export(module); diff --git a/test/test_rfc_5054.js b/test/test_rfc_5054.js new file mode 100644 index 0000000..c0542ec --- /dev/null +++ b/test/test_rfc_5054.js @@ -0,0 +1,98 @@ +const vows = require('vows'), + assert = require('assert'), + srp = require('../lib/srp'), + params = srp.params['1024']; + +/* + * http://tools.ietf.org/html/rfc5054#appendix-B + */ + +const I = new Buffer("alice"), + P = new Buffer("password123"), + s = Buffer('beb25379d1a8581eb5a727673a2441ee', 'hex'), + k_expected = '7556aa045aef2cdd07abaf0f665c3e818913186f', + x_expected = '94b7555aabe9127cc58ccf4993db6cf84d16c124', + v_expected = ('7e273de8 696ffc4f 4e337d05 b4b375be b0dde156 9e8fa00a 9886d812' + +'9bada1f1 822223ca 1a605b53 0e379ba4 729fdc59 f105b478 7e5186f5' + +'c671085a 1447b52a 48cf1970 b4fb6f84 00bbf4ce bfbb1681 52e08ab5' + +'ea53d15c 1aff87b2 b9da6e04 e058ad51 cc72bfc9 033b564e 26480d78' + +'e955a5e2 9e7ab245 db2be315 e2099afb').split(/\s/).join(''), + + a = Buffer('60975527035cf2ad1989806f0407210bc81edc04e2762a56afd529ddda2d4393', 'hex'), + b = Buffer('e487cb59d31ac550471e81f00f6928e01dda08e974a004f49e61f5d105284d20', 'hex'), + A_expected = ('61d5e490 f6f1b795 47b0704c 436f523d d0e560f0 c64115bb 72557ec4' + +'4352e890 3211c046 92272d8b 2d1a5358 a2cf1b6e 0bfcf99f 921530ec' + +'8e393561 79eae45e 42ba92ae aced8251 71e1e8b9 af6d9c03 e1327f44' + +'be087ef0 6530e69f 66615261 eef54073 ca11cf58 58f0edfd fe15efea' + +'b349ef5d 76988a36 72fac47b 0769447b').split(/\s/).join(''), + B_expected = ('bd0c6151 2c692c0c b6d041fa 01bb152d 4916a1e7 7af46ae1 05393011' + +'baf38964 dc46a067 0dd125b9 5a981652 236f99d9 b681cbf8 7837ec99' + +'6c6da044 53728610 d0c6ddb5 8b318885 d7d82c7f 8deb75ce 7bd4fbaa' + +'37089e6f 9c6059f3 88838e7a 00030b33 1eb76840 910440b1 b27aaeae' + +'eb4012b7 d7665238 a8e3fb00 4b117b58').split(/\s/).join(''), + + u_expected = 'ce38b9593487da98554ed47d70a7ae5f462ef019', + S_expected = ('b0dc82ba bcf30674 ae450c02 87745e79 90a3381f 63b387aa f271a10d' + +'233861e3 59b48220 f7c4693c 9ae12b0a 6f67809f 0876e2d0 13800d6c' + +'41bb59b6 d5979b5c 00a172b4 a2a5903a 0bdcaf8a 709585eb 2afafa8f' + +'3499b200 210dcc1f 10eb3394 3cd67fc8 8a2f39a4 be5bec4e c0a3212d' + +'c346d7e4 74b29ede 8a469ffe ca686e5a').split(/\s/).join(''); + +function asHex(num) { +//! return num.toBuffer().toString('hex'); + return num.toString(16); +} + +vows.describe('RFC 5054') + +.addBatch({ + "Test vectors": { + topic: function() { + return srp.computeVerifier(params, s, I, P); + }, + + "x": function() { + var client = new srp.Client(params, s, I, P, a); + assert.equal(asHex(client._private.x_num), x_expected); + }, + + "V": function(v) { + assert.equal(v.toString('hex'), v_expected); + }, + + "k": function() { + var client = new srp.Client(params, s, I, P, a); + assert.equal(asHex(client._private.k_num), k_expected); + }, + + "A": function() { + var client = new srp.Client(params, s, I, P, a); + assert.equal(client.computeA().toString('hex'), A_expected); + }, + + "B": function(v) { + var server = new srp.Server(params, v, b); + assert.equal(server.computeB().toString('hex'), B_expected); + }, + + "u": function() { + var client = new srp.Client(params, s, I, P, a); + client.setB(Buffer(B_expected, 'hex')); + assert.equal(asHex(client._private.u_num), u_expected); + }, + + "S client": function() { + var client = new srp.Client(params, s, I, P, a); + client.setB(Buffer(B_expected, 