JSRP is a pure JavaScript implementation of SRP-6A, the Secure Remote Password protocol, as defined in RFC 2945. It can be used in Node.js or the browser via Browserify. It uses SHA-256 by default for hashing, although it will support any of Node's hashing functions. It currently supports 2048 and 4096 bit parameters.
JSRP was written to make SRP simple to implement and work with from the browser and on the server. All high-level functions return hex strings that are easy to pass between server and client, as well as save. No need to waste time serializing and unserializing objects just to transmit them over the network.
To use JSRP in the browser, first add the script: (it can be downloaded from the Releases page.)
<script type="text/javascript" src="jsrp-browser.js"></script>To use JSRP in Node, simply run:
npm install jsrp
JSRP will be available from the jsrp global.
Just require the module:
var jsrp = require('jsrp');The example will run in Node or the browser, JSRP is completely compatible with both.
Example Registration Process:
var client = new jsrp.client();
client.init({ username: 'testUser', password: 'password123' }, function () {
client.createVerifier(function(err, result) {
// result will contain the necessary values the server needs to
// authenticate this user in the future.
sendSaltToServer(result.salt);
sendVerifierToServer(result.verifier);
});
});Example Login Process: (normally client and server wouldn't be in the same code, but the example is this way for the sake of brevity)
var client = new jsrp.client();
var server = new jsrp.server();
client.init({ username: 'username', password: 'password123' }, function() {
// Client instance is ready to be used here.
});
server.init({ salt: 'LONG_HEX_VALUE', verifier: 'EVEN_LONGER_HEX_VALUE' }, function () {
// Server instance is ready to be used here.
});
// Remember, both client and server must have called their
// init() callback before you can continue using them. The
// following functions would normally be called inside that
// callback.
cPubKey = client.getPublicKey();
server.setClientPublicKey(cPubKey);
salt = server.getSalt();
client.setSalt(salt);
sPubKey = server.getPublicKey();
client.setServerPublicKey(sPubKey);
client.getSharedKey() === server.getSharedKey() // will be trueClient methods:
init(options, callback)optionsshould be an object containing a username and a password.{ username: 'username', password: 'password' }. You may also pass a length property, which will allow you to select the size of your parameters. It defaults to 4096.callbackwill be called when the client instance is ready to use.
getPublicKey() -> Hex A value- Return the hex representation of the client's A value, suitable for sending over the network.
setSalt(salt)saltshould be the hex string obtained fromServer.getSalt(), this sets the client's internal salt value for later computations.
setServerPublicKey(serverPublicKey)serverPublicKeyshould be the hex representation of the server's B value, as returned fromServer.getPublicKey(). When this function is called, provided the publicKey is valid, the client instance will compute the rest of the values needed internally to complete authentication. This will throw an error if the server provides an incorrect value, authentication MUST be aborted here.
getSharedKey() -> Hex K value- The hex representation of the computed secret shared key, suitable for external crypto usage.
getProof() -> Hex M1 value- Client's M1 value as a hex string, suitable for transmission to the server.
checkServerProof(serverProof) -> Boolean- Returns true if
serverProofmatches the client's own proof computation, false if it doesn't.serverProofcan be obtained fromServer.getProof(). This can only be called aftergetProof().
- Returns true if
getSalt() -> Hex salt- The hex value of the salt generated from
createVerifier()(see next item), or the salt that was passed via setSalt()
- The hex value of the salt generated from
createVerifier(callback) -> Hex V value- Generate v and salt from the values passed to
init() callbackwill be called once the verifier has been created, with two values,err, andobject, whereobjectlooks like{ verifier: HEX_STRING, salt: HEX_STRING }and is suitable for transmission to the server.
- Generate v and salt from the values passed to
Server methods:
init(options, callback)optionsshould be an object containing the hex representations ofverifierandsalt. These should be the values received from the initial client registration usingClient.createVerifier(). You may also pass length, which allows you to select the size of your parameters.callbackwill be invoked once the server instance is ready to use.
getPublicKey() -> Hex B value- Return the server's B value in hex format, suitable for transmission to the client.
getSalt() -> Hex salt value- Return the salt value (this will be the same value passed to
init())
- Return the salt value (this will be the same value passed to
setClientPublicKey(clientPublicKey)clientPublicKeyshould be the hex value returned fromClient.getPublicKey(). Assuming it's valid, the server will then compute the values necessary to complete authentication internally. This will throw an error if the client provides an incorrect value, authentication MUST be aborted here.
getSharedKey() -> Hex K value- The secret shared key suitable for further crypto operations.
checkClientProof(clientProof) -> Boolean- Returns true if
clientProofmatches the server's own proof computation, false if it doesn't. If this value is true, then the client has provided the correct password, and can be considered authenticated. If it's false, the client used the wrong password.clientProofis the hex string obtained fromClient.getProof()
- Returns true if
getProof() -> Hex M2 value- The server's M2 value as a hex string, suitable for transmission to the client. This can only be called after
checkClientProof().
- The server's M2 value as a hex string, suitable for transmission to the client. This can only be called after
In either scenario, if you'd like to interact with the SRP protocol implementation directly, the SRP object will be available on the client/server object after running init(). You can access it using clientObj.srp or serverObj.srp. The intermediate values calculated by the client and server are also available on the objects themselves as well.
First, install the dependencies:
npm install
Also, you will need Mocha and CoffeeScript if you don't have them already:
npm install -g mocha coffee-script
Then simply run:
npm test
To build JSRP for the browser, you will need Browserify and CoffeeScript:
npm install -g browserify coffee-script
Then run the following commands inside the JSRP directory:
coffee --compile --output lib src
browserify jsrp.js --standalone jsrp > jsrp-browser.js
JSRP would not exist if it wasn't for Node-SRP: https://github.com/mozilla/node-srp. They provided a solid reference implementation, but JSRP was born out of wanting a reliable browser implementation as well as server implementation.
React
Typescript
Django
Laravel
Facebook
Microsoft
Google
Alibaba
D3
Tencent