Skip to content

Commit b9a93f5

Browse files
AlexPeshkoffAlexPeshkoff
committed
Applied CORE-5788: Security Patch: Replacement of use of SHA-1 in the SRP Client Proof with SHA-256
1 parent 76a55ab commit b9a93f5

15 files changed

Lines changed: 1592 additions & 51 deletions

File tree

‎builds/install/misc/firebird.conf.in‎

Lines changed: 15 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -422,13 +422,19 @@
422422
#
423423
# Type: string
424424

425-
# AuthServer and AuthClient determine what authentication methods will be used
426-
# by network server and client redirector. Secure remote passwords plugin
427-
# is default one. Except configured by default SRP plugin firebird also has
428-
# Legacy_Auth plugin which is used to emulate pre-FB3 login protocol making it
429-
# possible for client to talk to old servers and for server to listen to requests
430-
# from old clients. Legacy_Auth is VERY unsecure. On windows Win_Sspi plugin may
431-
# be also used - it implements windows trusted authentication and backward
425+
# AuthServer and AuthClient determine which authentication methods will be used
426+
# by network server and client redirector. The Secure remote password plugin
427+
# using SHA-256 for the client proof is the default for both client and Server.
428+
# Additionally, the default client configuration (AuthClient) also supports old Srp
429+
# plugin using SHA-1 for the client proof. This enables backwards compatibility
430+
# with old Firebird 3 servers but does not comply with NIST security requirements.
431+
#
432+
# The default client configuration (AuthClient) also supports the pre-Firebird 3 legacy
433+
# authentication protocol (Legacy_Auth). This is again for backwards
434+
# compatibility but has many known weaknesses and is deprecated for current use.
435+
#
436+
# The default Windows client configuration (AuthClient) also includes support for
437+
# the Win_Sspi plugin. This implements windows trusted authentication and is backward
432438
# compatible with 2.1 and 2.5 clients and servers running on windows.
433439
#
434440
# Per-database configurable.
@@ -437,7 +443,8 @@
437443
#
438444
# Per-connection and per-database configurable.
439445
#
440-
#AuthClient = Srp, Win_Sspi, Legacy_Auth
446+
#AuthClient = Srp, Srp256, Legacy_Auth #Non Windows clients
447+
#AuthClient = Srp, Srp256, Win_Sspi, Legacy_Auth #Windows clients
441448
#
442449
# If you need to use server plugins that do not provide encryption key (both Legacy_Auth
443450
# & Win_Sspi) you should also turn off required encryption on the wire with WireCrypt

‎builds/posix/make.shared.variables‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ AllObjects=
2727
CO1:= $(call dirObjects,common)
2828
CO2:= $(call dirObjects,common/classes)
2929
CO3:= $(call dirObjects,common/config)
30-
CO4:= $(call dirObjects,common/tomcrypt)
30+
CO4:= $(call dirObjects,common/sha2)
3131
#CO5:= $(call dirObjects,common/exceptions)
3232
#CO6:= $(call dirObjects,common/sync)
3333
Common_Objects:= $(CO1) $(CO2) $(CO3) $(CO4)

