search

midonet / tssrp6a

This library is a dependency free TypeScript implementation of Secure Remote Password SRP6a.
MIT License
36 stars 8 forks source link

Should support user provided hashes not included in CryptoJS #53

Closed jbis9051 closed 3 years ago

jbis9051 commented 3 years ago

CryptoJS supports a couple different KDF algorithms. However, it does not support many algorithms that could be useful for SRP. For example, 1Password uses PBKDF2. Another good option would be Argon2. The project should probably add support for the user to pass a custom hash function. We could still include the most common ones as we do.

https://github.com/midonet/tssrp6a/blob/bda8890715f56154084b9e010c1837436a4e9218/src/parameters.ts#L46-L50

bgrosse-midokura commented 3 years ago

I was playing around a bit, and to me it seems like that in order to be able to provide generic hash fn, the type of "hash value" must be genericized. Or maybe some other type magic will do the trick. Currently it's that HashWordArray / CryptoJS.LibWordArray.

bgrosse-midokura commented 3 years ago

Or maybe we can get away with passing around bigints everywhere.

bgrosse-midokura commented 3 years ago

I'm trying with only bigints, the nimbus reference test fails :disappointed:

bgrosse-midokura commented 3 years ago

Ok I got it to work, but the "identiyHash" value must be a CryptoJS.LibWordArray or the nimbus test fails. I got around the type system with using unknown for that value, I'm on the fence of trying with generics.