Fixed vulnerability CLP-01-016

author: Giulio Cesare Solaroli <giulio.cesare@clipperz.com> 2014-05-30 14:10:13 (UTC)
committer: Giulio Cesare Solaroli <giulio.cesare@clipperz.com> 2014-05-30 14:15:51 (UTC)
commit: 7fdb41fa2b1f621636882ad9059c1f3ecfb74083 (patch) (unidiff)
tree: 33c05ee7329d9b8e5eff79942f254d6c680ad661
parent: ed6b4edc82b0f65c77980713cd525053fcbc1dd2 (diff)
download: clipperz-7fdb41fa2b1f621636882ad9059c1f3ecfb74083.zip
clipperz-7fdb41fa2b1f621636882ad9059c1f3ecfb74083.tar.gz
clipperz-7fdb41fa2b1f621636882ad9059c1f3ecfb74083.tar.bz2
3 files changed, 125 insertions, 48 deletions
diff --git a/frontend/beta/js/Clipperz/Crypto/SRP.js b/frontend/beta/js/Clipperz/Crypto/SRP.js
index 8cc80ba..8c522ad 100644
--- a/frontend/beta/js/Clipperz/Crypto/SRP.js
+++ b/frontend/beta/js/Clipperz/Crypto/SRP.js
@@ -46,2 +46,4 @@ MochiKit.Base.update(Clipperz.Crypto.SRP, {
        '_g': null,
+        '_k': null,
+        
        //-------------------------------------------------------------------------
@@ -66,2 +68,11 @@ MochiKit.Base.update(Clipperz.Crypto.SRP, {
+        'k': function() {
+                if (Clipperz.Crypto.SRP._k == null) {
+        //              Clipperz.Crypto.SRP._k = new Clipperz.Crypto.BigInt(this.stringHash(this.n().asString() + this.g().asString()), 16);
+                        Clipperz.Crypto.SRP._k = new Clipperz.Crypto.BigInt("64398bff522814e306a97cb9bfc4364b7eed16a8c17c5208a40a2bad2933c8e", 16);
+                }
+                
+                return Clipperz.Crypto.SRP._k;
+        },
+        
        //-----------------------------------------------------------------------------
@@ -131,3 +142,2 @@ Clipperz.Crypto.SRP.Connection.prototype = MochiKit.Base.update(null, {
        //              this._a = new Clipperz.Crypto.BigInt("37532428169486597638072888476611365392249575518156687476805936694442691012367", 10);
-//MochiKit.Logging.logDebug("SRP a: " + this._a);
                }
@@ -141,10 +151,8 @@ Clipperz.Crypto.SRP.Connection.prototype = MochiKit.Base.update(null, {
                if (this._A == null) {
-                                //Warning: this value should be strictly greater than zero: how should we perform this check?
+                                //Warning: this value should be strictly greater than zero
                        this._A = Clipperz.Crypto.SRP.g().powerModule(this.a(), Clipperz.Crypto.SRP.n());
-                        
+                        if (this._A.equals(0) || negative(this._A)) {
-                        if (this._A.equals(0)) {
+                                MochiKit.Logging.logError("Clipperz.Crypto.SRP.Connection: trying to set 'A' to 0.");
-MochiKit.Logging.logError("Clipperz.Crypto.SRP.Connection: trying to set 'A' to 0.");
                                throw Clipperz.Crypto.SRP.exception.InvalidValue;
                        }
-//MochiKit.Logging.logDebug("SRP A: " + this._A);
                }
@@ -158,3 +166,2 @@ MochiKit.Logging.logError("Clipperz.Crypto.SRP.Connection: trying to set 'A' to
                return this._s;
-//MochiKit.Logging.logDebug("SRP s: " + this._S);
        },
@@ -172,8 +179,6 @@ MochiKit.Logging.logError("Clipperz.Crypto.SRP.Connection: trying to set 'A' to
        'set_B': function(aValue) {
-                        //Warning: this value should be strictly greater than zero: how should we perform this check?