‎doc/README.SecureRemotePassword.html‎

Lines changed: 204 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,204 @@
1+
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
2+
<html>
3+
<head>
4+
<meta http-equiv="content-type" content="text/html; charset=utf-8"/>
5+
<title>- no title specified</title>
6+
<meta name="generator" content="LibreOffice 5.1.6.2 (Linux)"/>
7+
<meta name="created" content="00:00:00"/>
8+
<meta name="changed" content="2018-06-21T14:25:04.182337599"/>
9+
<meta name="DCTERMS.issued" content="2018-04-09T10:14:20.507318741"/>
10+
<meta name="DCTERMS.language" content="en-US"/>
11+
<meta name="DCTERMS.modified" content="2018-04-09T10:14:29.569131327"/>
12+
<meta name="DCTERMS.provenance" content=""/>
13+
<meta name="DCTERMS.source" content="http://xml.openoffice.org/odf2xhtml"/>
14+
<meta name="DCTERMS.subject" content=","/>
15+
<meta name="DCTERMS.title" content=""/>
16+
<style type="text/css">
17+
p { margin-left: 0.79in; margin-right: 0.79in; color: #000000 }
18+
td p { margin-left: 0.79in; margin-right: 0.79in; color: #000000; font-size: 12pt }
19+
h1 { margin-left: 0.79in; margin-right: 0.79in; color: #000000 }
20+
h2 { margin-left: 0.79in; margin-right: 0.79in; color: #000000 }
21+
h2.cjk { font-family: "Noto Sans CJK SC Regular" }
22+
h2.ctl { font-family: "FreeSans" }
23+
p.p1 { margin-bottom: 0.1in; font-family: "Liberation Serif"; font-size: 12pt; line-height: 120% }
24+
p.p4 { margin-bottom: 0.1in; font-family: "Liberation Serif"; font-size: 12pt; line-height: 120% }
25+
td p.p6 { margin-bottom: 0.1in; font-family: "Liberation Serif"; font-size: 12pt; line-height: 120% }
26+
p.p5 { margin-bottom: 0.1in; font-family: "Liberation Serif"; font-size: 12pt; line-height: 120% }
27+
p.p7 { margin-bottom: 0.1in; font-family: "Liberation Serif"; font-size: 12pt; line-height: 120% }
28+
p.p2 { margin-bottom: 0.1in; font-family: "Liberation Serif"; font-size: 12pt; line-height: 120% }
29+
p.p9 { margin-bottom: 0.1in; font-family: "Liberation Serif"; font-size: 12pt; line-height: 120% }
30+
p.p10 { margin-bottom: 0in; font-family: "Liberation Serif"; font-size: 12pt; line-height: 120% }
31+
</style>
32+
</head>
33+
<body lang="en-US" text="#000000" dir="ltr">
34+
<p>&lt;?xml version=&quot;1.0&quot; encoding=&quot;UTF-8&quot;?&gt;<!--This file was converted to xhtml by LibreOffice - see http://cgit.freedesktop.org/libreoffice/core/tree/filter/source/xslt for the code.-->
35+
</p>
36+
<h1><a name="a__Replacement_of_use_of_SHA-1_in_the_SRP_Client_Proof_with_a_SHA-2_Message_Digest"></a>
37+
Replacement of use of SHA-1 in the SRP Client Proof with a SHA-2
38+
Message Digest</h1>
39+
<p class="p1">The Firebird implementation of the Secure Remote
40+
Protocol (SRP) for password based user authentication has been
41+
updated following a security review of the original Firebird SRP-6a
42+
implementation taking into account current NIST guidance on the use
43+
of SHA-1 – see NIST Special Publication 800-131A, Revision 1,
44+
Transitions: Recommendation for Transitioning the Use of
45+
Cryptographic Algorithms and Key Lengths
46+
(<a href="http://dx.doi.org/10.6028/NIST.SP.800-131Ar1">http://dx.doi.org/10.6028/NIST.SP.800-131Ar1</a>)
47+
chapter 9. This guidance disallows the general use of SHA-1 for
48+
“Digital Signature Generation” whilst permitting continued use
49+
for “Digital Signature Verification”. The background to making
50+
this change is given below.</p>
51+
<p class="p4">By default, the SHA-256 message digest is now used
52+
instead of SHA-1 for generating the Client Proof. Alternatively,
53+
SHA-1 (deprecated and for legacy use only) may be used for the Client
54+
Proof. Separate AuthServer and AuthClient plugins are available for
55+
each supported message digest, with the following names:</p>
56+
<table width="703" cellpadding="0" cellspacing="0">
57+
<col width="174">
58+
<col width="528">
59+
<tr>
60+
<td width="174" style="border: none; padding: 0in">
61+
<ul>
62+
<li/>
63+
<p class="p6" align="left" style="margin-right: 0in">•Srp&nbsp;</p>
64+
</ul>
65+
</td>
66+
