@crossdyne/security 0.3.1-beta.1 → 0.5.0-beta.1

package/dist/index.js

@@ -9,6 +9,11 @@ var SecurityConstants = {
   Pbkdf2IterationsDefault: 6e5,
   Pbkdf2IterationsMinimum: 1e5
 };
+var HashSizes = {
+  "SHA-256": 32,
+  "SHA-384": 48,
+  "SHA-512": 64
+};
 
 // src/configurations/supported-hash-algorithms.ts
 var SupportedHashAlgorithms = ["SHA-256", "SHA-384", "SHA-512"];
@@ -41,16 +46,22 @@ var SecurityUtils = class {
       return 0n;
     return BigInt("0x" + Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join(""));
   }
-  /** Converts bigint to fixed-length big-endian bytes (pads/truncates). */
+  /** Converts bigint to fixed-length big-endian bytes (pads only; never truncates). */
   static bigIntToFixedBytes(bn, length) {
+    if (length <= 0)
+      throw new Error("Length must be positive.");
     let hex = bn.toString(16);
     if (hex.length % 2 !== 0)
       hex = "0" + hex;
-    if (hex.length > length * 2)
-      hex = hex.slice(hex.length - length * 2);
-    else
-      hex = hex.padStart(length * 2, "0");
-    return new Uint8Array(hex.match(/.{1,2}/g)?.map((b) => parseInt(b, 16)) || []);
+    const byteLength = hex.length / 2;
+    if (byteLength > length)
+      throw new Error(`Value byte length (${byteLength}) exceeds expected length (${length}). Possible data corruption or context mismatch.`);
+    hex = hex.padStart(length * 2, "0");
+    const bytes = new Uint8Array(length);
+    for (let i = 0; i < length; i++) {
+      bytes[i] = parseInt(hex.substr(i * 2, 2), 16);
+    }
+    return bytes;
   }
   /** Constant-time comparison of two Uint8Arrays. */
   static fixedTimeEquals(a, b) {
@@ -63,16 +74,26 @@ var SecurityUtils = class {
   }
   /** Modular exponentiation (base^exp mod mod) using binary exponentiation. */
   static expMod(base, exp, mod) {
-    let res = BigInt(1);
+    if (mod === 1n) return 0n;
+    let res = 1n;
     base = base % mod;
     while (exp > 0n) {
-      if (exp % 2n === 1n)
+      if ((exp & 1n) === 1n)
         res = res * base % mod;
-      base = base * base % mod;
-      exp = exp / 2n;
+      exp >>= 1n;
+      if (exp > 0n)
+        base = base * base % mod;
     }
     return res;
   }
+  static bigIntToRawBytes(bn) {
+    if (bn === 0n)
+      return new Uint8Array([0]);
+    let hex = bn.toString(16);
+    if (hex.length % 2 !== 0)
+      hex = "0" + hex;
+    return new Uint8Array(hex.match(/.{1,2}/g).map((b) => parseInt(b, 16)));
+  }
 };
 
 // src/crypto/aes-gcm-options.ts
@@ -125,6 +146,97 @@ var AesGcmOptions = class _AesGcmOptions {
   }
 };
 
+// src/crypto/crypto-profile.ts
+var CryptoProfile = class {
+  /**
+   * Creates a new CryptoProfile.
+   * @param params - Object containing version, kdfOptions, aesGcmOptions.
