@crossdyne/security 0.3.1-beta.1 → 0.4.0-beta.1

package/dist/index.js

@@ -9,6 +9,11 @@ var SecurityConstants = {
   Pbkdf2IterationsDefault: 6e5,
   Pbkdf2IterationsMinimum: 1e5
 };
+var HashSizes = {
+  "SHA-256": 32,
+  "SHA-384": 48,
+  "SHA-512": 64
+};
 
 // src/configurations/supported-hash-algorithms.ts
 var SupportedHashAlgorithms = ["SHA-256", "SHA-384", "SHA-512"];
@@ -297,12 +302,17 @@ var KeyDerivationService = class {
   * @returns Object with `kek` (Uint8Array) and `authHash` (Base64 string).
   */
   async deriveKeysFromPassword(identity, password, salt, options) {
+    if (!identity || identity.trim().length === 0)
+      throw new Error("Identity cannot be null or empty.");
+    if (!password || password.trim().length === 0)
+      throw new Error("Password cannot be null or empty.");
+    if (!salt || salt.length < 16)
+      throw new Error("Salt must be at least 16 bytes.");
     const opts = options ?? KdfOptions.default;
     opts.validate();
     const safeSalt = new Uint8Array(salt);
     const encoder = new TextEncoder();
-    const normalizedLogin = identity.trim().toLowerCase();
-    const combinedPassword = `${normalizedLogin}:${password}`;
+    const combinedPassword = `${identity}:${password}`;
     const passwordBytes = encoder.encode(combinedPassword);
     const baseKey = await crypto.subtle.importKey("raw", passwordBytes, "PBKDF2", false, ["deriveBits", "deriveKey"]);
     const masterKeyBits = await crypto.subtle.deriveBits({
@@ -337,11 +347,16 @@ var KeyDerivationService = class {
   * @returns Raw hash bytes for use as SRP verifier input (x).
   */
   async deriveAuthHashForSrp(identity, password, salt, srpHashAlgorithm, options) {
+    if (!identity || identity.trim().length === 0)
+      throw new Error("Identity cannot be null or empty.");
+    if (!password || password.trim().length === 0)
+      throw new Error("Password cannot be null or empty.");
+    if (!salt || salt.length < 16)
+      throw new Error("Salt must be at least 16 bytes.");
     const opts = options ?? KdfOptions.default;
     opts.validate();
-    const srpHashSize = srpHashAlgorithm === "SHA-256" ? 32 : srpHashAlgorithm === "SHA-384" ? 48 : 64;
-    const normalizedLogin = identity.trim().toLowerCase();
-    const combinedPassword = `${normalizedLogin}:${password}`;
+    const srpHashSize = HashSizes[srpHashAlgorithm];
+    const combinedPassword = `${identity}:${password}`;
     const passwordBytes = new TextEncoder().encode(combinedPassword);
     const baseKey = await crypto.subtle.importKey(
       "raw",
@@ -432,21 +447,71 @@ var SrpEncoding = class {
     const buffers = values.map((v) => this.toModulusBytes(ctx, v));
     return this.hash(ctx.hashAlgorithmName, ...buffers);
   }
-  /** Computes M1 = H(A || B || sessionKeyK). */
-  static async computeM1(ctx, A, B, sessionKeyK) {
-    return this.hash(ctx.hashAlgorithmName, this.toModulusBytes(ctx, A), this.toModulusBytes(ctx, B), sessionKeyK);
+  /**
+  * Computes the client proof M1 = H( H(N) ⊕ H(g) | H(I) | s | PAD(A) | PAD(B) | K ).
+  * 
+  * Follows RFC 5054 / SRP-6a:
+  * - H(N) and H(g) are hashed as modulus-sized values.
+  * - Identity (I) is hashed as raw UTF-8 bytes.
+  * - A and B are padded to the modulus size before hashing.
+  * - K is the session key (H(S) without padding).
+  * 
+  * @param ctx - SRP context containing N, g, hash algorithm, and modulus size.
+  * @param A - Client ephemeral public key.
+  * @param B - Server ephemeral public key.
+  * @param sessionKeyK - Session key K as raw bytes.
+  * @param identity - User identity (login). Should already be normalized (trimmed / lowercased) by the caller.
+  * @param salt - User-specific salt bytes.
+  * @returns The M1 proof as raw hash bytes.
