org.jboss.security.srp
Class SRPServerSession

java.lang.Object
  org.jboss.security.srp.SRPServerSession

All Implemented Interfaces:

java.io.Serializable

public class SRPServerSession

extends java.lang.Object

implements java.io.Serializable

The server side logic to the SRP protocol. The class is the server side equivalent of the SRPClientSession object. An implementation of SRPServerInterface creates an SRPServerSession on the start of a login session. The client side algorithm using these classes consists of: 1. Get server, SRPServerInterface server = (SRPServerInterface) Naming.lookup(...); 2. Get SRP parameters, SRPParameters params = server.getSRPParameters(username); 3. Create a client session, SRPClientSession client = new SRPClientSession(username, password, params); 4. Exchange public keys, byte[] A = client.exponential(); byte[] B = server.init(username, A); 5. Exchange challenges, byte[] M1 = client.response(B); byte[] M2 = server.verify(username, M1); 6. Verify the server response, if( client.verify(M2) == false ) throw new SecurityException("Failed to validate server reply"); 7. Validation complete Note that these steps are stateful. They must be performed in order and a step cannot be repeated to update the session state. This product uses the 'Secure Remote Password' cryptographic authentication system developed by Tom Wu (tjw@CS.Stanford.EDU).

See Also:

Serialized Form

SRPServerSession

public SRPServerSession(java.lang.String username,
                        byte[] vb,
                        SRPParameters (src)  params)

Creates a new SRP server session object from the username, password verifier, and session parameters.

getParameters

public SRPParameters (src)  getParameters()

exponential

public byte[] exponential()

buildSessionKey

public void buildSessionKey(byte[] ab)
                     throws java.security.NoSuchAlgorithmException

Parameters:

ab - The client's exponential (parameter A).

Throws:

java.security.NoSuchAlgorithmException - thrown if the session key MessageDigest algorithm cannot be found.

getSessionKey

public byte[] getSessionKey()
                     throws java.lang.SecurityException

Returns the negotiated session K, K = SessionHash(S)

Returns:

the private session K byte[]

Throws:

java.lang.SecurityException - - if the current thread does not have an getSessionKey SRPPermission.

getServerResponse

public byte[] getServerResponse()

getClientResponse

public byte[] getClientResponse()

verify

public boolean verify(byte[] clientM1)