| java.lang.Object
 org.jboss.security.srp.SRPServerSession
| SRPServerSession | | public class SRPServerSession implements Serializable(Code) | | The server side logic to the SRP protocol. The class is the server side
equivalent of the SRPClientSession object. An implementation of
SRPServerInterface creates an SRPServerSession on the start of a login
session.
The client side algorithm using these classes consists of:
1. Get server, SRPServerInterface server = (SRPServerInterface) Naming.lookup(...);
2. Get SRP parameters, SRPParameters params = server.getSRPParameters(username);
3. Create a client session, SRPClientSession client = new SRPClientSession(username, password, params);
4. Exchange public keys, byte[] A = client.exponential();
byte[] B = server.init(username, A);
5. Exchange challenges, byte[] M1 = client.response(B);
byte[] M2 = server.verify(username, M1);
6. Verify the server response, if( client.verify(M2) == false )
throw new SecurityException("Failed to validate server reply");
7. Validation complete
Note that these steps are stateful. They must be performed in order and a
step cannot be repeated to update the session state.
This product uses the 'Secure Remote Password' cryptographic
authentication system developed by Tom Wu (tjw@CS.Stanford.EDU).
author:
Scott.Stark@jboss.org
version:
$Revision: 57210 $ |
| Constructor Summary | |
| public | SRPServerSession(String username, byte[] vb, SRPParameters params)
Creates a new SRP server session object from the username, password
verifier, and session parameters. |
| serialVersionUID | | final static long serialVersionUID(Code) | | The serial version ID
since:
1.6 |
| SRPServerSession | | public SRPServerSession(String username, byte[] vb, SRPParameters params)(Code) | | Creates a new SRP server session object from the username, password
verifier, and session parameters.
username, the user ID vb, the password verifier byte sequence params, the SRP parameters for the session |
| exponential | | public byte[] exponential()(Code) | | |
| getClientResponse | | public byte[] getClientResponse()(Code) | | |
| getServerResponse | | public byte[] getServerResponse()(Code) | | |
| getSessionKey | | public byte[] getSessionKey() throws SecurityException(Code) | | Returns the negotiated session K, K = SessionHash(S)
the private session K byte[]
throws:
SecurityException - - if the current thread does not have angetSessionKey SRPPermission. |
| verify | | public boolean verify(byte[] clientM1)(Code) | |
Parameters:
resp - The client's response to the server's challenge |
|
|