MFKDF

auth/index.js

  1. /**
  2.  * Authentication functions
  3.  *
  4.  * @namespace auth
  5.  */
  7. const crypto = require('crypto')
  8. let subtle
  9. /* istanbul ignore next */
  10. if (typeof window !== 'undefined') {
  11.   subtle = window.crypto.subtle
  12. } else {
  13.   subtle = crypto.webcrypto.subtle
  14. }
  16. /**
  17.  * Verify ISO 9798-2 2-Pass Unilateral Authentication
  18.  *
  19.  * @example
  20.  * // setup multi-factor derived key
  21.  * const key = await mfkdf.setup.key([ await mfkdf.setup.factors.password('password') ])
  23.  * // challenger: create random challenge
  24.  * const challenge = crypto.randomBytes(32)
  25.  * const identity = Buffer.from('Challenger')
  27.  * // responder: generate response
  28.  * const response = await key.ISO97982PassUnilateralAuthSymmetric(challenge, identity)
  30.  * // verifier: verify response
  31.  * const authKey = await key.ISO9798SymmetricKey()
  32.  * const valid = await mfkdf.auth.VerifyISO97982PassUnilateralAuthSymmetric(challenge, identity, response, authKey) // -> true
  33.  *
  34.  * @param {Buffer} challenge - The nonce value provided by the challenger
  35.  * @param {Buffer} identity - The identity of the challenger
  36.  * @param {Buffer} response - The response of the responder
  37.  * @param {Buffer} key - The key used to authenticate
  38.  * @returns {boolean} Whether the response is valid
  39.  * @author Vivek Nair (https://nair.me) <vivek@nair.me>
  40.  * @since 0.17.0
  41.  * @memberOf auth
  42.  * @async
  43.  */
  44. async function VerifyISO97982PassUnilateralAuthSymmetric (challenge, identity, response, key) {
  45.   const plaintext = Buffer.concat([challenge, identity])
  47.   const iv = response.subarray(0, 16)
  48.   const ct = response.subarray(16)
  49.   const decipher = crypto.createDecipheriv('AES-256-CBC', key, iv)
  51.   let decrypted
  52.   try {
  53.     decrypted = Buffer.concat([decipher.update(ct), decipher.final()])
  54.   } catch (e) {
  55.     return false
  56.   }
  58.   return (plaintext.toString('hex') === decrypted.toString('hex'))
  59. }
  60. module.exports.VerifyISO97982PassUnilateralAuthSymmetric = VerifyISO97982PassUnilateralAuthSymmetric
  62. /**
  63.  * Verify ISO 9798-2 Public Key 2-Pass Unilateral Authentication
  64.  *
  65.  * @example
  66.  * // setup multi-factor derived key
  67.  * const key = await mfkdf.setup.key([ await mfkdf.setup.factors.password('password') ])
  68.  *
  69.  * // challenger: create random challenge
  70.  * const challenge = crypto.randomBytes(32)
  71.  * const identity = Buffer.from('Challenger')
  72.  *
  73.  * // responder: generate response
  74.  * const response = await key.ISO97982PassUnilateralAuthAsymmetric(challenge, identity)
  75.  *
  76.  * // verifier: verify response
  77.  * const authKey = await key.ISO9798AsymmetricKey()
  78.  * const valid = await mfkdf.auth.VerifyISO97982PassUnilateralAuthAsymmetric(challenge, identity, response, authKey) // -> true
  79.  *
  80.  * @param {Buffer} challenge - The nonce value provided by the challenger
  81.  * @param {Buffer} identity - The identity of the challenger
  82.  * @param {Buffer} response - The response of the responder
  83.  * @param {Buffer} key - The key used to authenticate
  84.  * @returns {boolean} Whether the response is valid
  85.  * @author Vivek Nair (https://nair.me) <vivek@nair.me>
  86.  * @since 0.17.0
  87.  * @memberOf auth
  88.  * @async
  89.  */
  90. async function VerifyISO97982PassUnilateralAuthAsymmetric (challenge, identity, response, key) {