+   */
+  constructor(params) {
+    this.version = params.version;
+    this.kdfOptions = params.kdfOptions;
+    this.aesGcmOptions = params.aesGcmOptions;
+  }
+};
+
+// src/crypto/crypto-version.ts
+var CryptoVersion = /* @__PURE__ */ ((CryptoVersion2) => {
+  CryptoVersion2[CryptoVersion2["V1"] = 1] = "V1";
+  return CryptoVersion2;
+})(CryptoVersion || {});
+
+// src/crypto/kdf-options.ts
+var KdfOptions = class _KdfOptions {
+  constructor() {
+    this._pbkdf2Iterations = SecurityConstants.Pbkdf2IterationsDefault;
+    this._hashAlgorithm = "SHA-256";
+  }
+  /** PBKDF2 iteration count (minimum 100_000). */
+  get pbkdf2Iterations() {
+    return this._pbkdf2Iterations;
+  }
+  set pbkdf2Iterations(v) {
+    if (v < SecurityConstants.Pbkdf2IterationsMinimum)
+      throw new RangeError(`PBKDF2 iterations must be \u2265 ${SecurityConstants.Pbkdf2IterationsMinimum}`);
+    this._pbkdf2Iterations = v;
+  }
+  /** Hash algorithm used by PBKDF2. Must be one of {@link SupportedHashAlgorithms}. */
+  get hashAlgorithm() {
+    return this._hashAlgorithm;
+  }
+  set hashAlgorithm(v) {
+    if (!SupportedHashAlgorithms.includes(v))
+      throw new RangeError(`Unsupported hash: ${v}`);
+    this._hashAlgorithm = v;
+  }
+  /** Validates iterations and hash algorithm. */
+  validate() {
+    if (this.pbkdf2Iterations < SecurityConstants.Pbkdf2IterationsMinimum)
+      throw new Error(`Pbkdf2Iterations (${this.pbkdf2Iterations}) below minimum`);
+    if (!SupportedHashAlgorithms.includes(this.hashAlgorithm))
+      throw new Error(`Invalid hash algorithm: ${this.hashAlgorithm}`);
+  }
+  /** Default preset: SHA-256, 600_000 iterations. */
+  static get default() {
+    return new _KdfOptions();
+  }
+  /** Fluent setter for {@link pbkdf2Iterations}. */
+  withPbkdf2Iterations(i) {
+    this.pbkdf2Iterations = i;
+    return this;
+  }
+  /** Fluent setter for {@link hashAlgorithm}. */
+  withHashAlgorithm(h) {
+    this.hashAlgorithm = h;
+    return this;
+  }
+  /** Validates and returns this instance. */
+  build() {
+    this.validate();
+    return this;
+  }
+};
+
+// src/crypto/crypto-profile-registry.ts
+var CryptoProfileRegistry = class {
+  static getProfile(version) {
+    switch (version) {
+      case 1 /* V1 */:
+        return new CryptoProfile({
+          version: 1 /* V1 */,
+          kdfOptions: KdfOptions.default,
+          aesGcmOptions: AesGcmOptions.default
+        });
+      default:
+        throw new Error(`Unsupported crypto version: ${version}`);
+    }
+  }
+  /** Latest supported profile (currently V1). */
+  static get latest() {
+    return this.getProfile(1 /* V1 */);
+  }
+};
+
 // src/crypto/crypto.service.ts
 var CryptoService = class {
   constructor() {
@@ -142,12 +254,13 @@ var CryptoService = class {
   * @param options - AES-GCM configuration; uses default if omitted.
   * @returns Base64-encoded ciphertext with prepended nonce.
   */
-  async encryptData(dataModel, key, options) {
-    const opts = options ?? AesGcmOptions.default;
+  async encryptData(dataModel, key, version = 1 /* V1 */) {
+    const profile = CryptoProfileRegistry.getProfile(version);
+    const opts = profile.aesGcmOptions;
     opts.validate();
     const encoder = new TextEncoder();
     let jsonString;
-    if (dataModel instanceof Uint8Array) {
+    if (ArrayBuffer.isView(dataModel) && dataModel.constructor === Uint8Array) {
       jsonString = `"${SecurityUtils.toBase64(dataModel)}"`;
     } else {
       jsonString = JSON.stringify(dataModel);
@@ -175,9 +288,10 @@ var CryptoService = class {
       cryptoKey,
       plainBytes
     );
-    const result = new Uint8Array(opts.nonceSize + encryptedContent.byteLength);
-    result.set(nonce, 0);
-    result.set(new Uint8Array(encryptedContent), opts.nonceSize);
+    const result = new Uint8Array(1 + opts.nonceSize + encryptedContent.byteLength);
+    result[0] = version;
+    result.set(nonce, 1);
+    result.set(new Uint8Array(encryptedContent), 1 + opts.nonceSize);
     return SecurityUtils.toBase64(result);
   }
   /**
@@ -188,16 +302,19 @@ var CryptoService = class {
   * @returns Deserialized object, or null if input is empty.