<td width="528" style="border: none; padding: 0in">
67+
<p class="p4" align="left">SHA-1 Client Proof</p>
68+
</td>
69+
</tr>
70+
<tr>
71+
<td width="174" style="border: none; padding: 0in">
72+
<ul>
73+
<li/>
74+
<p class="p6" align="left" style="margin-right: 0in">•Srp256&nbsp;</p>
75+
</ul>
76+
</td>
77+
<td width="528" style="border: none; padding: 0in">
78+
<p class="p4" align="left">SHA-256 Client Proof</p>
79+
</td>
80+
</tr>
81+
</table>
82+
<p class="p5">Both client and server must have an SRP authentication
83+
plugin in common in order to enable successfully authentication of a
84+
user's password.
85+
</p>
86+
<p class="p5">There is no change to the SRP User Manager. This is
87+
still called (“Srp”) and the User Manager and the security
88+
database are not affected by the choice of message digest used to
89+
compute the client proof.</p>
90+
<p class="p4">The “firebird.conf” default configuration file
91+
entries for AuthServer and AuthClient are now:</p>
92+
<p class="p4">AuthServer = Srp256<br/>
93+
AuthClient = Srp256, Srp,
94+
Legacy_Auth (Non -windows clients)<br/>
95+
AuthClient = Srp256, Srp,
96+
Win_Sspi, Legacy_Auth (windows clients)</p>
97+
<p class="p4">With these settings, a Firebird Server is using Srp256
98+
to authenticate a client using SHA-256 to compute the client proof
99+
and is thus compatible with Firebird 3.0.4 or newer clients. On the
100+
other hand, a Firebird client will authenticate the user with any
101+
server version down to at least 2.5.</p>
102+
<p class="p7">A deployment where both client and servers support the
103+
legacy Srp (using SHA-1) and one or more of the SHA-2 authentication
104+
plugins (e.g. Srp256) should be avoided. This is because an attacker
105+
might be able to disrupt the Srp256 authentication thereby forcing
106+
Firebird to use the weaker Srp SHA-1 client proof without the user
107+
being aware.</p>
108+
<h2 class="western"><a name="a__REASON_FOR_CHANGE"></a>REASON FOR
109+
CHANGE</h2>
110+
<p class="p1">Review of the Firebird SRP implementation appears to
111+
indicate that most uses of SHA-1 continue to be permitted under NIST
112+
guidance except for its use in generating the client proof. The SRP
113+
client proof may be characterised as a “Poor Man's Digital
114+
Signature” in that it provides a two party proof of identity rather
115+
than the third party proof normally expected from a Digital Signature
116+
i.e. it is not a non-repudiable proof. Nevertheless, it is believed
117+
that generation of the client proof falls under the heading of
118+
“Digital Signature Generation” when considering the NIST
119+
Guidance.</p>
120+
<p class="p2">Continued use of SHA-1 in order to generate the client
121+
proof appears to risk leakage of the encryption key used to encrypt
122+
“over-the-wire” encryption and which hence also provides peer
123+
entity authentication during the lifetime of the connection. This may
124+
result in an attacker being able to monitor confidential
125+
communication either during the connection or at some later date and
126+
this could include leakage of an encryption key used to encrypt the
127+
user database, if this is passed from client to server during the
128+
connection.</p>
129+
<p class="p2">Such an attack is viable if weaknesses in SHA-1 can be
130+
exploited to allow a brute force attack on the client proof to be
131+
computationally feasible. All parts of the message on which the
132+
client proof is based may be known to an attacker with the exception
133+
of the shared session key and such an attack would concentrate on
134+
revealing this key. If it were possible to reveal the shared session
135+
key in real time then additionally a man-in-the-middle attack would
136+
be feasible.</p>
137+
<p class="p2">The severity of this issue is viewed as Important but
138+
not Critical. Users that rely on SRP (using SHA-1)/over the wire
139+
encryption to protect confidential communication have a long term
140+
risk that the confidentiality of &nbsp;their data may be compromised.
141+
The attack may also be mitigated through the use of other procedures