  91.   const plaintext = Buffer.concat([challenge, identity])
  93.   const cryptoKey = await subtle.importKey('spki', key, { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' }, false, ['verify'])
  94.   return await subtle.verify({ name: 'RSASSA-PKCS1-v1_5' }, cryptoKey, response, plaintext)
  95. }
  96. module.exports.VerifyISO97982PassUnilateralAuthAsymmetric = VerifyISO97982PassUnilateralAuthAsymmetric
  98. /**
  99.  * Verify ISO 9798-2 2-Pass Unilateral Authentication over CCF
  100.  *
  101.  * @example
  102.  * // setup multi-factor derived key
  103.  * const key = await mfkdf.setup.key([ await mfkdf.setup.factors.password('password') ])
  104.  *
  105.  * // challenger: create random challenge
  106.  * const challenge = crypto.randomBytes(32)
  107.  * const identity = Buffer.from('Challenger')
  108.  *
  109.  * // responder: generate response
  110.  * const response = await key.ISO97982PassUnilateralAuthCCF(challenge, identity)
  111.  *
  112.  * // verifier: verify response
  113.  * const authKey = await key.ISO9798CCFKey()
  114.  * const valid = await mfkdf.auth.VerifyISO97982PassUnilateralAuthCCF(challenge, identity, response, authKey) // -> true
  115.  *
  116.  * @param {Buffer} challenge - The nonce value provided by the challenger
  117.  * @param {Buffer} identity - The identity of the challenger
  118.  * @param {Buffer} response - The response of the responder
  119.  * @param {Buffer} key - The key used to authenticate
  120.  * @returns {boolean} Whether the response is valid
  121.  * @author Vivek Nair (https://nair.me) <vivek@nair.me>
  122.  * @since 0.17.0
  123.  * @memberOf auth
  124.  * @async
  125.  */
  126. async function VerifyISO97982PassUnilateralAuthCCF (challenge, identity, response, key) {
  127.   const ct = Buffer.concat([challenge, identity, key])
  128.   const hash = crypto.createHash('sha256').update(ct).digest()
  129.   return (hash.toString('hex') === response.toString('hex'))
  130. }
  131. module.exports.VerifyISO97982PassUnilateralAuthCCF = VerifyISO97982PassUnilateralAuthCCF
  133. /**
  134.  * Verify ISO 9798-2 1-Pass Unilateral Authentication
  135.  *
  136.  * @example
  137.  * // setup multi-factor derived key
  138.  * const key = await mfkdf.setup.key([ await mfkdf.setup.factors.password('password') ])
  139.  * const identity = Buffer.from('Challenger')
  140.  *
  141.  * // responder: generate response
  142.  * const response = await key.ISO97981PassUnilateralAuthSymmetric(identity)
  143.  *
  144.  * // verifier: verify response
  145.  * const authKey = await key.ISO9798SymmetricKey()
  146.  * const valid = await mfkdf.auth.VerifyISO97981PassUnilateralAuthSymmetric(identity, response, authKey) // -> true
  147.  *
  148.  * @param {Buffer} identity - The identity of the challenger
  149.  * @param {Buffer} response - The response of the responder
  150.  * @param {Buffer} key - The key used to authenticate
  151.  * @param {number} [window=5] - The maximum time difference in seconds
  152.  * @returns {boolean} Whether the response is valid
  153.  * @author Vivek Nair (https://nair.me) <vivek@nair.me>
  154.  * @since 0.17.0
  155.  * @memberOf auth
  156.  * @async
  157.  */
  158. async function VerifyISO97981PassUnilateralAuthSymmetric (identity, response, key, window = 5) {
  159.   const challenge = response.subarray(0, 4)
  160.   const value = response.subarray(4)
  162.   const actual = Math.floor(Date.now() / 1000)
  163.   const observed = challenge.readUInt32BE(0)
  164.   if (Math.abs(actual - observed) > window) return false