   * @throws If authentication tag mismatch or corrupted data.
   */
-  async decryptData(encryptedBase64, key, options, isBytes = false) {
+  async decryptData(encryptedBase64, key, isBytes = false) {
     if (!encryptedBase64)
       return null;
-    const opts = options ?? AesGcmOptions.default;
-    opts.validate();
     const encryptedBytes = SecurityUtils.fromBase64(encryptedBase64);
-    if (encryptedBytes.length < opts.nonceSize + opts.tagSize)
+    const version = encryptedBytes[0];
+    const payload = encryptedBytes.slice(1);
+    const profile = CryptoProfileRegistry.getProfile(version);
+    const opts = profile.aesGcmOptions;
+    opts.validate();
+    if (payload.length < opts.nonceSize + opts.tagSize)
       throw new Error(`Invalid format: minimum expected ${opts.nonceSize + opts.tagSize} byte.`);
-    const nonce = encryptedBytes.slice(0, opts.nonceSize);
-    const ciphertextWithTag = encryptedBytes.slice(opts.nonceSize);
+    const nonce = payload.slice(0, opts.nonceSize);
+    const ciphertextWithTag = payload.slice(opts.nonceSize);
     const cryptoKey = await crypto.subtle.importKey(
       "raw",
       key,
@@ -207,9 +324,8 @@ var CryptoService = class {
     );
     try {
       let associatedData = new Uint8Array(0);
-      if (opts.associatedData != null) {
+      if (opts.associatedData != null)
         associatedData = opts.associatedData;
-      }
       const decryptedBuffer = await crypto.subtle.decrypt(
         {
           name: "AES-GCM",
@@ -226,7 +342,7 @@ var CryptoService = class {
       if (isBytes && typeof parsed === "string") {
         return SecurityUtils.fromBase64(parsed);
       }
-      return JSON.parse(jsonString);
+      return parsed;
     } catch (e) {
       console.error("Decryption error:", e);
       throw new Error("Decryption failed: authentication tag mismatch or corrupted data.");
@@ -234,83 +350,40 @@ var CryptoService = class {
   }
 };
 
-// src/crypto/kdf-options.ts
-var KdfOptions = class _KdfOptions {
-  constructor() {
-    this._pbkdf2Iterations = SecurityConstants.Pbkdf2IterationsDefault;
-    this._hashAlgorithm = "SHA-256";
-  }
-  /** PBKDF2 iteration count (minimum 100_000). */
-  get pbkdf2Iterations() {
-    return this._pbkdf2Iterations;
-  }
-  set pbkdf2Iterations(v) {
-    if (v < SecurityConstants.Pbkdf2IterationsMinimum)
-      throw new RangeError(`PBKDF2 iterations must be \u2265 ${SecurityConstants.Pbkdf2IterationsMinimum}`);
-    this._pbkdf2Iterations = v;
-  }
-  /** Hash algorithm used by PBKDF2. Must be one of {@link SupportedHashAlgorithms}. */
-  get hashAlgorithm() {
-    return this._hashAlgorithm;
-  }
-  set hashAlgorithm(v) {
-    if (!SupportedHashAlgorithms.includes(v))
-      throw new RangeError(`Unsupported hash: ${v}`);
-    this._hashAlgorithm = v;
-  }
-  /** Validates iterations and hash algorithm. */
-  validate() {
-    if (this.pbkdf2Iterations < SecurityConstants.Pbkdf2IterationsMinimum)
-      throw new Error(`Pbkdf2Iterations (${this.pbkdf2Iterations}) below minimum`);
-    if (!SupportedHashAlgorithms.includes(this.hashAlgorithm))
-      throw new Error(`Invalid hash algorithm: ${this.hashAlgorithm}`);
-  }
-  /** Default preset: SHA-256, 600_000 iterations. */
-  static get default() {
-    return new _KdfOptions();
-  }
-  /** Fluent setter for {@link pbkdf2Iterations}. */
-  withPbkdf2Iterations(i) {
-    this.pbkdf2Iterations = i;
-    return this;
-  }
-  /** Fluent setter for {@link hashAlgorithm}. */
-  withHashAlgorithm(h) {
-    this.hashAlgorithm = h;
-    return this;
-  }
-  /** Validates and returns this instance. */
-  build() {
-    this.validate();
-    return this;
-  }
-};
-
 // src/crypto/key-derivation.service.ts
 var KeyDerivationService = class {
   /**
-  * Derives KEK and Base64 AuthHash. Identity is normalized (trimmed, lowercase).
