ScramAuthenticationMechanism.cs

using System;
using System.Collections.Generic;
using System.Net.Security;
using System.Security.Cryptography;
using System.Text;
using System.Threading.Tasks;
using Waher.Runtime.Settings;
using Waher.Security.LoginMonitor;
 
namespace Waher.Networking.SASL
{
    public abstract class ScramAuthenticationMechanism : HashedAuthenticationMechanism
    {
        private static readonly byte[] clientKey = Encoding.UTF8.GetBytes("Client Key");
        private static readonly byte[] serverKey = Encoding.UTF8.GetBytes("Server Key");
 
        private static byte[] salt = null;
        private static string saltBase64 = null;
 
        public ScramAuthenticationMechanism()
        {
        }
 
        public override bool Allowed(SslStream SslStream)
        {
            return true;
        }
 
        public override Task<bool?> AuthenticationRequest(string Data, ISaslServerSide Connection, ISaslPersistenceLayer PersistenceLayer)
        {
            byte[] Bin = Convert.FromBase64String(Data);
            string Request = Encoding.UTF8.GetString(Bin);
            string UserName = null;
            string Nonce = null;
            int NrIterations = 4096;
 
            foreach (KeyValuePair<string, string> Pair in this.ParseCommaSeparatedParameterList(Request))
            {
                switch (Pair.Key.ToLower())
                {
                    case "n":
                        UserName = Pair.Value;
                        break;
 
                    case "r":
                        Nonce = Pair.Value;
                        break;
                }
            }
 
            if (UserName is null || Nonce is null)
            {
                Connection.SaslErrorMalformedRequest();
                LoginAuditor.Fail("Login attempt using malformed request.", UserName, Connection.RemoteEndpoint, Connection.Protocol);
                return Task.FromResult<bool?>(null);
            }
 
            Connection.SetUserIdentity(UserName);
 
            string ServerNonce = Nonce + Convert.ToBase64String(PersistenceLayer.GetRandomNumbers(32));
 
            string Challenge = "r=" + ServerNonce + ",s=" + saltBase64 + ",i=" + NrIterations.ToString();
            Bin = Encoding.UTF8.GetBytes(Challenge);
            string ChallengeBase64 = Convert.ToBase64String(Bin);
 
            Connection.Tag = new object[] { UserName, Nonce, NrIterations, ServerNonce, Request, Challenge };
            Connection.SaslChallenge(ChallengeBase64);
 
            return Task.FromResult<bool?>(null);
        }
 
        public override async Task<bool?> ResponseRequest(string Data, ISaslServerSide Connection, ISaslPersistenceLayer PersistenceLayer)
        {
            byte[] Bin = Convert.FromBase64String(Data);
            string Request = Encoding.UTF8.GetString(Bin);
            object[] P = (object[])Connection.Tag;
            string UserName = (string)P[0];
            //string Nonce = (string)P[1];
            int NrIterations = (int)P[2];
            string ServerNonce = (string)P[3];
            string ClientRequest = (string)P[4];
            string ServerChallenge = (string)P[5];
            string c;
            string Proof = null;
            bool ServerNonceChecked = false;
 
            foreach (KeyValuePair<string, string> Pair in this.ParseCommaSeparatedParameterList(Request))
            {
                switch (Pair.Key.ToLower())
                {
                    case "c":
                        c = Pair.Value;
                        break;
 
                    case "r":
                        ServerNonceChecked = true;
                        if (ServerNonce != Pair.Value)
                        {
                            await Connection.SaslErrorMalformedRequest();
                            LoginAuditor.Fail("Login attempt using malformed request.", UserName, Connection.RemoteEndpoint, Connection.Protocol);
                            return null;
                        }
                        break;
 
                    case "p":
                        Proof = Pair.Value;
                        break;
                }
            }
 
            if (!ServerNonceChecked)
            {
                await Connection.SaslErrorMalformedRequest();
                LoginAuditor.Fail("Login attempt using malformed request.", UserName, Connection.RemoteEndpoint, Connection.Protocol);
                return null;
            }
 
            IAccount Account = await PersistenceLayer.GetAccount(UserName);
            if (Account is null)
            {
                LoginAuditor.Fail("Login attempt using invalid user name.", UserName, Connection.RemoteEndpoint, Connection.Protocol,
                    new KeyValuePair<string, object>("UserName", UserName));
                await Connection.SaslErrorNotAuthorized();
                return null;
            }
 
            if (!Account.Enabled)
            {
                LoginAuditor.Fail("Login attempt using disabled account.", UserName, Connection.RemoteEndpoint, Connection.Protocol);
                await Connection.SaslErrorAccountDisabled();
                return null;
            }
 
            byte[] SaltedPassword = this.Hi(Encoding.UTF8.GetBytes(Account.Password.Normalize()), salt, NrIterations);
            byte[] ClientKey = this.HMAC(SaltedPassword, clientKey);
            byte[] StoredKey = this.H(ClientKey);
            StringBuilder sb;
 
            sb = new StringBuilder();
 
            int i;
 
            i = ClientRequest.IndexOf("n=");
            if (i < 0)
                sb.Append(ClientRequest);
            else
                sb.Append(ClientRequest.Substring(i));
 
            sb.Append(',');
            sb.Append(ServerChallenge);
            sb.Append(',');
 
            i = Request.IndexOf(",p=");
            if (i < 0)
                sb.Append(Request);
            else
                sb.Append(Request.Substring(0, i));
 
            byte[] AuthenticationMessage = Encoding.UTF8.GetBytes(sb.ToString());
            byte[] ClientSignature = this.HMAC(StoredKey, AuthenticationMessage);
            byte[] ClientProof = XOR(ClientKey, ClientSignature);
 
            byte[] ServerKey = this.HMAC(SaltedPassword, serverKey);
            byte[] ServerSignature = this.HMAC(ServerKey, AuthenticationMessage);
 
            string ClientProofStr = Convert.ToBase64String(ClientProof);
            if (Proof == ClientProofStr)
            {
                await Connection.SetAccount(Account);
 
                string Response = "v=" + Convert.ToBase64String(ServerSignature);
                Response = Convert.ToBase64String(Encoding.UTF8.GetBytes(Response));
 
