Alexey Yachmenov <[email protected]>
这是基于 安全远程密码协议 (SRP-6a) 的 Objective-C 实现。基于 csrp 库。
SRP 是一种基于密码的安全身份验证和密钥交换协议。它在用户必须记住一个小的秘密（如密码）并且没有携带其他秘密信息的情况下，解决了客户端到服务器的安全认证问题，同时在服务器端为每个用户携带一个验证器，允许其验证客户端，但如果验证器被泄露，则不会允许攻击者冒充客户端。此外，SRP 在成功身份验证过程中交换一个密码学上强大的秘密，使双方能够安全地通信。
// private constants
NSString *N = @"115b8b692e0e045692cf280b436735c77a5a9e8a9e7ed56c965f87db5b2a2ece3";
NSString *g = @"02";
ALOSRPPrivateData *privateData = [ALOSRPPrivateData privateDataWithN:N g:g];
// init autentification with constants & login, password
ALOSRPAuth *auth = [[ALOSRPAuth alloc] initWithPrivateData:privateData
login:self.loginField.text
password:self.passwordField.text];
[auth startAuthorization];
// generate A
NSString *aBytes = [auth aBytesBase64];
if (auth.error) return;
// TODO: here we send login, A and receive salt & B from server
NSData *salt = [[NSData alloc] initWithBase64EncodedString:@"VgUNyWfG/ZzavL7JEUdwCsto7+w=" options:NSDataBase64DecodingIgnoreUnknownCharacters];
NSData *bBytes = [[NSData alloc] initWithBase64EncodedString:@"AunqLMG6ymWNmtJ9Keg3f+/cqnywqLQgghOfelhKSXg=" options:NSDataBase64DecodingIgnoreUnknownCharacters];
// Check B size
if (bBytes.length == 0) {
NSLog(@"Verifier SRP-6a safety check violated!");
return;
}
[auth setSalt:salt];
[auth setB:bBytes];
// calculate session key & M
NSString *mBytes = [auth mBytesBase64];
NSString *sessionKey = [auth sessionKeyBase64];
if (auth.error) return;
// TODO: here we send M and receive R from server
NSData *rBytes = [NSData data];
// Check R size & validate it (can't test without server)
if (rBytes.length > 0 && [auth validateR:rBytes]) {
NSLog(@"Succes autentification");
} else {
NSLog(@"Invalide autentification");
}