Module srp 

SRP-4096: the A/B exchange with the server and the crypto behind it.

Structs

SrpInfo 🔒

The account’s public SRP parameters, as returned by v3/auth/start.

Constants

AUTH_ENDPOINT 🔒

CONFIRM_KEY_ENDPOINT 🔒

N_BITS 🔒

The width of the SRP group, and so of every value reduced modulo it.

N_HEX 🔒

SCALAR_BITS 🔒

The width of the SHA-256 values SRP uses as scalars: u, k and x.

SRP_METHOD 🔒

Statics

G 🔒

The SRP group generator.

N 🔒

The 4096-bit SRP group prime (RFC 3526).

N_PARAMS 🔒

The Montgomery form of N, built once.

Functions

calculate_client_hash 🔒

The client verification hash sent to v2/auth/confirm-key: H(H(N) xor H(g) || H(I) || s || A || B || K).

calculate_identity 🔒

SHA256(SHA256(uuid) || SHA256(lower(nfkd(username)))), url-safe base64.

calculate_server_hash 🔒

The server’s answer to calculate_client_hash: H(A || M1 || K), where M1 is the client hash we just sent. A uses the same leading-zero-stripped encoding as the client hash.

compute_k 🔒

The multiplier k = H(N, g), always 3509477ea9fca66eadb7cf7b1bd0eb508f54d3989a9c988006a7d0b338374dd2 for this group.

compute_key 🔒

Computes the SRP session key K.

compute_shared_a 🔒

A = g^a mod N.

compute_u 🔒

The scrambling parameter u = H(A, B), which ties the key to both ephemerals.

compute_x 🔒

Derives SRP x, which proves we know the password without sending it.

exchange_a_for_b 🔒

Sends userA and returns the server’s userB.

from_server_hex 🔒

Parses a value the server sent in the encoding above.

generate_secret_a 🔒

Generates the ephemeral secret a as a random 256-bit value.

mod_n_bytes 🔒

value mod N as big-endian bytes, always the full width of N.

mod_pow 🔒

base ^ exponent mod N, constant time in exponent.

perform 🔒

The exchange itself, with secret_a taken as an argument so tests can pin it.

perform_and_verify_with_x 🔒

Runs the SRP exchange from a precomputed x and labels the key with the session id. The salt only feeds the verification hash.

scalar 🔒

A SHA-256 output as an SRP scalar.

scalar_bytes 🔒

The bytes of x without leading zeros, which a big integer serializer may add. x is a SHA-256 scalar, so a value that still does not fit comes from a malformed credential bundle.

sha256 🔒

to_compatible_byte_array 🔒

Big-endian bytes with leading zeros stripped, the encoding the server hashes over.

to_server_hex 🔒

Hex in the exact format 1Password’s server expects: lowercase, with all leading zero nibbles stripped. The output may be odd-length; that is intentional. Both userA (sent over the wire) and u (the SRP shared secret hashed into the session key) use this encoding, and changing it would break wire compatibility or session-key agreement with the server.

validate_b 🔒

Rejects a server B that is 0 or 1 modulo N, the two values the web client refuses.

verify_key 🔒

Sends the client verification hash to confirm the session key, then checks the server’s answer.