ruby-srp 0.2.0 → 0.2.1

data/.gitignore

@@ -0,0 +1,2 @@
+*.gem
+*.swp

data/Readme.md

@@ -1,7 +1,9 @@
-*IMPORTANT:* This is an initial test. It's verifying that the algorithm leads to the same secret on the client and server side. However it does not use crypto to send it over yet. So do not rely on it in a production environment yet.
-
 ## Ruby-SRP
 
 Secure remote password for ruby.
 
+*IMPORTANT:* This is still in early development. Versions prior to 0.2.1 are known to be insecure due to not validating the ephemeral public keys send.
+
+So far this library supports the two way authentication provided by SRP. It does not offer encryption for the traffic with the calculated shared secret yet. It should not be hard to add - but we do not need it yet.
+
 [![Build Status](https://secure.travis-ci.org/leapcode/ruby_srp.png?branch=master)](http://travis-ci.org/leapcode/ruby_srp) [![Code Climate](https://codeclimate.com/badge.png)](https://codeclimate.com/github/leapcode/ruby_srp)

data/lib/ruby-srp.rb

@@ -12,6 +12,6 @@ module SRP
   autoload :Authentication, 'srp/authentication'
   autoload :Util, 'srp/util'
   autoload :Session, 'srp/session'
-  class WrongPassword < StandardError
-  end
+  class WrongPassword < StandardError ; end
+  class InvalidEphemeral < ArgumentError ; end
 end

data/lib/srp/session.rb

@@ -13,7 +13,9 @@ module SRP
 
     # client -> server: I, A = g^a
     def handshake(server)
-      @bb = server.handshake(user.username, aa)
+      bb = server.handshake(user.username, aa)
+      validate_ephemeral(bb)
+      @bb = bb
     end
 
     # client -> server: M = H(H(N) xor H(g), H(I), s, A, B, K)
@@ -79,6 +81,7 @@ module SRP
 
     # only seed b for testing purposes.
     def initialize_server(aa, ephemeral = nil)
+      validate_ephemeral(aa)
       @aa = aa
       @b = ephemeral || bigrand(32).hex
     end
@@ -110,6 +113,12 @@ module SRP
       modpow(base, @b)
     end
 
+    def validate_ephemeral(ephemeral)
+      if ephemeral.hex % BIG_PRIME_N == 0
+        raise InvalidEphemeral.new 'insecure ephemeral value'
+      end
+    end
+
     # SRP 6a uses
     # M = H(H(N) xor H(g), H(I), s, A, B, K)
     def m

data/ruby-srp.gemspec

@@ -1,6 +1,6 @@
 Gem::Specification.new do |s|
   s.name              = "ruby-srp"
-  s.version           = "0.2.0"
+  s.version           = "0.2.1"
   s.platform          = Gem::Platform::RUBY
   s.authors           = ["Azul"]
   s.email             = ["azul@leap.se"]

data/test/client_session_test.rb

@@ -0,0 +1,46 @@
+require File.expand_path(File.dirname(__FILE__) + '/test_helper')
+require 'json'
+
+class ClientSessionTest < Test::Unit::TestCase
+
+  class UserStub
+    def username; end
+  end
+
+  class ServerStub
+    def initialize(bb)
+      @bb = bb
+    end
+
+    def handshake(username, aa)
+      @bb
+    end
+  end
+
+  def test_retrieval_of_bb
+    bb = SRP::Util::BIG_PRIME_N + 1
+    user = UserStub.new
+    server = ServerStub.new(bb)
+    session = SRP::Session.new(user)
+    session.handshake(server)
+    assert_equal bb, session.instance_variable_get("@bb")
+  end
+
+  def test_validation_of_bb
+    user = UserStub.new
+    server = ServerStub.new(SRP::Util::BIG_PRIME_N)
+    assert_raises SRP::InvalidEphemeral do
+      session = SRP::Session.new(user)
+      session.handshake(server)
+    end
+  end
+
+  def test_calculation_of_aa
+    data = fixture(:failed_js_client)
+    user = {} # stub
+    session = SRP::Session.new(user)
+    session.instance_variable_set("@a", data[:a].hex)
+    assert_equal data[:aa], session.aa
+  end
+
+end

data/test/session_test.rb

@@ -5,6 +5,14 @@ class SessionTest < Test::Unit::TestCase
 
   Struct.new("Client", :username, :salt, :verifier)
 
+  def test_client_public_key_validation
+    aa = SRP::Util::BIG_PRIME_N
+    client = {} # stub
+    assert_raises SRP::InvalidEphemeral do
+      session = SRP::Session.new(client, aa)
+    end
+  end
+
   def test_equivalance_to_py_srp
     data = fixture(:py_srp)
     client = stub_client(data)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ruby-srp
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.2.1
   prerelease: 
 platform: ruby
 authors:
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2013-07-14 00:00:00.000000000 Z
+date: 2013-08-07 00:00:00.000000000 Z
 dependencies: []
 description: SRP client and server based on version 6 of the standard
 email:
@@ -18,6 +18,7 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
+- .gitignore
 - .gitmodules
 - .travis.yml
 - Rakefile
@@ -45,6 +46,7 @@ files:
 - lib/srp/util.rb
 - ruby-srp.gemspec
 - test/auth_test.rb
+- test/client_session_test.rb
 - test/client_test.rb
 - test/fixtures/failed_js_client.json
 - test/fixtures/failed_js_login.json