+  * Derives KEK and Base64 AuthHash. Identity is hashed as-is — caller must 
+  * normalize (trim, lowercase, etc.) before calling.
+  * @param identity - User identity (pre-normalized by caller).
   * @param identity - User identity (email, username).
   * @param password - User password.
   * @param salt - Random salt.
   * @param options - KDF configuration; uses default if omitted.
   * @returns Object with `kek` (Uint8Array) and `authHash` (Base64 string).
   */
-  async deriveKeysFromPassword(identity, password, salt, options) {
-    const opts = options ?? KdfOptions.default;
+  async deriveKeysFromPassword(identity, password, salt, version) {
+    if (!identity || identity.length === 0)
+      throw new Error("Identity cannot be null or empty.");
+    if (!password || password.trim().length === 0)
+      throw new Error("Password cannot be null or empty.");
+    if (!salt || salt.length < 16)
+      throw new Error("Salt must be at least 16 bytes.");
+    const profile = CryptoProfileRegistry.getProfile(version);
+    const opts = profile.kdfOptions;
     opts.validate();
     const safeSalt = new Uint8Array(salt);
     const encoder = new TextEncoder();
-    const normalizedLogin = identity.trim().toLowerCase();
-    const combinedPassword = `${normalizedLogin}:${password}`;
+    const combinedPassword = `${identity}:${password}`;
     const passwordBytes = encoder.encode(combinedPassword);
     const baseKey = await crypto.subtle.importKey("raw", passwordBytes, "PBKDF2", false, ["deriveBits", "deriveKey"]);
+    const hashSize = HashSizes[opts.hashAlgorithm] ?? 32;
     const masterKeyBits = await crypto.subtle.deriveBits({
       name: "PBKDF2",
       salt: safeSalt,
       iterations: opts.pbkdf2Iterations,
       hash: opts.hashAlgorithm
-    }, baseKey, SecurityConstants.KeySizeBytes * 8);
+    }, baseKey, hashSize * 8);
     const masterKey = await crypto.subtle.importKey("raw", masterKeyBits, "HKDF", false, ["deriveBits"]);
     const kek = await crypto.subtle.deriveBits(
       { name: "HKDF", hash: opts.hashAlgorithm, salt: new Uint8Array(0), info: encoder.encode("AES-GCM-KEK-v1") },
@@ -329,6 +402,8 @@ var KeyDerivationService = class {
   }
   /**
   * Derives an SRP-compatible authentication hash (output size = hash output length).
+  * Identity is hashed as-is — caller must normalize (trim, lowercase, etc.) before calling.
+  * @param identity - User identity (pre-normalized by caller).
   * @param identity - User identity.
   * @param password - User password.
   * @param salt - Random salt.
@@ -336,12 +411,18 @@ var KeyDerivationService = class {
   * @param options - KDF configuration; uses default if omitted.
   * @returns Raw hash bytes for use as SRP verifier input (x).