142+
to protect communications (e.g. a secure VPN).</p>
143+
<p class="p9">The update adds a new directory to the source code tree
144+
(src/common/sha2) containing an implementation of the SHA-2 family of
145+
message digests derived from the implementation published by Olivier
146+
Gay &lt;<a href="mailto:[email protected]">[email protected]</a>&gt;
147+
(see https://github.com/ouah/sha2). The following copyright notice is
148+
included at the request of the original author and applies to the
149+
files in src/common/sha2:</p>
150+
<p class="p10" style="margin-bottom: 0.2in">FIPS 180-2
151+
SHA-224/256/384/512 implementation</p>
152+
<p class="p10" style="margin-bottom: 0.2in">Last update: 02/02/2007</p>
153+
<p class="p10" style="margin-bottom: 0.2in">Issue date: &nbsp;04/30/2005</p>
154+
<p class="p10" style="margin-bottom: 0.2in">https://github.com/ouah/sha2</p>
155+
<p class="p10" style="margin-bottom: 0.2in">&nbsp;</p>
156+
<p class="p10" style="margin-bottom: 0.2in">Copyright (C) 2005, 2007
157+
Olivier Gay &lt;[email protected]&gt;</p>
158+
<p class="p10" style="margin-bottom: 0.2in">All rights reserved.</p>
159+
<p class="p10" style="margin-bottom: 0.2in">&nbsp;</p>
160+
<p class="p10" style="margin-bottom: 0.2in">Redistribution and use in
161+
source and binary forms, with or without</p>
162+
<p class="p10" style="margin-bottom: 0.2in">modification, are
163+
permitted provided that the following conditions</p>
164+
<p class="p10" style="margin-bottom: 0.2in">are met:</p>
165+
<p class="p10" style="margin-bottom: 0.2in">1. Redistributions of
166+
source code must retain the above copyright</p>
167+
<p class="p10" style="margin-bottom: 0.2in">&nbsp; &nbsp;notice, this
168+
list of conditions and the following disclaimer.</p>
169+
<p class="p10" style="margin-bottom: 0.2in">2. Redistributions in
170+
binary form must reproduce the above copyright</p>
171+
<p class="p10" style="margin-bottom: 0.2in">&nbsp; &nbsp;notice, this
172+
list of conditions and the following disclaimer in the</p>
173+
<p class="p10" style="margin-bottom: 0.2in">&nbsp; &nbsp;documentation
174+
and/or other materials provided with the distribution.</p>
175+
<p class="p10" style="margin-bottom: 0.2in">3. Neither the name of
176+
the project nor the names of its contributors</p>
177+
<p class="p10" style="margin-bottom: 0.2in">&nbsp; &nbsp;may be used
178+
to endorse or promote products derived from this software</p>
179+
<p class="p10" style="margin-bottom: 0.2in">&nbsp; &nbsp;without
180+
specific prior written permission.</p>
181+
<p class="p10" style="margin-bottom: 0.2in">&nbsp;</p>
182+
<p class="p10" style="margin-bottom: 0.2in">THIS SOFTWARE IS PROVIDED
183+
BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND</p>
184+
<p class="p10" style="margin-bottom: 0.2in">ANY EXPRESS OR IMPLIED
185+
WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE</p>
186+
<p class="p10" style="margin-bottom: 0.2in">IMPLIED WARRANTIES OF
187+
MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE</p>
188+
<p class="p10" style="margin-bottom: 0.2in">ARE DISCLAIMED. &nbsp;IN
189+
NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE</p>
190+
<p class="p10" style="margin-bottom: 0.2in">FOR ANY DIRECT, INDIRECT,
191+
INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL</p>
192+
<p class="p10" style="margin-bottom: 0.2in">DAMAGES (INCLUDING, BUT
193+
NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS</p>
194+
<p class="p10" style="margin-bottom: 0.2in">OR SERVICES; LOSS OF USE,
195+
DATA, OR PROFITS; OR BUSINESS INTERRUPTION)</p>
196+
<p class="p10" style="margin-bottom: 0.2in">HOWEVER CAUSED AND ON ANY
197+
THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT</p>
198+
<p class="p10" style="margin-bottom: 0.2in">LIABILITY, OR TORT
199+
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY</p>
200+
<p class="p10" style="margin-bottom: 0.2in">OUT OF THE USE OF THIS
201+
SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF</p>
202+
<p class="p10" style="margin-bottom: 0.2in">SUCH DAMAGE.</p>
203+
</body>
204+
</html>

