SRP6 TrinityCore 实现错误？

Question

TrinityCore 弃用了 auth table 上的旧 sha_pass_hash 列，支持更安全的 SRP6 方法。但是，我无法使用 example provided here. I've looked at examples but it doesn't seem to be working the way that the TrinityCore developers suggest. Does anyone know about SRP6 that might be able to figure out what's wrong in the code? I've also looked at this example 在 PHP 中正确计算 C#/dotnet NOR 中的验证器，但它使用了硬编码盐？如果有人能告诉我 PHP 有什么问题，我也许就能弄清楚 .NET

有什么问题

我尝试的代码看起来最接近第一个示例，但我将数组翻转为小端。

           public byte[] CalculateVerifier(string username, string password, byte[] salt)
        {
                if (BitConverter.IsLittleEndian)
                {
                    return BigInteger.ModPow(
                                   g,
                                   new BigInteger(Hash(salt, Hash(Encoding.UTF8.GetBytes($"{username.ToUpper()}:{password.ToUpper()}")))),
                                   N
                               ).ToByteArray();
                }
                else
                {
                    return BigInteger.ModPow(
                                   g,
                                   new BigInteger(Hash(salt, Hash(Encoding.UTF8.GetBytes($"{username.ToUpper()}:{password.ToUpper()}")).Reverse().ToArray())),
                                   N
                               ).ToByteArray();
                }
            

        }
        public bool VerifySRP6Login(string username, string password, byte[] salt, byte[] verifier)
        {
            // re-calculate the verifier using the provided username + password and the stored salt
            byte[] checkVerifier = CalculateSRP6Verifier(username, password, salt);
            Console.WriteLine($"{Encoding.ASCII.GetString(verifier)} {verifier.Length} bytes\n{Encoding.ASCII.GetString(checkVerifier)} {checkVerifier.Length} bytes");
            Console.WriteLine($"{new BigInteger(verifier)}\n{new BigInteger(checkVerifier)}");
            // compare it against the stored verifier
            return verifier.SequenceEqual(checkVerifier);
        }
        public byte[] Hash(byte[] componentOne, byte[] componentTwo)
        {
            if (componentOne == null) throw new ArgumentNullException(nameof(componentOne));
            if (componentTwo == null) throw new ArgumentNullException(nameof(componentTwo));

            //WoW expects non-secure SHA1 hashing. SRP6 is deprecated too. We need to do it anyway
            using (SHA1 shaProvider = SHA1.Create())
            {
                //See Jackpoz's Combine function
                return shaProvider.ComputeHash(componentOne.Concat(componentTwo).ToArray());
            }
        }
        public byte[] Hash(byte[] bytes)
        {
            if (bytes == null) throw new ArgumentNullException(nameof(bytes));

            //WoW expects non-secure SHA1 hashing. SRP6 is deprecated too. We need to do it anyway
            using (SHA1 shaProvider = SHA1.Create())
            {
                return shaProvider.ComputeHash(bytes);
            }
        }

Answer 1

答案是在 this solution 中找到的，显然我没有正确地制作我的 BigInteger，因为数据是一个无符号整数，而我将其视为有符号。

SRP6 TrinityCore 实现错误？

SRP6 TrinityCore Implementation wrong?

.net

php

mysql

srp-protocol

trinitycore