+                        //Warning: this value should be strictly greater than zero
-                if (! aValue.equals(0)) {
+                this._B = aValue;
-                        this._B = aValue;
+                if (this._B.equals(0) || negative(this._B)) {
-//MochiKit.Logging.logDebug("SRP B: " + this._B);
+                        MochiKit.Logging.logError("Clipperz.Crypto.SRP.Connection: trying to set 'B' to 0.");
-                } else {
-MochiKit.Logging.logError("Clipperz.Crypto.SRP.Connection: trying to set 'B' to 0.");
                        throw Clipperz.Crypto.SRP.exception.InvalidValue;
@@ -187,3 +192,2 @@ MochiKit.Logging.logError("Clipperz.Crypto.SRP.Connection: trying to set 'B' to
                        this._x = new Clipperz.Crypto.BigInt(this.stringHash(this.s().asString(16, 64) + this.P()), 16);
-//MochiKit.Logging.logDebug("SRP x: " + this._x);
                }
@@ -197,4 +201,3 @@ MochiKit.Logging.logError("Clipperz.Crypto.SRP.Connection: trying to set 'B' to
                if (this._u == null) {
-                        this._u = new Clipperz.Crypto.BigInt(this.stringHash(this.B().asString()), 16);
+                        this._u = new Clipperz.Crypto.BigInt(this.stringHash(this.A().asString() + this.B().asString()), 16);
-//MochiKit.Logging.logDebug("SRP u: " + this._u);
                }
@@ -215,7 +218,12 @@ MochiKit.Logging.logError("Clipperz.Crypto.SRP.Connection: trying to set 'B' to
                                this._S =bigint.powerModule(
-                                                                bigint.subtract(this.B(), bigint.powerModule(srp.g(), this.x(), srp.n())),
+                                                        bigint.subtract(
-                                                                bigint.add(this.a(), bigint.multiply(this.u(), this.x())),
+                                                                this.B(),
-                                                                srp.n()
+                                                                bigint.multiply(
+                                                                        Clipperz.Crypto.SRP.k(),
+                                                                        bigint.powerModule(srp.g(), this.x(), srp.n())
+                                                                )
+                                                        ),
+                                                        bigint.add(this.a(), bigint.multiply(this.u(), this.x())),
+                                                        srp.n()
                                                )
-//MochiKit.Logging.logDebug("SRP S: " + this._S);
                }
@@ -230,3 +238,2 @@ MochiKit.Logging.logError("Clipperz.Crypto.SRP.Connection: trying to set 'B' to
                        this._K = this.stringHash(this.S().asString());
-//MochiKit.Logging.logDebug("SRP K: " + this._K);
                }
@@ -240,4 +247,16 @@ MochiKit.Logging.logError("Clipperz.Crypto.SRP.Connection: trying to set 'B' to
                if (this._M1 == null) {
-                        this._M1 = this.stringHash(this.A().asString(10) + this.B().asString(10) + this.K());
+        //              this._M1 = this.stringHash(this.A().asString(10) + this.B().asString(10) + this.K());
-//MochiKit.Logging.logDebug("SRP M1: " + this._M1);
+                                //http://srp.stanford.edu/design.html
+                                //User -> Host:  M = H(H(N) xor H(g), H(I), s, A, B, K)
+                        this._M1 = this.stringHash(
+                                "597626870978286801440197562148588907434001483655788865609375806439877501869636875571920406529" +
+                                this.stringHash(this.C()) +
+                                this.s().asString() +
+                                this.A().asString() +
+                                this.B().asString() +
+                                this.K()
+                        );
+//console.log("M1", this._M1);
                }
@@ -252,3 +271,3 @@ MochiKit.Logging.logError("Clipperz.Crypto.SRP.Connection: trying to set 'B' to
                        this._M2 = this.stringHash(this.A().asString(10) + this.M1() + this.K());
-//MochiKit.Logging.logDebug("SRP M2: " + this._M2);
+//console.log("M2", this._M2);
                }
diff --git a/frontend/delta/js/Clipperz/Crypto/SRP.js b/frontend/delta/js/Clipperz/Crypto/SRP.js
index 597e72d..6898dfb 100644
--- a/frontend/delta/js/Clipperz/Crypto/SRP.js
+++ b/frontend/delta/js/Clipperz/Crypto/SRP.js
@@ -46,2 +46,4 @@ MochiKit.Base.update(Clipperz.Crypto.SRP, {
        '_g': null,
+        '_k': null,
+        
        //-------------------------------------------------------------------------
@@ -66,2 +68,11 @@ MochiKit.Base.update(Clipperz.Crypto.SRP, {
+        'k': function() {
+                if (Clipperz.Crypto.SRP._k == null) {
+        //              Clipperz.Crypto.SRP._k = new Clipperz.Crypto.BigInt(this.stringHash(this.n().asString() + this.g().asString()), 16);
+                        Clipperz.Crypto.SRP._k = new Clipperz.Crypto.BigInt("64398bff522814e306a97cb9bfc4364b7eed16a8c17c5208a40a2bad2933c8e", 16);
+                }
+                
+                return Clipperz.Crypto.SRP._k;
+        },
+        
        //-----------------------------------------------------------------------------
@@ -140,6 +151,5 @@ Clipperz.Crypto.SRP.Connection.prototype = MochiKit.Base.update(null, {
                if (this._A == null) {
-                                //Warning: this value should be strictly greater than zero: how should we perform this check?