+  */
+  static async computeM1(ctx, A, B, sessionKeyK, identity, salt) {
+    const nBytes = this.toModulusBytes(ctx, ctx.N);
+    const gBytes = this.toModulusBytes(ctx, ctx.g);
+    const hashN = await this.computeHash(ctx.hashAlgorithmName, nBytes);
+    const hashG = await this.computeHash(ctx.hashAlgorithmName, gBytes);
+    const xorNg = new Uint8Array(hashN.length);
+    for (let i = 0; i < hashN.length; i++)
+      xorNg[i] = hashN[i] ^ hashG[i];
+    const encoder = new TextEncoder();
+    const hashI = await this.computeHash(ctx.hashAlgorithmName, encoder.encode(identity));
+    return this.computeHash(
+      ctx.hashAlgorithmName,
+      xorNg,
+      hashI,
+      salt,
+      this.toModulusBytes(ctx, A),
+      this.toModulusBytes(ctx, B),
+      sessionKeyK
+    );
   }
   /** Computes M2 = H(A || M1 || sessionKeyK). */
-  static async computeM2(ctx, A, M1, sessionKeyK) {
-    return this.hash(ctx.hashAlgorithmName, this.toModulusBytes(ctx, A), this.toHashBytes(ctx, M1), sessionKeyK);
+  static async computeM2(ctx, A, m1Bytes, sessionKeyK) {
+    return this.computeHash(
+      ctx.hashAlgorithmName,
+      this.toModulusBytes(ctx, A),
+      m1Bytes,
+      sessionKeyK
+    );
   }
   /** Computes session key K = H(S). */
   static async computeSessionKey(ctx, S) {
-    const sBytes = this.toModulusBytes(ctx, S);
-    const hashBuffer = await crypto.subtle.digest(
-      ctx.hashAlgorithmName,
-      sBytes
-    );
+    let hex = S.toString(16);
+    if (hex.length % 2 !== 0)
+      hex = "0" + hex;
+    const sBytes = new Uint8Array(hex.match(/.{1,2}/g).map((b) => parseInt(b, 16)));
+    const hashBuffer = await crypto.subtle.digest(ctx.hashAlgorithmName, sBytes);
+    return new Uint8Array(hashBuffer);
+  }
+  /** Hashes bytes and returns raw Uint8Array (для M1/M2). */
+  static async computeHash(algo, ...buffers) {
+    const totalLen = buffers.reduce((sum, b) => sum + b.length, 0);
+    const combined = new Uint8Array(totalLen);
+    let offset = 0;
+    for (const buf of buffers) {
+      combined.set(buf, offset);
+      offset += buf.length;
+    }
+    const hashBuffer = await crypto.subtle.digest(algo, combined);
     return new Uint8Array(hashBuffer);
   }
   /** Concatenates byte arrays and returns the hash as bigint. */
@@ -492,7 +557,8 @@ var SrpClientService = class {
     const salt = SecurityUtils.fromBase64(saltBase64);
     const authHash = await this.keyDerivation.deriveAuthHashForSrp(login, password, salt, ctx.hashAlgorithmName);
     const x = SecurityUtils.bytesToBigInt(authHash);
-    const aBytes = crypto.getRandomValues(new Uint8Array(32));
+    const privateKeySize = Math.max(32, Math.floor(ctx.modulusSize / 2));
+    const aBytes = crypto.getRandomValues(new Uint8Array(privateKeySize));
     const a = SecurityUtils.bytesToBigInt(aBytes);
     const A = SecurityUtils.expMod(ctx.g, a, ctx.N);
     if (A % ctx.N === 0n)
@@ -511,11 +577,11 @@ var SrpClientService = class {
     if (S === 0n)
       throw new Error("Critical error: S === 0");
     const sessionKeyK = await SrpEncoding.computeSessionKey(ctx, S);
-    const M1 = await SrpEncoding.computeM1(ctx, A, B, sessionKeyK);
+    const M1 = await SrpEncoding.computeM1(ctx, A, B, sessionKeyK, login, salt);
     return {
       A: SecurityUtils.toBase64(SrpEncoding.toModulusBytes(ctx, A)),
-      M1: SecurityUtils.toBase64(SrpEncoding.toHashBytes(ctx, M1)),
-      S: SecurityUtils.toBase64(SrpEncoding.toModulusBytes(ctx, S))
+      M1: SecurityUtils.toBase64(M1),
+      SessionKeyK: sessionKeyK
     };
   }
   /**
@@ -527,15 +593,12 @@ var SrpClientService = class {
    * @param ctx - SRP context.
    * @returns True if the server proof is valid.
