Class ClientSrpData

Namespace

FishMMO.Auth.Implementation

Assembly

FishMMO-AuthShared.dll

Holds SRP (Secure Remote Password) authentication data and logic for a client-side session.

public class ClientSrpData

Inheritance

object

ClientSrpData

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.MemberwiseClone()

object.ReferenceEquals(object, object)

object.ToString()

Remarks

String zeroization limitation: SRP values (username, salt, verifier, ephemeral, proof, private key) are .NET immutable strings that cannot be deterministically zeroed. The SecureRemotePassword library requires string parameters throughout its API. Clear() nulls all references so the GC can collect them, but the string contents remain in managed heap memory until garbage-collected. This limitation applies to all methods in this class, including GetSaltAndVerifier(string, string, out string, out string) and GetProof(string, string, string, string, out string) where derived private keys are short-lived locals. Intermediate decrypted byte[] buffers (e.g., AES-GCM ciphertext inputs, session encryption keys) are zeroed correctly via CryptographicOperations.ZeroMemory in the authenticator workers — only the SRP library's string outputs persist in the heap.

Thread safety: This class is not thread-safe. GetProof(string, string, string, string, out string), Verify(string, out string), and Clear() must not be called concurrently. In particular, Clear() nulls ClientEphemeral and Session, which would cause NullReferenceException if another thread is mid-call in GetProof(string, string, string, string, out string) or Verify(string, out string). The expected usage is single-threaded per connection.

Constructors

ClientSrpData(SrpParameters)

Constructs a new ClientSrpData instance and initializes the SRP client and ephemeral values.

public ClientSrpData(SrpParameters parameters)

Parameters

parameters SrpParameters

SRP parameters used for cryptographic operations.

Properties

ClientEphemeral

The ephemeral values generated by the client for SRP authentication.

public SrpEphemeral? ClientEphemeral { get; }

Property Value

SrpEphemeral

Session

The current SRP session, containing proof and session keys.

public SrpSession? Session { get; }

Property Value

SrpSession

SrpClient

The SRP client instance used for authentication operations.

public SrpClient? SrpClient { get; }

Property Value

SrpClient

Methods

Clear()

Clears all SRP references so the GC can collect sensitive SRP strings (salt, verifier, proofs, session keys) as early as possible. .NET strings cannot be deterministically zeroed, but nulling references removes the reachability root and allows collection.

public void Clear()

Remarks

Only fields stored on this instance are nulled. SrpParameters passed to the constructor is not retained as a field. If future fields are added, they must be nulled here as well.

GetProof(string, string, string, string, out string)

Generates a client proof for SRP authentication using provided credentials and server ephemeral value.

public bool GetProof(string username, string password, string salt, string serverPublicEphemeral, out string proof)

Parameters

username string

The username for authentication.

password string

The password for authentication.

salt string

The salt used for deriving the private key.

serverPublicEphemeral string

The server's public ephemeral value.

proof string

Output client proof if authentication succeeds; otherwise, an error message.

Returns

bool

True if proof generation succeeded; otherwise, false.

Remarks

The derived privateKey string cannot be zeroed (immutable .NET string). On both success and exception paths the reference goes out of scope, making it GC-eligible. The exception handler does not log or expose privateKey. See class-level remarks for the broader string zeroization limitation.

Single-use: Calling this method more than once overwrites Session with a freshly derived session. Callers that cached the proof from a prior call will hold a stale value. The intended protocol flow calls GetProof(string, string, string, string, out string) exactly once, followed by Verify(string, out string), then Clear().

GetSaltAndVerifier(string, string, out string, out string)

Generates a salt and verifier for the given username and password. Used for account registration or password changes.

public void GetSaltAndVerifier(string username, string password, out string salt, out string verifier)

Parameters

username string

The username for which to generate the verifier.

password string

The password for which to generate the verifier.

salt string

Output salt value.

verifier string

Output verifier value.

Remarks

The derived privateKey string is a short-lived local that becomes eligible for GC collection when this method returns. It cannot be zeroed because .NET strings are immutable — see class-level remarks.

Verify(string, out string)

Verifies the server's proof to complete the SRP authentication session.

public bool Verify(string serverProof, out string result)

Parameters

serverProof string

The proof value provided by the server.

result string

Output result message indicating success or reason for failure.

Returns

bool

True if verification succeeded; otherwise, false.