+                                //Warning: this value should be strictly greater than zero
                        this._A = Clipperz.Crypto.SRP.g().powerModule(this.a(), Clipperz.Crypto.SRP.n());
-                        
+                        if (this._A.equals(0) || negative(this._A)) {
-                        if (this._A.equals(0)) {
                                Clipperz.logError("Clipperz.Crypto.SRP.Connection: trying to set 'A' to 0.");
@@ -169,6 +179,5 @@ Clipperz.Crypto.SRP.Connection.prototype = MochiKit.Base.update(null, {
        'set_B': function(aValue) {
-                        //Warning: this value should be strictly greater than zero: how should we perform this check?
+                        //Warning: this value should be strictly greater than zero
-                if (! aValue.equals(0)) {
+                this._B = aValue;
-                        this._B = aValue;
+                if (this._B.equals(0) || negative(this._B)) {
-                } else {
                        Clipperz.logError("Clipperz.Crypto.SRP.Connection: trying to set 'B' to 0.");
@@ -192,3 +201,3 @@ Clipperz.Crypto.SRP.Connection.prototype = MochiKit.Base.update(null, {
                if (this._u == null) {
-                        this._u = new Clipperz.Crypto.BigInt(this.stringHash(this.B().asString()), 16);
+                        this._u = new Clipperz.Crypto.BigInt(this.stringHash(this.A().asString() + this.B().asString()), 16);
                }
@@ -209,5 +218,11 @@ Clipperz.Crypto.SRP.Connection.prototype = MochiKit.Base.update(null, {
                                this._S =bigint.powerModule(
-                                                                bigint.subtract(this.B(), bigint.powerModule(srp.g(), this.x(), srp.n())),
+                                                        bigint.subtract(
-                                                                bigint.add(this.a(), bigint.multiply(this.u(), this.x())),
+                                                                this.B(),
-                                                                srp.n()
+                                                                bigint.multiply(
+                                                                        Clipperz.Crypto.SRP.k(),
+                                                                        bigint.powerModule(srp.g(), this.x(), srp.n())
+                                                                )
+                                                        ),
+                                                        bigint.add(this.a(), bigint.multiply(this.u(), this.x())),
+                                                        srp.n()
                                                )
@@ -232,3 +247,16 @@ Clipperz.Crypto.SRP.Connection.prototype = MochiKit.Base.update(null, {
                if (this._M1 == null) {
-                        this._M1 = this.stringHash(this.A().asString(10) + this.B().asString(10) + this.K());
+        //              this._M1 = this.stringHash(this.A().asString(10) + this.B().asString(10) + this.K());
+                                //http://srp.stanford.edu/design.html
+                                //User -> Host:  M = H(H(N) xor H(g), H(I), s, A, B, K)
+                        this._M1 = this.stringHash(
+                                "597626870978286801440197562148588907434001483655788865609375806439877501869636875571920406529" +
+                                this.stringHash(this.C()) +
+                                this.s().asString() +
+                                this.A().asString() +
+                                this.B().asString() +
+                                this.K()
+                        );
+//console.log("M1", this._M1);
                }
@@ -243,2 +271,3 @@ Clipperz.Crypto.SRP.Connection.prototype = MochiKit.Base.update(null, {
                        this._M2 = this.stringHash(this.A().asString(10) + this.M1() + this.K());
+//console.log("M2", this._M2);
                }
diff --git a/frontend/gamma/js/Clipperz/Crypto/SRP.js b/frontend/gamma/js/Clipperz/Crypto/SRP.js
index 597e72d..6898dfb 100644
--- a/frontend/gamma/js/Clipperz/Crypto/SRP.js
+++ b/frontend/gamma/js/Clipperz/Crypto/SRP.js
@@ -46,2 +46,4 @@ MochiKit.Base.update(Clipperz.Crypto.SRP, {
        '_g': null,
+        '_k': null,
+        
        //-------------------------------------------------------------------------
@@ -66,2 +68,11 @@ MochiKit.Base.update(Clipperz.Crypto.SRP, {
+        'k': function() {
+                if (Clipperz.Crypto.SRP._k == null) {
+        //              Clipperz.Crypto.SRP._k = new Clipperz.Crypto.BigInt(this.stringHash(this.n().asString() + this.g().asString()), 16);
+                        Clipperz.Crypto.SRP._k = new Clipperz.Crypto.BigInt("64398bff522814e306a97cb9bfc4364b7eed16a8c17c5208a40a2bad2933c8e", 16);
+                }
+                
+                return Clipperz.Crypto.SRP._k;
+        },
+        
        //-----------------------------------------------------------------------------
@@ -140,6 +151,5 @@ Clipperz.Crypto.SRP.Connection.prototype = MochiKit.Base.update(null, {
                if (this._A == null) {
-                                //Warning: this value should be strictly greater than zero: how should we perform this check?