    */
-  async verifyServerM2(A_b64, M1_b64, S_b64, serverM2_b64, ctx) {
+  async verifyServerM2(A_b64, M1_b64, sessionKeyK, serverM2_b64, ctx) {
     const A = SecurityUtils.bytesToBigInt(SecurityUtils.fromBase64(A_b64));
-    const M1 = SecurityUtils.bytesToBigInt(SecurityUtils.fromBase64(M1_b64));
-    const S = SecurityUtils.bytesToBigInt(SecurityUtils.fromBase64(S_b64));
-    const sessionKeyK = await SrpEncoding.computeSessionKey(ctx, S);
+    const M1 = SecurityUtils.fromBase64(M1_b64);
     const computedM2 = await SrpEncoding.computeM2(ctx, A, M1, sessionKeyK);
-    const computedM2Bytes = SrpEncoding.toHashBytes(ctx, computedM2);
     const serverM2Bytes = SecurityUtils.fromBase64(serverM2_b64);
-    return SecurityUtils.fixedTimeEquals(computedM2Bytes, serverM2Bytes);
+    return SecurityUtils.fixedTimeEquals(computedM2, serverM2Bytes);
   }
 };
 
@@ -548,17 +611,23 @@ var SrpServerService = class {
    * @param ctx - SRP context (hash, N, g, etc.).
    * @returns Session state with private b, verifier, and public B.
    */
-  async getSrpChallenge(login, verifierBytes, ctx) {
+  async getSrpChallenge(login, verifierBytes, salt, ctx) {
     const v = SecurityUtils.bytesToBigInt(verifierBytes);
-    const bBytes = crypto.getRandomValues(new Uint8Array(32));
-    const b = SecurityUtils.bytesToBigInt(bBytes);
-    const gB = SecurityUtils.expMod(ctx.g, b, ctx.N);
-    const B = (ctx.k * v + gB) % ctx.N;
+    const privateKeySize = Math.max(32, Math.floor(ctx.modulusSize / 2));
+    let bBytes;
+    let B;
+    do {
+      bBytes = crypto.getRandomValues(new Uint8Array(privateKeySize));
+      const b = SecurityUtils.bytesToBigInt(bBytes);
+      const gB = SecurityUtils.expMod(ctx.g, b, ctx.N);
+      B = (ctx.k * v + gB) % ctx.N;
+    } while (B === 0n);
     return {
       login,
-      privateKeyB: SecurityUtils.toBase64(bBytes),
-      verifier: SecurityUtils.toBase64(verifierBytes),
-      publicKeyB: SecurityUtils.toBase64(SrpEncoding.toModulusBytes(ctx, B))
+      privateKeyB: bBytes,
+      verifier: verifierBytes,
+      publicKeyB: SrpEncoding.toModulusBytes(ctx, B),
+      salt
     };
   }
   /**
@@ -572,10 +641,10 @@ var SrpServerService = class {
    */
   async verifySrpProof(sessionState, a, m1, ctx) {
     const A = SecurityUtils.bytesToBigInt(SecurityUtils.fromBase64(a));
-    const M1_client = SecurityUtils.bytesToBigInt(SecurityUtils.fromBase64(m1));
-    const b = SecurityUtils.bytesToBigInt(SecurityUtils.fromBase64(sessionState.privateKeyB));
-    const v = SecurityUtils.bytesToBigInt(SecurityUtils.fromBase64(sessionState.verifier));
-    const B = SecurityUtils.bytesToBigInt(SecurityUtils.fromBase64(sessionState.publicKeyB));
+    const M1_client = SecurityUtils.fromBase64(m1);
+    const b = SecurityUtils.bytesToBigInt(sessionState.privateKeyB);
+    const v = SecurityUtils.bytesToBigInt(sessionState.verifier);
+    const B = SecurityUtils.bytesToBigInt(sessionState.publicKeyB);
     if (v <= 0n)
       throw new Error("The verifier is corrupted");
     if (A % ctx.N === 0n)
@@ -588,13 +657,11 @@ var SrpServerService = class {
     const vU = SecurityUtils.expMod(v, u, ctx.N);
     const S = SecurityUtils.expMod(A * vU % ctx.N, b, ctx.N);
     const sessionKeyK = await SrpEncoding.computeSessionKey(ctx, S);
-    const M1_server = await SrpEncoding.computeM1(ctx, A, B, sessionKeyK);
-    const m1ServerBytes = SrpEncoding.toHashBytes(ctx, M1_server);
-    const m1ClientBytes = SrpEncoding.toHashBytes(ctx, M1_client);
-    if (!SecurityUtils.fixedTimeEquals(m1ServerBytes, m1ClientBytes))
+    const M1_server = await SrpEncoding.computeM1(ctx, A, B, sessionKeyK, sessionState.login, sessionState.salt);
+    if (!SecurityUtils.fixedTimeEquals(M1_server, M1_client))
       throw new Error("Invalid password");
     const M2_server = await SrpEncoding.computeM2(ctx, A, M1_client, sessionKeyK);
-    return SecurityUtils.toBase64(SrpEncoding.toHashBytes(ctx, M2_server));
+    return SecurityUtils.toBase64(M2_server);
   }
 };