'hex')); + assert.equal(client._private.S_buf.toString('hex'), S_expected); + }, + + "S server": function(v) { + var server = new srp.Server(params, v, b); + server.setA(Buffer(A_expected, 'hex')); + assert.equal(server._private.S_buf.toString('hex'), S_expected); + } + } +}) + +.export(module); diff --git a/test/test_srp.js b/test/test_srp.js new file mode 100644 index 0000000..acd1b4d --- /dev/null +++ b/test/test_srp.js @@ -0,0 +1,194 @@ +const vows = require('vows'), + assert = require('assert'), + srp = require('../lib/srp'), + params = srp.params[4096], + + salt = new Buffer("salty"), + identity = new Buffer("alice"), + password = new Buffer("password123"); + +assert(params, "missing parameters"); + +var client, server; +var a, A; +var b, B; +var verifier; +var S_client, S_server; + +vows.describe("srp.js") + +.addBatch({ + "create Verifier": function() { + verifier = srp.computeVerifier(params, salt, identity, password); + assert.equal(verifier.toString("hex"), "f0e47f50f5dead8db8d93a279e3b62d6ff50854b31fbd3474a886bef916261717e84dd4fb8b4d27feaa5146db7b1cbbc274fdf96a132b5029c2cd72527427a9b9809d5a4d018252928b4fc343bc17ce63c1859d5806f5466014fc361002d8890aeb4d6316ff37331fc2761be0144c91cdd8e00ed0138c0ce51534d1b9a9ba629d7be34d2742dd4097daabc9ecb7aaad89e53c342b038f1d2adae1f2410b7884a3e9a124c357e421bccd4524467e1922660e0a4460c5f7c38c0877b65f6e32f28296282a93fc11bbabb7bb69bf1b3f9391991d8a86dd05e15000b7e38ba38a536bb0bf59c808ec25e791b8944719488b8087df8bfd7ff20822997a53f6c86f3d45d004476d6303301376bb25a9f94b552cce5ed40de5dd7da8027d754fa5f66738c7e3fc4ef3e20d625df62cbe6e7adfc21e47880d8a6ada37e60370fd4d8fc82672a90c29f2e72f35652649d68348de6f36d0e435c8bd42dd00155d35d501becc0661b43e04cdb2da84ce92b8bf49935d73d75efcbd1176d7bbccc3cc4d4b5fefcc02d478614ee1681d2ff3c711a61a7686eb852ae06fb8227be21fb8802719b1271ba1c02b13bbf0a2c2e459d9bedcc8d1269f6a785cb4563aa791b38fb038269f63f58f47e9051499549789269cc7b8ec7026fc34ba73289c4af829d5a532e723967ce9b6c023ef0fd0cfe37f51f10f19463b6534159a09ddd2f51f3b30033"); + }, + + "create a and b": { + topic: function() { + var cb = this.callback; + srp.genKey(64, function(err, key) { + assert(err === null); + a = key; + srp.genKey(32, function(err, key) { + assert(err === null); + b = key; + cb(); + }); + }); + }, + + "use a and b": function() { + client = new srp.Client(params, salt, identity, password, a); + + // client produces A + A = client.computeA(); + + // create server + server = new srp.Server(params, verifier, b); + + // server produces B + B = server.computeB(); + + // server accepts A + server.setA(A); + + // client doesn't produce M1 too early + assert.throws(function(){client.computeM1();}, /incomplete protocol/); + + // client accepts B + client.setB(B); + + // client produces M1 now + client.computeM1(); + + // server likes client's M1 + var serverM2 = server.checkM1(client.computeM1()); + + // client and server agree on K + var client_K = client.computeK(); + var server_K = server.computeK(); + assert.equal(client_K.toString("hex"), server_K.toString("hex")); + + // server is authentic + assert.doesNotThrow(function(){client.checkM2(serverM2);}, "M2 didn't check"); + }, + + "constructor doesn't require 'new'": function() { + client = srp.Client(params, salt, identity, password, a); + + // client produces A + A = client.computeA(); + + // create server + server = srp.Server(params, verifier, b); + + // server produces B + B = server.computeB(); + + // server accepts A + server.setA(A); + + // client doesn't produce M1 too early + assert.throws(function(){client.computeM1();}, /incomplete protocol/); + + // client accepts B + client.setB(B); + + // client produces M1 now + client.computeM1(); + + // server likes client's M1 + serverM2 = server.checkM1(client.computeM1()); + + // client and server agree on K + var client_K = client.computeK(); + var server_K = server.computeK(); + assert.equal(client_K.toString("hex"), server_K.toString("hex")); + + // server is authentic + assert.doesNotThrow(function(){client.checkM2(serverM2);}, "M2 didn't check"); + }, + + "server rejects wrong M1": function() { + var bad_client = new srp.Client(params, salt, identity, Buffer("bad"), a); + var server2 = new srp.Server(params, verifier, b); + bad_client.setB(server2.computeB()); + assert.throws(function(){server.checkM1(bad_client.computeM1());}, + /client did not use the same password/); + }, + + "server rejects bad A": function() { + // client's "A" must be 1..N-1 . Reject 0 and N and N+1. We should + // reject 2*N too, but our Buffer-length checks reject it before the + // number itself is examined. + + var server2 = new srp.Server(params, verifier, b); + var Azero = new Buffer(params.N_length_bits/8); + Azero.fill(0); +//! var AN = params.N.toBuffer(); +//! var AN1 = params.N.add(1).toBuffer(); + var AN = new Buffer(params.N.toString(16), 16); + var AN1 = new Buffer(params.N.add(1).toString(16), 16); + assert.throws(function() {server2.setA(Azero);}, + /invalid client-supplied 'A'/); + assert.throws(function() {server2.setA(AN);}, + /invalid client-supplied 'A'/); + assert.throws(function() {server2.setA(AN1);}, + /invalid client-supplied 'A'/); + }, + + "client rejects bad B": function() { + // server's "B" must be 1..N-1 . Reject 0 and N and N+1 + var client2 = new srp.Client(params, salt, identity, password, a); + var Bzero = new Buffer(params.N_length_bits/8); + Bzero.fill(0, 0, params.N_length_bits/8); +//! var BN = params.N.toBuffer(); +//! var BN1 = params.N.add(1).toBuffer(); + var BN = new Buffer(params.N.toString(16), 16); + var BN1 = new Buffer(params.N.add(1).toString(16), 16); + assert.throws(function() {client2.setB(Bzero);}, + /invalid server-supplied 'B'/); + assert.throws(function() {client2.setB(BN);}, + /invalid server-supplied 'B'/); + assert.throws(function() {client2.setB(BN1);}, + /invalid server-supplied 'B'/); + }, + + "client rejects bad M2": function() { + client = srp.Client(params, salt, identity, password, a); + + // client produces A + A = client.computeA(); + + // create server + server = srp.Server(params, verifier, b); + + // server produces B + B = server.computeB(); + + // server accepts A + server.setA(A); + + // client accepts B + client.setB(B); + + // client produces M1 now + client.computeM1(); + + // server likes client's M1 + var serverM2 = server.checkM1(client.computeM1()); + // we tamper with the server's M2 + serverM2 = serverM2 + "a"; + + // client and server agree on K + var client_K = client.computeK(); + var server_K = server.computeK(); + assert.equal(client_K.toString("hex"), server_K.toString("hex")); + + // server is NOT authentic + assert.throws(function(){client.checkM2(serverM2);}, "M2 didn't check"); + }, + } + +}) +.export(module);