+                                //Warning: this value should be strictly greater than zero
                        this._A = Clipperz.Crypto.SRP.g().powerModule(this.a(), Clipperz.Crypto.SRP.n());
-                        
+                        if (this._A.equals(0) || negative(this._A)) {
-                        if (this._A.equals(0)) {
                                Clipperz.logError("Clipperz.Crypto.SRP.Connection: trying to set 'A' to 0.");
@@ -169,6 +179,5 @@ Clipperz.Crypto.SRP.Connection.prototype = MochiKit.Base.update(null, {
        'set_B': function(aValue) {
-                        //Warning: this value should be strictly greater than zero: how should we perform this check?
+                        //Warning: this value should be strictly greater than zero
-                if (! aValue.equals(0)) {
+                this._B = aValue;
-                        this._B = aValue;
+                if (this._B.equals(0) || negative(this._B)) {
-                } else {
                        Clipperz.logError("Clipperz.Crypto.SRP.Connection: trying to set 'B' to 0.");
@@ -192,3 +201,3 @@ Clipperz.Crypto.SRP.Connection.prototype = MochiKit.Base.update(null, {
                if (this._u == null) {
-                        this._u = new Clipperz.Crypto.BigInt(this.stringHash(this.B().asString()), 16);
+                        this._u = new Clipperz.Crypto.BigInt(this.stringHash(this.A().asString() + this.B().asString()), 16);
                }
@@ -209,5 +218,11 @@ Clipperz.Crypto.SRP.Connection.prototype = MochiKit.Base.update(null, {
                                this._S =bigint.powerModule(
-                                                                bigint.subtract(this.B(), bigint.powerModule(srp.g(), this.x(), srp.n())),
+                                                        bigint.subtract(
-                                                                bigint.add(this.a(), bigint.multiply(this.u(), this.x())),
+                                                                this.B(),
-                                                                srp.n()
+                                                                bigint.multiply(
+                                                                        Clipperz.Crypto.SRP.k(),
+                                                                        bigint.powerModule(srp.g(), this.x(), srp.n())
+                                                                )
+                                                        ),
+                                                        bigint.add(this.a(), bigint.multiply(this.u(), this.x())),
+                                                        srp.n()
                                                )
@@ -232,3 +247,16 @@ Clipperz.Crypto.SRP.Connection.prototype = MochiKit.Base.update(null, {
                if (this._M1 == null) {
-                        this._M1 = this.stringHash(this.A().asString(10) + this.B().asString(10) + this.K());
+        //              this._M1 = this.stringHash(this.A().asString(10) + this.B().asString(10) + this.K());
+                                //http://srp.stanford.edu/design.html
+                                //User -> Host:  M = H(H(N) xor H(g), H(I), s, A, B, K)
+                        this._M1 = this.stringHash(
+                                "597626870978286801440197562148588907434001483655788865609375806439877501869636875571920406529" +
+                                this.stringHash(this.C()) +
+                                this.s().asString() +
+                                this.A().asString() +
+                                this.B().asString() +
+                                this.K()
+                        );
+//console.log("M1", this._M1);
                }
@@ -243,2 +271,3 @@ Clipperz.Crypto.SRP.Connection.prototype = MochiKit.Base.update(null, {
                        this._M2 = this.stringHash(this.A().asString(10) + this.M1() + this.K());
