Class ServerSrpData

Namespace

FishMMO.Auth.Implementation

Assembly

FishMMO-ServerAuth.dll

Holds SRP (Secure Remote Password) authentication data and logic for a server-side session.

public class ServerSrpData

Inheritance

object

ServerSrpData

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.MemberwiseClone()

object.ReferenceEquals(object, object)

object.ToString()

Remarks

String zeroization limitation: SRP values (username, salt, verifier, ephemeral, proof) are .NET immutable strings that cannot be deterministically zeroed. The SecureRemotePassword library and database boundary both require string parameters. Clear() nulls all references so the GC can collect them, but the string contents remain in managed heap memory until garbage-collected. Intermediate decrypted byte[] buffers are zeroed via CryptographicOperations.ZeroMemory in the authenticator workers.

Constructors

ServerSrpData(SrpParameters, string, string, string, string)

Initializes a new instance of the ServerSrpData class.

public ServerSrpData(SrpParameters parameters, string username, string publicClientEphemeral, string salt, string verifier)

Parameters

parameters SrpParameters

The SRP parameters to use.

username string

The username for the session.

publicClientEphemeral string

The public ephemeral value sent by the client.

salt string

The salt for the session.

verifier string

The verifier for the session.

Properties

PublicClientEphemeral

Gets the public ephemeral value sent by the client.

public string? PublicClientEphemeral { get; }

Property Value

string

Salt

Gets the salt used for the SRP session.

public string? Salt { get; }

Property Value

string

ServerEphemeral

Gets the server's ephemeral values for the SRP session.

public SrpEphemeral? ServerEphemeral { get; }

Property Value

SrpEphemeral

Session

Gets the SRP session object after proof verification.

public SrpSession? Session { get; }

Property Value

SrpSession

SrpServer

Gets the SRP server instance handling the protocol.

public SrpServer? SrpServer { get; }

Property Value

SrpServer

UserName

Gets the username associated with the SRP session.

public string? UserName { get; }

Property Value

string

Verifier

Gets the verifier used for the SRP session.

public string? Verifier { get; }

Property Value

string

Methods

Clear()

Nulls all string and object references to allow GC collection of sensitive SRP material. Call after SRP success to minimize the window during which secrets reside in memory.

public void Clear()

Remarks

.NET strings are immutable and GC-managed — their contents cannot be deterministically zeroed. This method nulls all references so the GC can collect the backing memory at its next opportunity. For true defense-in-depth, ensure the process runs with locked pages or consider a native SRP library that operates on pinned byte arrays.

GetProof(string, out string)

Verifies the client's proof and derives the SRP session, returning the server's proof if successful.

public bool GetProof(string clientProof, out string serverProof)

Parameters

clientProof string

The proof sent by the client.

serverProof string

Output parameter that will contain the server's proof if verification is successful, or an error message if it fails.

Returns

bool

true if the proof is valid and the session is established; otherwise, false.