   */
-  async deriveAuthHashForSrp(identity, password, salt, srpHashAlgorithm, options) {
-    const opts = options ?? KdfOptions.default;
+  async deriveAuthHashForSrp(identity, password, salt, srpHashAlgorithm, version) {
+    if (!identity || identity.trim().length === 0)
+      throw new Error("Identity cannot be null or empty.");
+    if (!password || password.trim().length === 0)
+      throw new Error("Password cannot be null or empty.");
+    if (!salt || salt.length < 16)
+      throw new Error("Salt must be at least 16 bytes.");
+    const profile = CryptoProfileRegistry.getProfile(version);
+    const opts = profile.kdfOptions;
     opts.validate();
-    const srpHashSize = srpHashAlgorithm === "SHA-256" ? 32 : srpHashAlgorithm === "SHA-384" ? 48 : 64;
-    const normalizedLogin = identity.trim().toLowerCase();
-    const combinedPassword = `${normalizedLogin}:${password}`;
+    const srpHashSize = HashSizes[srpHashAlgorithm];
+    const combinedPassword = `${identity}:${password}`;
     const passwordBytes = new TextEncoder().encode(combinedPassword);
     const baseKey = await crypto.subtle.importKey(
       "raw",
@@ -355,7 +436,7 @@ var KeyDerivationService = class {
       salt,
       iterations: opts.pbkdf2Iterations,
       hash: srpHashAlgorithm
-    }, baseKey, SecurityConstants.KeySizeBytes * 8);
+    }, baseKey, srpHashSize * 8);
     const masterKey = await crypto.subtle.importKey(
       "raw",
       masterKeyBits,
@@ -378,45 +459,6 @@ var KeyDerivationService = class {
   }
 };
 
-// src/crypto/crypto-version.ts
-var CryptoVersion = /* @__PURE__ */ ((CryptoVersion2) => {
-  CryptoVersion2[CryptoVersion2["V1"] = 1] = "V1";
-  return CryptoVersion2;
-})(CryptoVersion || {});
-
-// src/crypto/crypto-profile.ts
-var CryptoProfile = class {
-  /**
-   * Creates a new CryptoProfile.
-   * @param params - Object containing version, kdfOptions, aesGcmOptions.
-   */
-  constructor(params) {
-    this.version = params.version;
-    this.kdfOptions = params.kdfOptions;
-    this.aesGcmOptions = params.aesGcmOptions;
-  }
-};
-
-// src/crypto/crypto-profile-registry.ts
-var CryptoProfileRegistry = class {
-  static getProfile(version) {
-    switch (version) {
-      case 1 /* V1 */:
-        return new CryptoProfile({
-          version: 1 /* V1 */,
-          kdfOptions: KdfOptions.default,
-          aesGcmOptions: AesGcmOptions.default
-        });
-      default:
-        throw new Error(`Unsupported crypto version: ${version}`);
-    }
-  }
-  /** Latest supported profile (currently V1). */
-  static get latest() {
-    return this.getProfile(1 /* V1 */);
-  }
-};
-
 // src/utils/srp-encoding.ts
 var SrpEncoding = class {
   /** Serializes a bigint to modulus-sized big-endian bytes. */
@@ -432,21 +474,68 @@ var SrpEncoding = class {
     const buffers = values.map((v) => this.toModulusBytes(ctx, v));
     return this.hash(ctx.hashAlgorithmName, ...buffers);
   }
-  /** Computes M1 = H(A || B || sessionKeyK). */
-  static async computeM1(ctx, A, B, sessionKeyK) {
-    return this.hash(ctx.hashAlgorithmName, this.toModulusBytes(ctx, A), this.toModulusBytes(ctx, B), sessionKeyK);
+  /**
+  * Computes the client proof M1 = H( H(N) ⊕ H(g) | H(I) | s | PAD(A) | PAD(B) | K ).
+  * 
+  * Follows RFC 5054 / SRP-6a:
+  * - H(N) and H(g) are hashed as modulus-sized values.
+  * - Identity (I) is hashed as raw UTF-8 bytes.
+  * - A and B are padded to the modulus size before hashing.
+  * - K is the session key (H(S) without padding).
+  * 
+  * @param ctx - SRP context containing N, g, hash algorithm, and modulus size.
+  * @param A - Client ephemeral public key.
+  * @param B - Server ephemeral public key.
+  * @param sessionKeyK - Session key K as raw bytes.
+  * @param identity - User identity (login). Must be pre-normalized by the caller.
+  * @param salt - User-specific salt bytes.
+  * @returns The M1 proof as raw hash bytes.
