diff --git a/application/config/resources.php b/application/config/resources.php index 58c4162b..da46d034 100644 --- a/application/config/resources.php +++ b/application/config/resources.php @@ -100,5 +100,13 @@ 'trinity_sha' => [ 'name' => 'TrinityCore (SHA Hash)', 'urn' => 'TC' + ], + 'trinitySRP1' => [ + 'name' => 'TrinityCore (SRP6 V1)', + 'urn' => 'TC' + ], + 'trinitySRP2' => [ + 'name' => 'TrinityCore (SRP6 V2)', + 'urn' => 'TC' ] ]; diff --git a/application/helpers/extra_helper.php b/application/helpers/extra_helper.php index ac7fdafc..670ae7f4 100644 --- a/application/helpers/extra_helper.php +++ b/application/helpers/extra_helper.php @@ -319,6 +319,9 @@ function decrypt($data) */ function client_pwd_hash($username, $password, $type = null, $salt = null) { + is_string($username) || $username = ''; + is_string($password) || $password = ''; + switch ($type) { case 'bnet': return strtoupper(bin2hex(strrev(hex2bin(strtoupper(hash('sha256', strtoupper(hash('sha256', strtoupper($username)) . ':' . strtoupper($password)))))))); @@ -326,7 +329,6 @@ function client_pwd_hash($username, $password, $type = null, $salt = null) case 'hex': $client = new \Laizerox\Wowemu\SRP\UserClient($username, $salt); return strtoupper($client->generateVerifier($password)); - case 'srp6': // Constants $g = gmp_init(7); @@ -345,6 +347,45 @@ function client_pwd_hash($username, $password, $type = null, $salt = null) $verifier = str_pad($verifier, 32, chr(0), STR_PAD_RIGHT); return $verifier; + case 'srp6v1': + // Set the value of generator 'g' to 2. + $g = gmp_init(2); + // Set the value of the safe prime 'N' using the gmp_init() function. + $N = gmp_init('86A7F6DEEB306CE519770FE37D556F29944132554DED0BD68205E27F3231FEF5A10108238A3150C59CAF7B0B6478691C13A6ACF5E1B5ADAFD4A943D4A21A142B800E8A55F8BFBAC700EB77A7235EE5A609E350EA9FC19F10D921C2FA832E4461B7125D38D254A0BE873DFC27858ACB3F8B9F258461E4373BC3A6C2A9634324AB'); + + // Calculate the hash value 'h' using the hash() function with SHA-256 and gmp_import(). + $h = gmp_import(hash('sha256', $salt . hash('sha256', strtoupper(hash('sha256', strtoupper($username), false) . ':' . substr($password, 0, 16)), true), true), 1, GMP_LSW_FIRST); + + // Calculate the verifier using gmp_powm() and convert it to a byte string. + $verifier = str_pad(gmp_export(gmp_powm($g, $h, $N), 1, GMP_LSW_FIRST), 128, chr(0), STR_PAD_RIGHT); + + // Return an array with the value 'verifier'. + return $verifier; + + case 'srp6v2': + // Define algorithm constants + $g = gmp_init(2); // Generator + $N = gmp_init('AC6BDB41324A9A9BF166DE5E1389582FAF72B6651987EE07FC3192943DB56050A37329CBB4A099ED8193E0757767A13DD52312AB4B03310DCD7F48A9DA04FD50E8083969EDB767B0CF6095179A163AB3661A05FBD5FAAAE82918A9962F0B93B855F97993EC975EEAA80D740ADBF4FF747359D041D5C33EA71D281E446B14773BCA97B43A23FB801676BD207A436C6481F1D2B9078717461A5B9D32E688F87748544523B524B0D57D5EA77A2775D2ECFA032CFBDBF52FB3786160279004E57AE6AF874E7303CE53299CCC041C7BC308D82A5698F3A8D0C38271AE35F8E9DBFBB694B5C803D89F7AE435DE236D525F54759B65E372FCD68EF20FA7111F9E4AFF73', 16); // Prime + + // Calculate 'x' using PBKDF2 with SHA-512 + $tmp = strtoupper(hash('sha256', strtoupper($username), false)) . ":" . $password; + $iterations = 15000; + $xBytes = hash_pbkdf2("sha512", $tmp, $salt, $iterations, 64, true); + $x = gmp_import($xBytes, 1, GMP_MSW_FIRST); + + // Ensure 'x' is within the range [0, N-1] + if (ord($xBytes[0]) & 0x80) { + $fix = gmp_init('100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000', 16); + $x = gmp_sub($x, $fix); + } + $x = gmp_mod($x, gmp_sub($N, 1)); + + // Calculate the verifier + $verifier = str_pad(gmp_export(gmp_powm($g, $x, $N), 1, GMP_LSW_FIRST), 256, chr(0), STR_PAD_RIGHT); + + // Return an array with the value 'verifier'. + return $verifier; + default: return strtoupper(sha1(strtoupper($username) . ':' . strtoupper($password))); } diff --git a/application/models/Server_auth_model.php b/application/models/Server_auth_model.php index 1d0af7b2..7b6be556 100644 --- a/application/models/Server_auth_model.php +++ b/application/models/Server_auth_model.php @@ -55,7 +55,16 @@ public function create_account($username, $email, $password) $account['salt'] = $salt; $account['verifier'] = client_pwd_hash($username, $password, 'srp6', $salt); break; - + case 'trinitySRP1': + $salt = random_bytes(32); + $account['salt'] = $salt; + $account['verifier'] = client_pwd_hash($username, $password, 'srp6v1', $salt); + break; + case 'trinitySRP2': + $salt = random_bytes(32); + $account['salt'] = $salt; + $account['verifier'] = client_pwd_hash($username, $password, 'srp6v2', $salt); + break; case 'cmangos': $salt = bin2hex(random_bytes(32)); $account['v'] = client_pwd_hash($username, $password, 'hex', $salt);