+//console.log("M2", this._M2);
                }
author	Giulio Cesare Solaroli <giulio.cesare@clipperz.com>	2014-05-30 14:10:13 (UTC)
committer	Giulio Cesare Solaroli <giulio.cesare@clipperz.com>	2014-05-30 14:15:51 (UTC)
commit	7fdb41fa2b1f621636882ad9059c1f3ecfb74083 (patch) (unidiff)
tree	33c05ee7329d9b8e5eff79942f254d6c680ad661
parent	ed6b4edc82b0f65c77980713cd525053fcbc1dd2 (diff)
download	clipperz-7fdb41fa2b1f621636882ad9059c1f3ecfb74083.zip clipperz-7fdb41fa2b1f621636882ad9059c1f3ecfb74083.tar.gz clipperz-7fdb41fa2b1f621636882ad9059c1f3ecfb74083.tar.bz2

diff --git a/frontend/beta/js/Clipperz/Crypto/SRP.js b/frontend/beta/js/Clipperz/Crypto/SRP.js index 8cc80ba..8c522ad 100644 --- a/frontend/beta/js/Clipperz/Crypto/SRP.js +++ b/frontend/beta/js/Clipperz/Crypto/SRP.js
@@ -46,2 +46,4 @@ MochiKit.Base.update(Clipperz.Crypto.SRP, {
46	'_g': null,	46	'_g': null,
		47	'_k': null,
		48
47	//-------------------------------------------------------------------------	49	//-------------------------------------------------------------------------
@@ -66,2 +68,11 @@ MochiKit.Base.update(Clipperz.Crypto.SRP, {
66		68
		69	'k': function() {
		70	if (Clipperz.Crypto.SRP._k == null) {
		71	// Clipperz.Crypto.SRP._k = new Clipperz.Crypto.BigInt(this.stringHash(this.n().asString() + this.g().asString()), 16);
		72	Clipperz.Crypto.SRP._k = new Clipperz.Crypto.BigInt("64398bff522814e306a97cb9bfc4364b7eed16a8c17c5208a40a2bad2933c8e", 16);
		73	}
		74
		75	return Clipperz.Crypto.SRP._k;
		76	},
		77
67	//-----------------------------------------------------------------------------	78	//-----------------------------------------------------------------------------
@@ -131,3 +142,2 @@ Clipperz.Crypto.SRP.Connection.prototype = MochiKit.Base.update(null, {
131	// this._a = new Clipperz.Crypto.BigInt("37532428169486597638072888476611365392249575518156687476805936694442691012367", 10);	142	// this._a = new Clipperz.Crypto.BigInt("37532428169486597638072888476611365392249575518156687476805936694442691012367", 10);
132	//MochiKit.Logging.logDebug("SRP a: " + this._a);
133	}	143	}
@@ -141,10 +151,8 @@ Clipperz.Crypto.SRP.Connection.prototype = MochiKit.Base.update(null, {
141	if (this._A == null) {	151	if (this._A == null) {
142	//Warning: this value should be strictly greater than zero: how should we perform this check?	152	//Warning: this value should be strictly greater than zero
143	this._A = Clipperz.Crypto.SRP.g().powerModule(this.a(), Clipperz.Crypto.SRP.n());	153	this._A = Clipperz.Crypto.SRP.g().powerModule(this.a(), Clipperz.Crypto.SRP.n());
144		154	if (this._A.equals(0) \|\| negative(this._A)) {
145	if (this._A.equals(0)) {	155	MochiKit.Logging.logError("Clipperz.Crypto.SRP.Connection: trying to set 'A' to 0.");
146	MochiKit.Logging.logError("Clipperz.Crypto.SRP.Connection: trying to set 'A' to 0.");
147	throw Clipperz.Crypto.SRP.exception.InvalidValue;	156	throw Clipperz.Crypto.SRP.exception.InvalidValue;
148	}	157	}
149	//MochiKit.Logging.logDebug("SRP A: " + this._A);
150	}	158	}
@@ -158,3 +166,2 @@ MochiKit.Logging.logError("Clipperz.Crypto.SRP.Connection: trying to set 'A' to
158	return this._s;	166	return this._s;
159	//MochiKit.Logging.logDebug("SRP s: " + this._S);
160	},	167	},
@@ -172,8 +179,6 @@ MochiKit.Logging.logError("Clipperz.Crypto.SRP.Connection: trying to set 'A' to
172	'set_B': function(aValue) {	179	'set_B': function(aValue) {
173	//Warning: this value should be strictly greater than zero: how should we perform this check?	180	//Warning: this value should be strictly greater than zero
174	if (! aValue.equals(0)) {	181	this._B = aValue;
175	this._B = aValue;	182	if (this._B.equals(0) \|\| negative(this._B)) {
176	//MochiKit.Logging.logDebug("SRP B: " + this._B);	183	MochiKit.Logging.logError("Clipperz.Crypto.SRP.Connection: trying to set 'B' to 0.");
177	} else {
178	MochiKit.Logging.logError("Clipperz.Crypto.SRP.Connection: trying to set 'B' to 0.");