+  */
+  static async computeM1(ctx, A, B, sessionKeyK, identity, salt) {
+    const nBytes = this.toModulusBytes(ctx, ctx.N);
+    const gBytes = this.toModulusBytes(ctx, ctx.g);
+    const hashN = await this.computeHash(ctx.hashAlgorithmName, nBytes);
+    const hashG = await this.computeHash(ctx.hashAlgorithmName, gBytes);
+    const xorNg = new Uint8Array(hashN.length);
+    for (let i = 0; i < hashN.length; i++)
+      xorNg[i] = hashN[i] ^ hashG[i];
+    const encoder = new TextEncoder();
+    const hashI = await this.computeHash(ctx.hashAlgorithmName, encoder.encode(identity));
+    return this.computeHash(
+      ctx.hashAlgorithmName,
+      xorNg,
+      hashI,
+      salt,
+      this.toModulusBytes(ctx, A),
+      this.toModulusBytes(ctx, B),
+      sessionKeyK
+    );
   }
   /** Computes M2 = H(A || M1 || sessionKeyK). */
-  static async computeM2(ctx, A, M1, sessionKeyK) {
-    return this.hash(ctx.hashAlgorithmName, this.toModulusBytes(ctx, A), this.toHashBytes(ctx, M1), sessionKeyK);
+  static async computeM2(ctx, A, m1Bytes, sessionKeyK) {
+    return this.computeHash(
+      ctx.hashAlgorithmName,
+      this.toModulusBytes(ctx, A),
+      m1Bytes,
+      sessionKeyK
+    );
   }
   /** Computes session key K = H(S). */
   static async computeSessionKey(ctx, S) {
-    const sBytes = this.toModulusBytes(ctx, S);
-    const hashBuffer = await crypto.subtle.digest(
-      ctx.hashAlgorithmName,
-      sBytes
-    );
+    const sBytes = SecurityUtils.bigIntToRawBytes(S);
+    const hashBuffer = await crypto.subtle.digest(ctx.hashAlgorithmName, sBytes.buffer);
+    return new Uint8Array(hashBuffer);
+  }
+  /** Hashes bytes and returns raw Uint8Array (для M1/M2). */
+  static async computeHash(algo, ...buffers) {
+    const totalLen = buffers.reduce((sum, b) => sum + b.length, 0);
+    const combined = new Uint8Array(totalLen);
+    let offset = 0;
+    for (const buf of buffers) {
+      combined.set(buf, offset);
+      offset += buf.length;
+    }
+    const hashBuffer = await crypto.subtle.digest(algo, combined);
     return new Uint8Array(hashBuffer);
   }
   /** Concatenates byte arrays and returns the hash as bigint. */
@@ -483,22 +572,27 @@ var SrpClientService = class {
    * Generates client proof (A, M1, session key S) from server challenge.
    * @param login - User login.
    * @param password - Plaintext password.
-   * @param saltBase64 - Server salt (URL-safe Base64).
-   * @param B_base64 - Server public ephemeral B (URL-safe Base64).
+   * @param saltBase64 - Server salt (standard Base64).
+   * @param B_base64 - Server public ephemeral B (standard Base64).
    * @param ctx - SRP context.
-   * @returns Object with A, M1, S as Base64 strings.
+   * @returns Object with A and M1 as standard Base64; SessionKeyK as raw bytes.