  166.   return await VerifyISO97982PassUnilateralAuthSymmetric(challenge, identity, value, key)
  167. }
  168. module.exports.VerifyISO97981PassUnilateralAuthSymmetric = VerifyISO97981PassUnilateralAuthSymmetric
  170. /**
  171.  * Verify ISO 9798-2 Public Key 1-Pass Unilateral Authentication
  172.  *
  173.  * @example
  174.  * // setup multi-factor derived key
  175.  * const key = await mfkdf.setup.key([ await mfkdf.setup.factors.password('password') ])
  176.  * const identity = Buffer.from('Challenger')
  177.  *
  178.  * // responder: generate response
  179.  * const response = await key.ISO97981PassUnilateralAuthAsymmetric(identity)
  180.  *
  181.  * // verifier: verify response
  182.  * const authKey = await key.ISO9798AsymmetricKey()
  183.  * const valid = await mfkdf.auth.VerifyISO97981PassUnilateralAuthAsymmetric(identity, response, authKey) // -> true
  184.  *
  185.  * @param {Buffer} identity - The identity of the challenger
  186.  * @param {Buffer} response - The response of the responder
  187.  * @param {Buffer} key - The key used to authenticate
  188.  * @param {number} [window=5] - The maximum time difference in seconds
  189.  * @returns {boolean} Whether the response is valid
  190.  * @author Vivek Nair (https://nair.me) <vivek@nair.me>
  191.  * @since 0.17.0
  192.  * @memberOf auth
  193.  * @async
  194.  */
  195. async function VerifyISO97981PassUnilateralAuthAsymmetric (identity, response, key, window = 5) {
  196.   const challenge = response.subarray(0, 4)
  197.   const value = response.subarray(4)
  199.   const actual = Math.floor(Date.now() / 1000)
  200.   const observed = challenge.readUInt32BE(0)
  201.   if (Math.abs(actual - observed) > window) return false
  203.   return await VerifyISO97982PassUnilateralAuthAsymmetric(challenge, identity, value, key)
  204. }
  205. module.exports.VerifyISO97981PassUnilateralAuthAsymmetric = VerifyISO97981PassUnilateralAuthAsymmetric
  207. /**
  208.  * Verify ISO 9798-2 1-Pass Unilateral Authentication over CCF
  209.  *
  210.  * @example
  211.  * // setup multi-factor derived key
  212.  * const key = await mfkdf.setup.key([ await mfkdf.setup.factors.password('password') ])
  213.  * const identity = Buffer.from('Challenger')
  214.  *
  215.  * // responder: generate response
  216.  * const response = await key.ISO97981PassUnilateralAuthCCF(identity)
  217.  *
  218.  * // verifier: verify response
  219.  * const authKey = await key.ISO9798CCFKey()
  220.  * const valid = await mfkdf.auth.VerifyISO97981PassUnilateralAuthCCF(identity, response, authKey) // -> true
  221.  *
  222.  * @param {Buffer} identity - The identity of the challenger
  223.  * @param {Buffer} response - The response of the responder
  224.  * @param {Buffer} key - The key used to authenticate
  225.  * @param {number} [window=5] - The maximum time difference in seconds
  226.  * @returns {boolean} Whether the response is valid
  227.  * @author Vivek Nair (https://nair.me) <vivek@nair.me>
  228.  * @since 0.17.0
  229.  * @memberOf auth
  230.  * @async
  231.  */
  232. async function VerifyISO97981PassUnilateralAuthCCF (identity, response, key, window = 5) {
  233.   const challenge = response.subarray(0, 4)
  234.   const value = response.subarray(4)
  236.   const actual = Math.floor(Date.now() / 1000)
  237.   const observed = challenge.readUInt32BE(0)
  238.   if (Math.abs(actual - observed) > window) return false
  240.   return await VerifyISO97982PassUnilateralAuthCCF(challenge, identity, value, key)
  241. }
  242. module.exports.VerifyISO97981PassUnilateralAuthCCF = VerifyISO97981PassUnilateralAuthCCF