com.bitbucket.thinbus.srp6.js

Class HexHashedVerifierGenerator

java.lang.Object

com.bitbucket.thinbus.srp6.js.HexHashedVerifierGenerator

public class HexHashedVerifierGenerator
extends Object

Generates a SRP6 verifier. WARNING: You should use the JavaScript client not the Java client for generating the verifier. See the TestSRP6JavascriptClientSessionSHA256.js for an example. This class is only for systems which let users login from Java clients in addition to JavaScript clients who additionally wish to implement user registration of password reset logic in their Java clients which subsequently let users login via a browser. It is probably better to implement user registration or password rest logic only via the browser. Certainly you SHOULD to avoid this code ever being run on the server as that would require the password to be transmitted to the server which is something which SRP is designed to avoid.

Field Summary

Fields

Modifier and Type	Field and Description
protected com.nimbusds.srp6.SRP6CryptoParams	config

Constructor Summary

Constructors

Constructor and Description
HexHashedVerifierGenerator(String N, String g, String hashName)

Method Summary

Modifier and Type	Method and Description
String	generateVerifier(String salt, String identity, String password) Browser does string concat version of x = H(s | H(i | ":" | p)).

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

config

protected final com.nimbusds.srp6.SRP6CryptoParams config

Constructor Detail

HexHashedVerifierGenerator

public HexHashedVerifierGenerator(String N,
                                  String g,
                                  String hashName)

Parameters:

N - The large safe prime in radix10

g - The safe prime generator in radix10

hashName - The name of the hashing algorithm e.g. SHA256

Method Detail

generateVerifier

public String generateVerifier(String salt,
                               String identity,
                               String password)

Browser does string concat version of x = H(s | H(i | ":" | p)). Specification is RFC 5054 Which we repeat here to be able to reset the password in a java client.

Parameters:

salt - The random salt stored at user registration

identity - The user username

password - The user password. Note this should only ever be on java clients and never sent to the java server.

Returns:

An SRP password verifier