                Connection.ResetState(true);
                await Connection.SaslSuccess(Response);
                LoginAuditor.Success("Login successful.", UserName, Connection.RemoteEndpoint, Connection.Protocol);
            }
            else
            {
                await Connection.SaslErrorNotAuthorized();
                LoginAuditor.Fail("Login attempt failed.", UserName, Connection.RemoteEndpoint, Connection.Protocol);
            }
 
            return null;
        }
 
        private byte[] Hi(byte[] String, byte[] Salt, int NrIterations)
        {
            byte[] U1 = this.HMAC(String, CONCAT(Salt, One));
            byte[] U2 = this.HMAC(String, U1);
            byte[] Response = XOR(U1, U2);
 
            while (NrIterations > 2)
            {
                U1 = U2;
                U2 = this.HMAC(String, U1);
                Response = XOR(Response, U2);
                NrIterations--;
            }
 
            return Response;
        }
 
        private static readonly byte[] One = new byte[] { 0, 0, 0, 1 };
 
        public override async Task Initialize()
        {
            saltBase64 = await GetSaltBase64("XMPP.SCRAM.Server.Salt");
            salt = Convert.FromBase64String(saltBase64);
        }
 
        public static async Task<string> GetSaltBase64(string Key)
        {
            string Result = await RuntimeSettings.GetAsync(Key, string.Empty);
            if (string.IsNullOrEmpty(Result))
            {
                byte[] Bin = new byte[32];
 
                using (RandomNumberGenerator Rnd = RandomNumberGenerator.Create())
                {
                    Rnd.GetBytes(Bin);
                }
 
                Result = Convert.ToBase64String(Bin);
                await RuntimeSettings.SetAsync(Key, Result);
            }
 
            return Result;
        }
 
        public override async Task<bool?> Authenticate(string UserName, string Password, ISaslClientSide Connection)
        {
            string Nonce = Convert.ToBase64String(GetRandomBytes(16));
            string s = "n,,n=" + UserName + ",r=" + Nonce;
            byte[] Data = Encoding.UTF8.GetBytes(s);
            string Challenge = await Connection.Initiate(this, Convert.ToBase64String(Data));
            byte[] ChallengeBinary = Convert.FromBase64String(Challenge);
            string ChallengeString = Encoding.UTF8.GetString(ChallengeBinary);
            string ServerNonce = null;
            string SaltString;
            int NrIterations = 0;
            byte[] Salt = null;
 
            foreach (KeyValuePair<string, string> Pair in this.ParseCommaSeparatedParameterList(ChallengeString))
            {
                switch (Pair.Key.ToLower())
                {
                    case "r":
                        ServerNonce = Pair.Value;
                        break;
 
                    case "s":
                        SaltString = Pair.Value;
                        Salt = Convert.FromBase64String(SaltString);
                        break;
 
                    case "i":
                        NrIterations = int.Parse(Pair.Value);
                        break;
                }
            }
 
            if (string.IsNullOrEmpty(ServerNonce) || !ServerNonce.StartsWith(Nonce) || Salt is null || NrIterations <= 0)
                return null;
 
            byte[] SaltedPassword = this.Hi(Encoding.UTF8.GetBytes(Password.Normalize()), Salt, NrIterations);
 
            byte[] ClientKey = this.HMAC(SaltedPassword, Encoding.UTF8.GetBytes("Client Key"));
            byte[] StoredKey = this.H(ClientKey);
 
            StringBuilder sb;
 
            sb = new StringBuilder();
            sb.Append("n=");
            sb.Append(UserName);
            sb.Append(",r=");
            sb.Append(Nonce);
            sb.Append(',');
            sb.Append(ChallengeString);
            sb.Append(",c=biws,r=");
            sb.Append(ServerNonce);
 
            byte[] AuthenticationMessage = Encoding.UTF8.GetBytes(sb.ToString());
            byte[] ClientSignature = this.HMAC(StoredKey, AuthenticationMessage);
            byte[] ClientProof = XOR(ClientKey, ClientSignature);
 
            byte[] ServerKey = this.HMAC(SaltedPassword, Encoding.UTF8.GetBytes("Server Key"));
            byte[] ServerSignatureBinary = this.HMAC(ServerKey, AuthenticationMessage);
 
            string ServerSignature = Convert.ToBase64String(ServerSignatureBinary);
 
            sb = new StringBuilder();
            sb.Append("c=biws,r=");     // biws="n,,"
            sb.Append(ServerNonce);
            sb.Append(",p=");
            sb.Append(Convert.ToBase64String(ClientProof));
 
            string Success = await Connection.FinalResponse(this, Convert.ToBase64String(Encoding.UTF8.GetBytes(sb.ToString())));
            if (string.IsNullOrEmpty(Success))
                return true;
 
            byte[] ResponseBinary = Convert.FromBase64String(Success);
            string ResponseString = Encoding.UTF8.GetString(ResponseBinary);
 
            foreach (KeyValuePair<string, string> Pair in this.ParseCommaSeparatedParameterList(ResponseString))
            {
                if (string.Compare(Pair.Key, "v", true) == 0)
                    return (Pair.Value == ServerSignature);
            }
 
            return false;
        }
 
    }
}