179	throw Clipperz.Crypto.SRP.exception.InvalidValue;	184	throw Clipperz.Crypto.SRP.exception.InvalidValue;
@@ -187,3 +192,2 @@ MochiKit.Logging.logError("Clipperz.Crypto.SRP.Connection: trying to set 'B' to
187	this._x = new Clipperz.Crypto.BigInt(this.stringHash(this.s().asString(16, 64) + this.P()), 16);	192	this._x = new Clipperz.Crypto.BigInt(this.stringHash(this.s().asString(16, 64) + this.P()), 16);
188	//MochiKit.Logging.logDebug("SRP x: " + this._x);
189	}	193	}
@@ -197,4 +201,3 @@ MochiKit.Logging.logError("Clipperz.Crypto.SRP.Connection: trying to set 'B' to
197	if (this._u == null) {	201	if (this._u == null) {
198	this._u = new Clipperz.Crypto.BigInt(this.stringHash(this.B().asString()), 16);	202	this._u = new Clipperz.Crypto.BigInt(this.stringHash(this.A().asString() + this.B().asString()), 16);
199	//MochiKit.Logging.logDebug("SRP u: " + this._u);
200	}	203	}
@@ -215,7 +218,12 @@ MochiKit.Logging.logError("Clipperz.Crypto.SRP.Connection: trying to set 'B' to
215	this._S =bigint.powerModule(	218	this._S =bigint.powerModule(
216	bigint.subtract(this.B(), bigint.powerModule(srp.g(), this.x(), srp.n())),	219	bigint.subtract(
217	bigint.add(this.a(), bigint.multiply(this.u(), this.x())),	220	this.B(),
218	srp.n()	221	bigint.multiply(
		222	Clipperz.Crypto.SRP.k(),
		223	bigint.powerModule(srp.g(), this.x(), srp.n())
		224	)
		225	),
		226	bigint.add(this.a(), bigint.multiply(this.u(), this.x())),
		227	srp.n()
219	)	228	)
220	//MochiKit.Logging.logDebug("SRP S: " + this._S);
221	}	229	}
@@ -230,3 +238,2 @@ MochiKit.Logging.logError("Clipperz.Crypto.SRP.Connection: trying to set 'B' to
230	this._K = this.stringHash(this.S().asString());	238	this._K = this.stringHash(this.S().asString());
231	//MochiKit.Logging.logDebug("SRP K: " + this._K);
232	}	239	}
@@ -240,4 +247,16 @@ MochiKit.Logging.logError("Clipperz.Crypto.SRP.Connection: trying to set 'B' to
240	if (this._M1 == null) {	247	if (this._M1 == null) {
241	this._M1 = this.stringHash(this.A().asString(10) + this.B().asString(10) + this.K());	248	// this._M1 = this.stringHash(this.A().asString(10) + this.B().asString(10) + this.K());
242	//MochiKit.Logging.logDebug("SRP M1: " + this._M1);	249
		250	//http://srp.stanford.edu/design.html
		251	//User -> Host: M = H(H(N) xor H(g), H(I), s, A, B, K)
		252
		253	this._M1 = this.stringHash(
		254	"597626870978286801440197562148588907434001483655788865609375806439877501869636875571920406529" +
		255	this.stringHash(this.C()) +
		256	this.s().asString() +
		257	this.A().asString() +
		258	this.B().asString() +
		259	this.K()
		260	);
		261	//console.log("M1", this._M1);
243	}	262	}
@@ -252,3 +271,3 @@ MochiKit.Logging.logError("Clipperz.Crypto.SRP.Connection: trying to set 'B' to
252	this._M2 = this.stringHash(this.A().asString(10) + this.M1() + this.K());	271	this._M2 = this.stringHash(this.A().asString(10) + this.M1() + this.K());
253	//MochiKit.Logging.logDebug("SRP M2: " + this._M2);	272	//console.log("M2", this._M2);
254	}	273	}


diff --git a/frontend/delta/js/Clipperz/Crypto/SRP.js b/frontend/delta/js/Clipperz/Crypto/SRP.js index 597e72d..6898dfb 100644 --- a/frontend/delta/js/Clipperz/Crypto/SRP.js +++ b/frontend/delta/js/Clipperz/Crypto/SRP.js
@@ -46,2 +46,4 @@ MochiKit.Base.update(Clipperz.Crypto.SRP, {
46	'_g': null,	46	'_g': null,
		47	'_k': null,
		48
47	//-------------------------------------------------------------------------	49	//-------------------------------------------------------------------------
@@ -66,2 +68,11 @@ MochiKit.Base.update(Clipperz.Crypto.SRP, {
66		68
		69	'k': function() {
		70	if (Clipperz.Crypto.SRP._k == null) {
		71	// Clipperz.Crypto.SRP._k = new Clipperz.Crypto.BigInt(this.stringHash(this.n().asString() + this.g().asString()), 16);
		72	Clipperz.Crypto.SRP._k = new Clipperz.Crypto.BigInt("64398bff522814e306a97cb9bfc4364b7eed16a8c17c5208a40a2bad2933c8e", 16);
		73	}
		74
		75	return Clipperz.Crypto.SRP._k;
		76	},
		77
