Namespace FishMMO.Auth.Implementation
Classes
- AccountData
Holds account-related data for a server session, including authentication state, access level, and optional SRP authentication data.
- AccountManager<TConnection>
Thread-safe base manager for account and connection data, including encryption state and the unified AuthState machine. All public methods are synchronized via a shared lock to support concurrent access from network broadcast handlers and async worker threads. Subclass SrpAccountManager<TConnection> or TokenAccountManager<TConnection> for authentication-method-specific behaviour.
- BaseAuthenticatorCore<TConnection>
Abstract engine-independent base for all server authenticators. Provides X25519 ECDH handshake logic, stale-auth TTL sweeps, per-IP and global handshake rate limiting, and connection auth-state tracking — with no dependency on Unity, FishNet, or any game-engine type.
Concrete implementations supply transport-specific callbacks (broadcast, disconnect, IP resolution) by implementing the abstract members, then call OnHandshakeReceived(TConnection, byte[], byte[], string, ushort, ushort, string) from their transport layer.
- ClientAuthenticatorCore
Engine-independent client-side authenticator state machine. Implements the full SRP-6a + X25519 ECDH client auth flow, including cookie challenge echo, key agreement, token auth (World/Scene), SRP verify/proof, TOTP, and key material cleanup.
Concrete implementations (e.g., FishNet
ClientLoginAuthenticator) implement abstract callbacks for broadcasting messages and notifying the application layer.
- ClientSrpData
Holds SRP (Secure Remote Password) authentication data and logic for a client-side session.
- ConnectionEncryptionData
Holds per-connection encryption state including directional AES keys, nonce contexts, and negotiated protocol version. Keys are established via X25519 ECDH key agreement during the handshake phase.
Thread-safety: nonce contexts use
Interlockedinternally for counter operations.
- CryptoHelper
Static class providing cryptographic helper methods for X25519 ECDH key agreement, AES-256-GCM authenticated encryption, HKDF-SHA256 key derivation, HMAC-SHA256 signing, and authentication token management. BouncyCastle is used for cross-platform support on all Unity targets.
- CryptoHelper.TwoFactor
TOTP two-factor authentication helpers. Uses OtpNet for TOTP generation/verification, AES-256-GCM for encrypting TOTP secrets at rest, and PBKDF2-SHA256 for hashing recovery codes.
- CryptoHelper.X25519EphemeralKeyPair
Disposable container for an ephemeral X25519 keypair that enforces private-key zeroization via API ownership. The private key is never exposed to callers.
- HandshakeService
Transport-agnostic service for X25519 ECDH handshake operations and stateless cookie challenge management. Provides both server-side and client-side key agreement, IP normalisation, and HMAC-SHA256 cookie computation/verification.
- KeyEnvelope
AEAD envelope (AES-256-GCM) for wrapping symmetric key material at rest.
- LocalDeriveKmsProvider
Local fallback IKmsProvider implementation that derives keys via HMAC-SHA256 from a long-lived root key. This is the legacy behaviour and is exposed here for parity; production deployments should swap in a hardware-backed implementation.
- ProcessHardening
OS-level hardening hooks invoked early during server startup to reduce the risk that sensitive in-memory key material (TOTP KEK, signing keys, SRP verifier) leaks via process core dumps or ptrace from unprivileged peers.
- ServerSrpData
Holds SRP (Secure Remote Password) authentication data and logic for a server-side session.
- SrpAccountManager<TConnection>
SRP-specific account manager for LoginServer authentication. Extends AccountManager<TConnection> with SRP data population, connection account creation, and periodic sweep of stale unauthenticated connections. Auth state machine methods (
TryAdvanceAuthState,HasAuthState) are inherited from the base AccountManager<TConnection>.
- SrpAuthenticatorCore<TConnection>
Engine-independent SRP-6a authenticator core for LoginServer use. Extends BaseAuthenticatorCore<TConnection> with bounded-channel SRP verify/proof workers, TOTP two-factor authentication, kick-request tracking, and per-IP/per-account rate limiting — with no dependency on Unity, FishNet, or any game-engine type.
Subclasses provide transport-specific callbacks for broadcasting auth results, disconnecting connections, resolving IP addresses, and performing database operations.
- SrpService
Transport-agnostic SRP-6a authentication service. Provides server-side and client-side SRP field decryption/encryption, fake SRP salt derivation for anti-enumeration, and SRP session helpers.
- TokenAccountManager<TConnection>
Token-specific account manager for World and Scene server authentication. Extends AccountManager<TConnection> with a simplified connection account creation method that does not require SRP state.
- TokenAuthenticatorCore<TConnection>
Engine-independent token-based authenticator core for World/Scene servers. Extends BaseAuthenticatorCore<TConnection> with a bounded-channel token auth worker that decrypts, verifies, and revocation-checks client-supplied auth tokens issued by the LoginServer.
Subclasses supply transport-specific callbacks (broadcast, database validation).
- TokenService
Transport-agnostic service for authentication token operations. Provides token generation, encryption, decryption, and verification for both server-side issuance and client/server token authentication.
Structs
- CryptoHelper.SessionKeys
Container for derived session keys and prefixes.
- HandshakeService.ClientKeyAgreementResult
Result of a client-side X25519 key agreement operation.
- HandshakeService.ServerKeyAgreementResult
Result of a server-side X25519 key agreement operation.
- SrpAuthenticatorCore<TConnection>.SrpAccountLookupResult
Result of an account fetch for SRP login.
- SrpProofRequest<TConnection>
Immutable request data for async SRP proof processing. Contains encrypted proof and pre-validated account data to avoid blocking the network thread. Generic over connection type to maintain engine independence.
- SrpVerifyRequest<TConnection>
Immutable request data for async SRP verification processing. Contains ENCRYPTED credentials to avoid blocking the network thread with decryption. Generic over connection type to maintain engine independence.
- TokenService.TokenVerifyResult
Result of a token decryption and verification operation.
Interfaces
- IKmsProvider
Abstraction over a Key Management Service. Allows operators to plug in AWS KMS, Vault, PKCS#11/HSM, or other backends in place of the local-derive default.
Enums
- CryptoHelper.AuthMessageType
Message type identifiers for AAD binding. Values are fixed and must be used by both client and server.
- CryptoHelper.NonceSide
Disposable container that owns a GCM session prefix and provides thread-safe nonce generation. Zeroes the prefix on dispose to prevent accidental reuse across sessions.