secure-remote-password / srp.net

SRP-6a protocol implementation for .NET Standard 1.6+ and .NET Framework 3.5+
https://www.nuget.org/packages/srp
MIT License
64 stars 10 forks source link

Feature request: Methods to validate salt/verifier on sign up #8

Closed alexrp closed 4 years ago

alexrp commented 4 years ago

Right now, I have code looking like the following when processing sign-ups on the server:

string salt = ..., verifier = ...;

var param = SrpParameters.Create8192<SHA512>();
var valid = salt.Length == param.HashSizeBytes * 2 && verifier.Length == param.PaddedLength;

try
{
    _ = new SrpInteger(salt);
    _ = new SrpInteger(verifier);
}
catch (Exception)
{
    valid = false;
}

if (valid)
{
    // Save to DB...
}

It would be convenient if the library exposed methods to do this kind of validation.

yallie commented 4 years ago

Hello @alexrp,

What's the proposed API? Something like this?

srpParameters.IsValidSalt(salt);
srpParameters.IsValidVerifier(verifier);
alexrp commented 4 years ago

That looks reasonable.

yallie commented 4 years ago

Here you are: https://www.nuget.org/packages/srp/1.0.5

if (param.IsValidSalt(salt) && param.IsValidVerifier(verifier))
{
    // Save to DB...
}