    */
-  async generateSrpProof(login, password, saltBase64, B_base64, ctx) {
+  async generateSrpProof(login, password, saltBase64, B_base64, ctx, version) {
     const salt = SecurityUtils.fromBase64(saltBase64);
-    const authHash = await this.keyDerivation.deriveAuthHashForSrp(login, password, salt, ctx.hashAlgorithmName);
+    const authHash = await this.keyDerivation.deriveAuthHashForSrp(login, password, salt, ctx.hashAlgorithmName, version);
     const x = SecurityUtils.bytesToBigInt(authHash);
-    const aBytes = crypto.getRandomValues(new Uint8Array(32));
-    const a = SecurityUtils.bytesToBigInt(aBytes);
+    const privateKeySize = Math.max(32, Math.floor(ctx.modulusSize / 2));
+    let aBytes;
+    let a;
+    do {
+      aBytes = crypto.getRandomValues(new Uint8Array(privateKeySize));
+      a = SecurityUtils.bytesToBigInt(aBytes);
+    } while (a === 0n);
     const A = SecurityUtils.expMod(ctx.g, a, ctx.N);
-    if (A % ctx.N === 0n)
-      throw new Error("Critical error: A % N === 0");
+    if (A <= 0n || A >= ctx.N)
+      throw new Error("Invalid client public key A.");
     const B = SecurityUtils.bytesToBigInt(SecurityUtils.fromBase64(B_base64));
-    if (B % ctx.N === 0n)
+    if (B <= 0n || B >= ctx.N || B % ctx.N === 0n)
       throw new Error("Critical error: B % N === 0");
     const u = await SrpEncoding.hashModuli(ctx, A, B);
     if (u === 0n)
@@ -511,11 +605,11 @@ var SrpClientService = class {
     if (S === 0n)
       throw new Error("Critical error: S === 0");
     const sessionKeyK = await SrpEncoding.computeSessionKey(ctx, S);
-    const M1 = await SrpEncoding.computeM1(ctx, A, B, sessionKeyK);
+    const M1 = await SrpEncoding.computeM1(ctx, A, B, sessionKeyK, login, salt);
     return {
       A: SecurityUtils.toBase64(SrpEncoding.toModulusBytes(ctx, A)),
-      M1: SecurityUtils.toBase64(SrpEncoding.toHashBytes(ctx, M1)),
-      S: SecurityUtils.toBase64(SrpEncoding.toModulusBytes(ctx, S))
+      M1: SecurityUtils.toBase64(M1),
+      SessionKeyK: sessionKeyK
     };
   }
   /**
@@ -527,15 +621,12 @@ var SrpClientService = class {
    * @param ctx - SRP context.
    * @returns True if the server proof is valid.
    */
-  async verifyServerM2(A_b64, M1_b64, S_b64, serverM2_b64, ctx) {
+  async verifyServerM2(A_b64, M1_b64, sessionKeyK, serverM2_b64, ctx) {
     const A = SecurityUtils.bytesToBigInt(SecurityUtils.fromBase64(A_b64));
-    const M1 = SecurityUtils.bytesToBigInt(SecurityUtils.fromBase64(M1_b64));
-    const S = SecurityUtils.bytesToBigInt(SecurityUtils.fromBase64(S_b64));
-    const sessionKeyK = await SrpEncoding.computeSessionKey(ctx, S);
+    const M1 = SecurityUtils.fromBase64(M1_b64);
     const computedM2 = await SrpEncoding.computeM2(ctx, A, M1, sessionKeyK);
-    const computedM2Bytes = SrpEncoding.toHashBytes(ctx, computedM2);
     const serverM2Bytes = SecurityUtils.fromBase64(serverM2_b64);
-    return SecurityUtils.fixedTimeEquals(computedM2Bytes, serverM2Bytes);
+    return SecurityUtils.fixedTimeEquals(computedM2, serverM2Bytes);
   }
 };
 
@@ -548,18 +639,33 @@ var SrpServerService = class {
    * @param ctx - SRP context (hash, N, g, etc.).
    * @returns Session state with private b, verifier, and public B.