‎src/CMakeLists.txt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -364,7 +364,7 @@ add_library (burp ${burp_src} ${burp_generated_src_master})
364364
# LIBRARY common
365365
########################################
366366

367-
file(GLOB common_src "common/*.cpp" "common/classes/*.cpp" "common/config/*.cpp" "common/os/${OS_DIR}/*.cpp")
367+
file(GLOB common_src "common/*.cpp" "common/classes/*.cpp" "common/config/*.cpp" "common/os/${OS_DIR}/*.cpp" "common/sha2/*.cpp")
368368
file(GLOB_RECURSE common_include "common/*.h")
369369

370370
if (APPLE)

‎src/auth/SecureRemotePassword/client/SrpClient.cpp‎

Lines changed: 27 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ using namespace Firebird;
3434

3535
namespace Auth {
3636

37-
class SrpClient FB_FINAL : public StdPlugin<IClientImpl<SrpClient, CheckStatusWrapper> >
37+
class SrpClient : public StdPlugin<IClientImpl<SrpClient, CheckStatusWrapper> >
3838
{
3939
public:
4040
explicit SrpClient(IPluginConfig*)
@@ -55,6 +55,20 @@ class SrpClient FB_FINAL : public StdPlugin<IClientImpl<SrpClient, CheckStatusWr
5555
RemotePassword* client;
5656
string data;
5757
UCharBuffer sessionKey;
58+
protected:
59+
virtual RemotePassword* RemotePasswordFactory()=0;
60+
};
61+
62+
template <class SHA> class SrpClientImpl FB_FINAL : public SrpClient
63+
{
64+
public:
65+
explicit SrpClientImpl<SHA>(IPluginConfig* ipc)
66+
: SrpClient(ipc) {}
67+
protected:
68+
RemotePassword* RemotePasswordFactory()
69+
{
70+
return FB_NEW RemotePasswordImpl<SHA>;
71+
}
5872
};
5973

6074
int SrpClient::authenticate(CheckStatusWrapper* status, IClientBlock* cb)
@@ -76,7 +90,7 @@ int SrpClient::authenticate(CheckStatusWrapper* status, IClientBlock* cb)
7690
return AUTH_CONTINUE;
7791
}
7892

79-
client = FB_NEW RemotePassword;
93+
client = RemotePasswordFactory();
8094
client->genClientKey(data);
8195
dumpIt("Clnt: clientPubKey", data);
8296
cb->putData(status, data.length(), data.begin());
@@ -130,7 +144,7 @@ int SrpClient::authenticate(CheckStatusWrapper* status, IClientBlock* cb)
130144

131145
BigInteger cProof = client->clientProof(cb->getLogin(), salt.c_str(), sessionKey);
132146
cProof.getText(data);
133-
147+
dumpIt("Clnt: Client Proof",cProof);
134148
cb->putData(status, data.length(), data.c_str());
135149
if (status->getState() & IStatus::STATE_ERRORS)
136150
{
@@ -170,12 +184,20 @@ int SrpClient::release()
170184

171185
namespace
172186
{
173-
SimpleFactory<SrpClient> factory;
187+
SimpleFactory<SrpClientImpl<Sha1> > factory_sha1;
188+
SimpleFactory<SrpClientImpl<sha224> > factory_sha224;
189+
SimpleFactory<SrpClientImpl<sha256> > factory_sha256;
190+
SimpleFactory<SrpClientImpl<sha384> > factory_sha384;
191+
SimpleFactory<SrpClientImpl<sha512> > factory_sha512;
174192
}
175193

176194
void registerSrpClient(IPluginManager* iPlugin)
177195
{
178-
iPlugin->registerPluginFactory(IPluginManager::TYPE_AUTH_CLIENT, RemotePassword::plugName, &factory);
196+
iPlugin->registerPluginFactory(IPluginManager::TYPE_AUTH_CLIENT, RemotePassword::plugName, &factory_sha1);
197+
iPlugin->registerPluginFactory(IPluginManager::TYPE_AUTH_CLIENT, RemotePassword::pluginName(224).c_str(), &factory_sha224);
198+
iPlugin->registerPluginFactory(IPluginManager::TYPE_AUTH_CLIENT, RemotePassword::pluginName(256).c_str(), &factory_sha256);
199+
iPlugin->registerPluginFactory(IPluginManager::TYPE_AUTH_CLIENT, RemotePassword::pluginName(384).c_str(), &factory_sha384);
200+
iPlugin->registerPluginFactory(IPluginManager::TYPE_AUTH_CLIENT, RemotePassword::pluginName(512).c_str(), &factory_sha512);
179201
}
180202

