Table of Contents

Namespace FishMMO.Auth.Implementation

Classes

AccountData

Holds account-related data for a server session, including authentication state, access level, and optional SRP authentication data.

AccountManager<TConnection>

Thread-safe base manager for account and connection data, including encryption state and the unified AuthState machine. All public methods are synchronized via a shared lock to support concurrent access from network broadcast handlers and async worker threads. Subclass SrpAccountManager<TConnection> or TokenAccountManager<TConnection> for authentication-method-specific behaviour.

BaseAuthenticatorCore<TConnection>

Abstract engine-independent base for all server authenticators. Provides X25519 ECDH handshake logic, stale-auth TTL sweeps, per-IP and global handshake rate limiting, and connection auth-state tracking — with no dependency on Unity, FishNet, or any game-engine type.

Concrete implementations supply transport-specific callbacks (broadcast, disconnect, IP resolution) by implementing the abstract members, then call OnHandshakeReceived(TConnection, byte[], byte[], string, ushort, ushort, string) from their transport layer.

ClientAuthenticatorCore

Engine-independent client-side authenticator state machine. Implements the full SRP-6a + X25519 ECDH client auth flow, including cookie challenge echo, key agreement, token auth (World/Scene), SRP verify/proof, TOTP, and key material cleanup.

Concrete implementations (e.g., FishNet ClientLoginAuthenticator) implement abstract callbacks for broadcasting messages and notifying the application layer.

ClientSrpData

Holds SRP (Secure Remote Password) authentication data and logic for a client-side session.

ConnectionEncryptionData

Holds per-connection encryption state including directional AES keys, nonce contexts, and negotiated protocol version. Keys are established via X25519 ECDH key agreement during the handshake phase.

Thread-safety: nonce contexts use Interlocked internally for counter operations.

CryptoHelper

Static class providing cryptographic helper methods for X25519 ECDH key agreement, AES-256-GCM authenticated encryption, HKDF-SHA256 key derivation, HMAC-SHA256 signing, and authentication token management. BouncyCastle is used for cross-platform support on all Unity targets.

CryptoHelper.GcmNonceContext
CryptoHelper.TwoFactor

TOTP two-factor authentication helpers. Uses OtpNet for TOTP generation/verification, AES-256-GCM for encrypting TOTP secrets at rest, and PBKDF2-SHA256 for hashing recovery codes.

CryptoHelper.X25519EphemeralKeyPair

Disposable container for an ephemeral X25519 keypair that enforces private-key zeroization via API ownership. The private key is never exposed to callers.

HandshakeService

Transport-agnostic service for X25519 ECDH handshake operations and stateless cookie challenge management. Provides both server-side and client-side key agreement, IP normalisation, and HMAC-SHA256 cookie computation/verification.

KeyEnvelope

AEAD envelope (AES-256-GCM) for wrapping symmetric key material at rest.

LocalDeriveKmsProvider

Local fallback IKmsProvider implementation that derives keys via HMAC-SHA256 from a long-lived root key. This is the legacy behaviour and is exposed here for parity; production deployments should swap in a hardware-backed implementation.

ProcessHardening

OS-level hardening hooks invoked early during server startup to reduce the risk that sensitive in-memory key material (TOTP KEK, signing keys, SRP verifier) leaks via process core dumps or ptrace from unprivileged peers.

ServerSrpData

Holds SRP (Secure Remote Password) authentication data and logic for a server-side session.

SrpAccountManager<TConnection>

SRP-specific account manager for LoginServer authentication. Extends AccountManager<TConnection> with SRP data population, connection account creation, and periodic sweep of stale unauthenticated connections. Auth state machine methods (TryAdvanceAuthState, HasAuthState) are inherited from the base AccountManager<TConnection>.

SrpAuthenticatorCore<TConnection>

Engine-independent SRP-6a authenticator core for LoginServer use. Extends BaseAuthenticatorCore<TConnection> with bounded-channel SRP verify/proof workers, TOTP two-factor authentication, kick-request tracking, and per-IP/per-account rate limiting — with no dependency on Unity, FishNet, or any game-engine type.

Subclasses provide transport-specific callbacks for broadcasting auth results, disconnecting connections, resolving IP addresses, and performing database operations.

SrpService

Transport-agnostic SRP-6a authentication service. Provides server-side and client-side SRP field decryption/encryption, fake SRP salt derivation for anti-enumeration, and SRP session helpers.

TokenAccountManager<TConnection>

Token-specific account manager for World and Scene server authentication. Extends AccountManager<TConnection> with a simplified connection account creation method that does not require SRP state.

TokenAuthenticatorCore<TConnection>

Engine-independent token-based authenticator core for World/Scene servers. Extends BaseAuthenticatorCore<TConnection> with a bounded-channel token auth worker that decrypts, verifies, and revocation-checks client-supplied auth tokens issued by the LoginServer.

Subclasses supply transport-specific callbacks (broadcast, database validation).

TokenService

Transport-agnostic service for authentication token operations. Provides token generation, encryption, decryption, and verification for both server-side issuance and client/server token authentication.

Structs

CryptoHelper.SessionKeys

Container for derived session keys and prefixes.

HandshakeService.ClientKeyAgreementResult

Result of a client-side X25519 key agreement operation.

HandshakeService.ServerKeyAgreementResult

Result of a server-side X25519 key agreement operation.

SrpAuthenticatorCore<TConnection>.SrpAccountLookupResult

Result of an account fetch for SRP login.

SrpProofRequest<TConnection>

Immutable request data for async SRP proof processing. Contains encrypted proof and pre-validated account data to avoid blocking the network thread. Generic over connection type to maintain engine independence.

SrpVerifyRequest<TConnection>

Immutable request data for async SRP verification processing. Contains ENCRYPTED credentials to avoid blocking the network thread with decryption. Generic over connection type to maintain engine independence.

TokenService.TokenVerifyResult

Result of a token decryption and verification operation.

Interfaces

IKmsProvider

Abstraction over a Key Management Service. Allows operators to plug in AWS KMS, Vault, PKCS#11/HSM, or other backends in place of the local-derive default.

Enums

CryptoHelper.AuthMessageType

Message type identifiers for AAD binding. Values are fixed and must be used by both client and server.

CryptoHelper.NonceSide

Disposable container that owns a GCM session prefix and provides thread-safe nonce generation. Zeroes the prefix on dispose to prevent accidental reuse across sessions.