    */
-  async getSrpChallenge(login, verifierBytes, ctx) {
+  async getSrpChallenge(login, verifierBytes, salt, ctx) {
+    if (!login || login.trim().length === 0)
+      throw new Error("Login cannot be null or empty.");
+    if (!verifierBytes || verifierBytes.length === 0)
+      throw new Error("Verifier cannot be null or empty.");
     const v = SecurityUtils.bytesToBigInt(verifierBytes);
-    const bBytes = crypto.getRandomValues(new Uint8Array(32));
-    const b = SecurityUtils.bytesToBigInt(bBytes);
-    const gB = SecurityUtils.expMod(ctx.g, b, ctx.N);
-    const B = (ctx.k * v + gB) % ctx.N;
-    return {
-      login,
-      privateKeyB: SecurityUtils.toBase64(bBytes),
-      verifier: SecurityUtils.toBase64(verifierBytes),
-      publicKeyB: SecurityUtils.toBase64(SrpEncoding.toModulusBytes(ctx, B))
-    };
+    if (v <= 0n || v >= ctx.N)
+      throw new Error("The verifier is corrupted");
+    const privateKeySize = Math.max(32, Math.floor(ctx.modulusSize / 2));
+    while (true) {
+      const bBytes = crypto.getRandomValues(new Uint8Array(privateKeySize));
+      const b = SecurityUtils.bytesToBigInt(bBytes);
+      if (b === 0n) {
+        continue;
+      }
+      const gB = SecurityUtils.expMod(ctx.g, b, ctx.N);
+      const B = (ctx.k * v + gB) % ctx.N;
+      if (B !== 0n) {
+        return {
+          login,
+          privateKeyB: bBytes,
+          verifier: verifierBytes,
+          publicKeyB: SrpEncoding.toModulusBytes(ctx, B),
+          salt
+        };
+      }
+    }
   }
   /**
    * Verifies client M1 proof and returns server M2 proof.
@@ -572,29 +678,31 @@ var SrpServerService = class {
    */
   async verifySrpProof(sessionState, a, m1, ctx) {
     const A = SecurityUtils.bytesToBigInt(SecurityUtils.fromBase64(a));
-    const M1_client = SecurityUtils.bytesToBigInt(SecurityUtils.fromBase64(m1));
-    const b = SecurityUtils.bytesToBigInt(SecurityUtils.fromBase64(sessionState.privateKeyB));
-    const v = SecurityUtils.bytesToBigInt(SecurityUtils.fromBase64(sessionState.verifier));
-    const B = SecurityUtils.bytesToBigInt(SecurityUtils.fromBase64(sessionState.publicKeyB));
-    if (v <= 0n)
+    const M1_client = SecurityUtils.fromBase64(m1);
+    const b = SecurityUtils.bytesToBigInt(sessionState.privateKeyB);
+    const v = SecurityUtils.bytesToBigInt(sessionState.verifier);
+    const B = SecurityUtils.bytesToBigInt(sessionState.publicKeyB);
+    if (v <= 0n || v >= ctx.N)
       throw new Error("The verifier is corrupted");
     if (A % ctx.N === 0n)
       throw new Error("Incorrect value of A");
     if (A <= 0n || A >= ctx.N)
       throw new Error("Invalid A (out of range)");
+    if (B <= 0n || B >= ctx.N)
+      throw new Error("Invalid server public key B.");
     const u = await SrpEncoding.hashModuli(ctx, A, B);
     if (u === 0n)
       throw new Error("Error in calculating the parameter u");
     const vU = SecurityUtils.expMod(v, u, ctx.N);
     const S = SecurityUtils.expMod(A * vU % ctx.N, b, ctx.N);
+    if (S === 0n)
+      throw new Error("Critical error: shared secret S is zero (possible malicious A).");
     const sessionKeyK = await SrpEncoding.computeSessionKey(ctx, S);
-    const M1_server = await SrpEncoding.computeM1(ctx, A, B, sessionKeyK);
-    const m1ServerBytes = SrpEncoding.toHashBytes(ctx, M1_server);
-    const m1ClientBytes = SrpEncoding.toHashBytes(ctx, M1_client);
-    if (!SecurityUtils.fixedTimeEquals(m1ServerBytes, m1ClientBytes))
+    const M1_server = await SrpEncoding.computeM1(ctx, A, B, sessionKeyK, sessionState.login, sessionState.salt);
+    if (!SecurityUtils.fixedTimeEquals(M1_server, M1_client))
       throw new Error("Invalid password");
     const M2_server = await SrpEncoding.computeM2(ctx, A, M1_client, sessionKeyK);
-    return SecurityUtils.toBase64(SrpEncoding.toHashBytes(ctx, M2_server));
+    return SecurityUtils.toBase64(M2_server);
   }
 };