181203
} // namespace Auth

‎src/auth/SecureRemotePassword/manage/SrpManagement.cpp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -688,7 +688,7 @@ class SrpManagement FB_FINAL : public Firebird::StdPlugin<Firebird::IManagementI
688688
Firebird::RefPtr<Firebird::IFirebirdConf> config;
689689
Firebird::RefPtr<Firebird::IAttachment> att;
690690
Firebird::RefPtr<Firebird::ITransaction> tra;
691-
RemotePassword server;
691+
RemotePasswordImpl<Firebird::Sha1> server;
692692
int upCount, delCount;
693693

694694
bool checkCount(Firebird::CheckStatusWrapper* status, int* count, UCHAR item)

‎src/auth/SecureRemotePassword/misc/test.sh‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,8 @@ compile()
44
file=test_${1}
55
g++ -I../../../include -DLINUX -DAMD64 -DDEV_BUILD ${file}.cpp \
66
../../../../temp/Debug/auth/SecureRemotePassword/srp.o \
7-
../../../../temp/Debug/auth/SecureRemotePassword/BigInteger.o \
87
../../../../temp/Debug/common.a -ltommath ../../../../gen/Debug/firebird/lib/libfbclient.so \
9-
-Wl,-rpath,../../../../gen/Debug/firebird/lib -lrt -o ${file} && ./${file}
8+
-lpthread -Wl,-rpath,../../../../gen/Debug/firebird/lib -lrt -o ${file} && ./${file}
109
}
1110

1211
compile srp

‎src/auth/SecureRemotePassword/misc/test_srp.cpp‎

Lines changed: 19 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -2,19 +2,19 @@
22

33
using namespace Auth;
44

5-
int main(int argc, char** argv)
5+
template<class SHA>void runTest(int argc, char** argv)
66
{
77
Firebird::string salt;
88
#if SRP_DEBUG > 1
9-
BigInteger s("02E268803000000079A478A700000002D1A6979000000026E1601C000000054F");
9+
Firebird::BigInteger s("02E268803000000079A478A700000002D1A6979000000026E1601C000000054F");
1010
#else
11-
BigInteger s;
11+
Firebird::BigInteger s;
1212
s.random(128);
1313
#endif
1414
s.getText(salt);
1515

16-
RemotePassword* server = FB_NEW RemotePassword();
17-
RemotePassword* client = FB_NEW RemotePassword();
16+
RemotePassword* server = FB_NEW RemotePasswordImpl<SHA>();
17+
RemotePassword* client = FB_NEW RemotePasswordImpl<SHA>();
1818

1919
const char* account = "SYSDBA";
2020
const char* password = "masterkey";
@@ -37,8 +37,20 @@ int main(int argc, char** argv)
3737
client->clientSessionKey(key1, account, salt.c_str(), argc > 1 ? argv[1] : password, serverPubKey.c_str());
3838
server->serverSessionKey(key2, clientPubKey.c_str(), verifier);
3939

40-
BigInteger cProof = client->clientProof(account, salt.c_str(), key1);
41-
BigInteger sProof = server->clientProof(account, salt.c_str(), key2);
40+
Firebird::BigInteger cProof = client->clientProof(account, salt.c_str(), key1);
41+
Firebird::BigInteger sProof = server->clientProof(account, salt.c_str(), key2);
4242

43+
printf("Proof length = %d\n",cProof.length());
4344
printf("%s\n", cProof == sProof ? "OK" : "differ");
45+
4446
}
47+
48+
int main(int argc, char** argv)
49+
{
50+
runTest<Firebird::Sha1>(argc,argv);
51+
runTest<Firebird::sha224>(argc,argv);
52+
runTest<Firebird::sha256>(argc,argv);
53+
runTest<Firebird::sha384>(argc,argv);
54+
runTest<Firebird::sha512>(argc,argv);
55+
}
56+

0 commit comments

Comments
 (0)