67	//-----------------------------------------------------------------------------	78	//-----------------------------------------------------------------------------
@@ -140,6 +151,5 @@ Clipperz.Crypto.SRP.Connection.prototype = MochiKit.Base.update(null, {
140	if (this._A == null) {	151	if (this._A == null) {
141	//Warning: this value should be strictly greater than zero: how should we perform this check?	152	//Warning: this value should be strictly greater than zero
142	this._A = Clipperz.Crypto.SRP.g().powerModule(this.a(), Clipperz.Crypto.SRP.n());	153	this._A = Clipperz.Crypto.SRP.g().powerModule(this.a(), Clipperz.Crypto.SRP.n());
143		154	if (this._A.equals(0) \|\| negative(this._A)) {
144	if (this._A.equals(0)) {
145	Clipperz.logError("Clipperz.Crypto.SRP.Connection: trying to set 'A' to 0.");	155	Clipperz.logError("Clipperz.Crypto.SRP.Connection: trying to set 'A' to 0.");
@@ -169,6 +179,5 @@ Clipperz.Crypto.SRP.Connection.prototype = MochiKit.Base.update(null, {
169	'set_B': function(aValue) {	179	'set_B': function(aValue) {
170	//Warning: this value should be strictly greater than zero: how should we perform this check?	180	//Warning: this value should be strictly greater than zero
171	if (! aValue.equals(0)) {	181	this._B = aValue;
172	this._B = aValue;	182	if (this._B.equals(0) \|\| negative(this._B)) {
173	} else {
174	Clipperz.logError("Clipperz.Crypto.SRP.Connection: trying to set 'B' to 0.");	183	Clipperz.logError("Clipperz.Crypto.SRP.Connection: trying to set 'B' to 0.");
@@ -192,3 +201,3 @@ Clipperz.Crypto.SRP.Connection.prototype = MochiKit.Base.update(null, {
192	if (this._u == null) {	201	if (this._u == null) {
193	this._u = new Clipperz.Crypto.BigInt(this.stringHash(this.B().asString()), 16);	202	this._u = new Clipperz.Crypto.BigInt(this.stringHash(this.A().asString() + this.B().asString()), 16);
194	}	203	}
@@ -209,5 +218,11 @@ Clipperz.Crypto.SRP.Connection.prototype = MochiKit.Base.update(null, {
209	this._S =bigint.powerModule(	218	this._S =bigint.powerModule(
210	bigint.subtract(this.B(), bigint.powerModule(srp.g(), this.x(), srp.n())),	219	bigint.subtract(
211	bigint.add(this.a(), bigint.multiply(this.u(), this.x())),	220	this.B(),
212	srp.n()	221	bigint.multiply(
		222	Clipperz.Crypto.SRP.k(),
		223	bigint.powerModule(srp.g(), this.x(), srp.n())
		224	)
		225	),
		226	bigint.add(this.a(), bigint.multiply(this.u(), this.x())),
		227	srp.n()
213	)	228	)
@@ -232,3 +247,16 @@ Clipperz.Crypto.SRP.Connection.prototype = MochiKit.Base.update(null, {
232	if (this._M1 == null) {	247	if (this._M1 == null) {
233	this._M1 = this.stringHash(this.A().asString(10) + this.B().asString(10) + this.K());	248	// this._M1 = this.stringHash(this.A().asString(10) + this.B().asString(10) + this.K());
		249
		250	//http://srp.stanford.edu/design.html
		251	//User -> Host: M = H(H(N) xor H(g), H(I), s, A, B, K)
		252
		253	this._M1 = this.stringHash(
		254	"597626870978286801440197562148588907434001483655788865609375806439877501869636875571920406529" +
		255	this.stringHash(this.C()) +
		256	this.s().asString() +
		257	this.A().asString() +
		258	this.B().asString() +
		259	this.K()
		260	);
		261	//console.log("M1", this._M1);
234	}	262	}
@@ -243,2 +271,3 @@ Clipperz.Crypto.SRP.Connection.prototype = MochiKit.Base.update(null, {
243	this._M2 = this.stringHash(this.A().asString(10) + this.M1() + this.K());	271	this._M2 = this.stringHash(this.A().asString(10) + this.M1() + this.K());
		272	//console.log("M2", this._M2);
244	}	273	}


diff --git a/frontend/gamma/js/Clipperz/Crypto/SRP.js b/frontend/gamma/js/Clipperz/Crypto/SRP.js index 597e72d..6898dfb 100644 --- a/frontend/gamma/js/Clipperz/Crypto/SRP.js +++ b/frontend/gamma/js/Clipperz/Crypto/SRP.js
@@ -46,2 +46,4 @@ MochiKit.Base.update(Clipperz.Crypto.SRP, {
46	'_g': null,	46	'_g': null,
		47	'_k': null,
		48
47	//-------------------------------------------------------------------------	49	//-------------------------------------------------------------------------
