Botan::SPAKE2p::ProverSecret Class Reference

#include <spake2p.h>

Public Member Functions
RegistrationRecord	registration_record (RandomNumberGenerator &rng) const
secure_vector< uint8_t >	serialize () const

Static Public Member Functions
static ProverSecret	deserialize (const SystemParameters &params, std::span< const uint8_t > secret)
static ProverSecret	from_password (const SystemParameters &params, std::string_view password, std::span< const uint8_t > prover_id, std::span< const uint8_t > verifier_id, std::span< const uint8_t > salt)
static ProverSecret	from_prehashed (EC_Scalar w0, EC_Scalar w1)

Friends
class	ProverContext

Detailed Description

SPAKE2+ Prover Secret

This is the information (w0 and w1 in RFC 9383) which the prover derives from the password in order to authenticate itself.

Definition at line 207 of file spake2p.h.

Member Function Documentation

deserialize()

ProverSecret Botan::SPAKE2p::ProverSecret::deserialize ( const SystemParameters & params, std::span< const uint8_t > secret )

static

Deserialize a ProverSecret previously serialized by serialize

Definition at line 296 of file spake2p.cpp.

                                                                                                    {
   if(auto w0_w1 = EC_Scalar::deserialize_pair(params.group(), secret)) {
      return ProverSecret(std::move(w0_w1->first), std::move(w0_w1->second));
   } else {
      throw Decoding_Error("Invalid SPAKE2+ prover secret");
   }
}

References Botan::EC_Scalar::deserialize_pair(), and Botan::SPAKE2p::SystemParameters::group().

Referenced by botan_spake2p_prover_init(), and botan_spake2p_registration_record().

from_password()

ProverSecret Botan::SPAKE2p::ProverSecret::from_password ( const SystemParameters & params, std::string_view password, std::span< const uint8_t > prover_id, std::span< const uint8_t > verifier_id, std::span< const uint8_t > salt )

static

Derive the prover secret from a password

The derivation uses Argon2id with the memory-constrained parameters from RFC 9106, namely m=64 MiB, t=3, p=4. Following RFC 9383, the Argon2id passphrase input is the concatenation

len(pw) || pw || len(idProver) || idProver || len(idVerifier) || idVerifier

with each length an 8-byte little-endian count of bytes, and the salt is provided to Argon2id directly. The Argon2id output is split in two halves, each of which is reduced modulo the group order.

The identities and salt may be empty; if a salt is available it should be used, as this prevents precomputed dictionary attacks.

Definition at line 283 of file spake2p.cpp.

                                                                      {
   auto [w0, w1] = derive_w0_w1(params, password, prover_id, verifier_id, salt);
   return ProverSecret(std::move(w0), std::move(w1));
}

Referenced by botan_spake2p_derive_secret(), and Botan::SPAKE2p::RegistrationRecord::from_password().

from_prehashed()

ProverSecret Botan::SPAKE2p::ProverSecret::from_prehashed ( EC_Scalar w0, EC_Scalar w1 )

static

Create a prover secret from already derived scalars

Warning

This interface is potentially unsafe, depending upon how the scalars are derived from the password. They must be uniformly random, and preferably computed in a way such that testing password guesses is expensive for an attacker. It exists to support testing, as well as applications which require using a different password hashing scheme than the default one implemented by from_password.

Definition at line 292 of file spake2p.cpp.

                                                                    {
   return ProverSecret(std::move(w0), std::move(w1));
}

registration_record()

RegistrationRecord Botan::SPAKE2p::ProverSecret::registration_record

(

RandomNumberGenerator &

rng

)

const

Compute the registration record (w0 and L=w1*P) for this secret

This would typically be done once, when the password is first registered with the verifier.

Definition at line 308 of file spake2p.cpp.

                                                                                     {
   // RFC 9383 Section 3.2: "the registration record L=w1*P"
   return RegistrationRecord(m_w0, EC_AffinePoint::g_mul(m_w1, rng));
}

References Botan::EC_AffinePoint::g_mul().

Referenced by Botan::SPAKE2p::RegistrationRecord::from_password().

serialize()

secure_vector< uint8_t > Botan::SPAKE2p::ProverSecret::serialize

(

)

const

Serialize the prover secret

Warning

the return value is password equivalent; encrypt it for persistent storage if possible.

Definition at line 304 of file spake2p.cpp.

                                                     {
   return EC_Scalar::serialize_pair<secure_vector<uint8_t>>(m_w0, m_w1);
}

References Botan::EC_Scalar::serialize_pair().

Friends And Related Symbol Documentation

ProverContext

friend class ProverContext

friend

Definition at line 265 of file spake2p.h.

References ProverContext.

Referenced by ProverContext.

---

The documentation for this class was generated from the following files:

• src/lib/pake/spake2p/spake2p.h
• src/lib/pake/spake2p/spake2p.cpp