@@ -66,2 +68,11 @@ MochiKit.Base.update(Clipperz.Crypto.SRP, {
66		68
		69	'k': function() {
		70	if (Clipperz.Crypto.SRP._k == null) {
		71	// Clipperz.Crypto.SRP._k = new Clipperz.Crypto.BigInt(this.stringHash(this.n().asString() + this.g().asString()), 16);
		72	Clipperz.Crypto.SRP._k = new Clipperz.Crypto.BigInt("64398bff522814e306a97cb9bfc4364b7eed16a8c17c5208a40a2bad2933c8e", 16);
		73	}
		74
		75	return Clipperz.Crypto.SRP._k;
		76	},
		77
67	//-----------------------------------------------------------------------------	78	//-----------------------------------------------------------------------------
@@ -140,6 +151,5 @@ Clipperz.Crypto.SRP.Connection.prototype = MochiKit.Base.update(null, {
140	if (this._A == null) {	151	if (this._A == null) {
141	//Warning: this value should be strictly greater than zero: how should we perform this check?	152	//Warning: this value should be strictly greater than zero
142	this._A = Clipperz.Crypto.SRP.g().powerModule(this.a(), Clipperz.Crypto.SRP.n());	153	this._A = Clipperz.Crypto.SRP.g().powerModule(this.a(), Clipperz.Crypto.SRP.n());
143		154	if (this._A.equals(0) \|\| negative(this._A)) {
144	if (this._A.equals(0)) {
145	Clipperz.logError("Clipperz.Crypto.SRP.Connection: trying to set 'A' to 0.");	155	Clipperz.logError("Clipperz.Crypto.SRP.Connection: trying to set 'A' to 0.");
@@ -169,6 +179,5 @@ Clipperz.Crypto.SRP.Connection.prototype = MochiKit.Base.update(null, {
169	'set_B': function(aValue) {	179	'set_B': function(aValue) {
170	//Warning: this value should be strictly greater than zero: how should we perform this check?	180	//Warning: this value should be strictly greater than zero
171	if (! aValue.equals(0)) {	181	this._B = aValue;
172	this._B = aValue;	182	if (this._B.equals(0) \|\| negative(this._B)) {
173	} else {
174	Clipperz.logError("Clipperz.Crypto.SRP.Connection: trying to set 'B' to 0.");	183	Clipperz.logError("Clipperz.Crypto.SRP.Connection: trying to set 'B' to 0.");
@@ -192,3 +201,3 @@ Clipperz.Crypto.SRP.Connection.prototype = MochiKit.Base.update(null, {
192	if (this._u == null) {	201	if (this._u == null) {
193	this._u = new Clipperz.Crypto.BigInt(this.stringHash(this.B().asString()), 16);	202	this._u = new Clipperz.Crypto.BigInt(this.stringHash(this.A().asString() + this.B().asString()), 16);
194	}	203	}
@@ -209,5 +218,11 @@ Clipperz.Crypto.SRP.Connection.prototype = MochiKit.Base.update(null, {
209	this._S =bigint.powerModule(	218	this._S =bigint.powerModule(
210	bigint.subtract(this.B(), bigint.powerModule(srp.g(), this.x(), srp.n())),	219	bigint.subtract(
211	bigint.add(this.a(), bigint.multiply(this.u(), this.x())),	220	this.B(),
212	srp.n()	221	bigint.multiply(
		222	Clipperz.Crypto.SRP.k(),
		223	bigint.powerModule(srp.g(), this.x(), srp.n())
		224	)
		225	),
		226	bigint.add(this.a(), bigint.multiply(this.u(), this.x())),
		227	srp.n()
213	)	228	)
@@ -232,3 +247,16 @@ Clipperz.Crypto.SRP.Connection.prototype = MochiKit.Base.update(null, {
232	if (this._M1 == null) {	247	if (this._M1 == null) {
233	this._M1 = this.stringHash(this.A().asString(10) + this.B().asString(10) + this.K());	248	// this._M1 = this.stringHash(this.A().asString(10) + this.B().asString(10) + this.K());
		249
		250	//http://srp.stanford.edu/design.html
		251	//User -> Host: M = H(H(N) xor H(g), H(I), s, A, B, K)
		252
		253	this._M1 = this.stringHash(
		254	"597626870978286801440197562148588907434001483655788865609375806439877501869636875571920406529" +
		255	this.stringHash(this.C()) +
		256	this.s().asString() +
		257	this.A().asString() +
		258	this.B().asString() +
		259	this.K()
		260	);
		261	//console.log("M1", this._M1);
234	}	262	}
@@ -243,2 +271,3 @@ Clipperz.Crypto.SRP.Connection.prototype = MochiKit.Base.update(null, {
243	this._M2 = this.stringHash(this.A().asString(10) + this.M1() + this.K());	271	this._M2 = this.stringHash(this.A().asString(10) + this.M1() + this.K());
		272	//console.log("M2", this._M2);
244	}	273	}