src/AWSSDK.Extensions.CognitoAuthentication/Util/AuthenticationHelper.cs
/// <summary>
/// Creates the Password Authentication Key based on the SRP protocol
/// </summary>
/// <param name="userID"> Username of CognitoUser</param>
/// <param name="userPassword">Password of CognitoUser</param>
/// <param name="poolName">PoolName of CognitoUserPool (part of poolID after "_")</param>
/// <param name="Aa">Returned from TupleAa</param>
/// <param name="B">BigInteger SRPB from AWS ChallengeParameters</param>
/// <param name="salt">BigInteger salt from AWS ChallengeParameters</param>
/// <returns>Returns the password authentication key for the SRP protocol</returns>
Creates the Password Authentication Key based on the SRP protocol
Creates the Password Authentication Key based on the SRP protocol
internal static byte[] GetPasswordAuthenticationKey(string userID, 
            string userPassword, 
            string poolName,
            Tuple<BigInteger, BigInteger> Aa, 
            BigInteger B, 
            BigInteger salt)
        {
            byte[] contentBytes = Util.CombineBytes(new byte[][] { Aa.Item1.ToByteArray(), B.ToByteArray() });
            byte[] digest = Util.Sha256.ComputeHash(contentBytes);
            BigInteger u = new BigInteger(1, digest);
            if (u.Equals(BigInteger.Zero))
            {
                throw new ArgumentException("Hash of A and B cannot be zero.");
            }
            byte[] userIdContent = Util.CombineBytes(new byte[][] { Encoding.UTF8.GetBytes(poolName), Encoding.UTF8.GetBytes(userID),
                                                Encoding.UTF8.GetBytes(":"), Encoding.UTF8.GetBytes(userPassword)});
            byte[] userIdHash = Util.Sha256.ComputeHash(userIdContent);
            byte[] xBytes = Util.CombineBytes(new byte[][] { salt.ToByteArray(), userIdHash });
            byte[] xDigest = Util.Sha256.ComputeHash(xBytes);
            BigInteger x = new BigInteger(1, xDigest);
            BigInteger k = CreateKForGeneratingIkm();
            BigInteger ikm = (B.Subtract(k.Multiply(g.ModPow(x, N))).ModPow(Aa.Item2.Add(u.Multiply(x)), N)).Mod(N);
            Hkdf hkdf = new Hkdf(u.ToByteArray(), ikm.ToByteArray());
            return hkdf.Expand(Encoding.UTF8.GetBytes(DerivedKeyInfo), DerivedKeySize);
        }
internal static byte [ ] GetPasswordAuthenticationKey ( string userID , string userPassword , string poolName , Tuple < BigInteger , BigInteger > Aa , BigInteger B , BigInteger salt ) { byte [ ] contentBytes = Util . CombineBytes ( new byte [ ] [ ] { Aa . Item1 . ToByteArray ( ) , B . ToByteArray ( ) } ) ; byte [ ] digest = Util . Sha256 . ComputeHash ( contentBytes ) ; BigInteger u = new BigInteger ( 1 , digest ) ; if ( u . Equals ( BigInteger . Zero ) ) { throw new ArgumentException ( " " ) ; } byte [ ] userIdContent = Util . CombineBytes ( new byte [ ] [ ] { Encoding . UTF8 . GetBytes ( poolName ) , Encoding . UTF8 . GetBytes ( userID ) , Encoding . UTF8 . GetBytes ( " " ) , Encoding . UTF8 . GetBytes ( userPassword ) } ) ; byte [ ] userIdHash = Util . Sha256 . ComputeHash ( userIdContent ) ; byte [ ] xBytes = Util . CombineBytes ( new byte [ ] [ ] { salt . ToByteArray ( ) , userIdHash } ) ; byte [ ] xDigest = Util . Sha256 . ComputeHash ( xBytes ) ; BigInteger x = new BigInteger ( 1 , xDigest ) ; BigInteger k = CreateKForGeneratingIkm ( ) ; BigInteger ikm = ( B . Subtract ( k . Multiply ( g . ModPow ( x , N ) ) ) . ModPow ( Aa . Item2 . Add ( u . Multiply ( x ) ) , N ) ) . Mod ( N ) ; Hkdf hkdf = new Hkdf ( u . ToByteArray ( ) , ikm . ToByteArray ( ) ) ; return hkdf . Expand ( Encoding . UTF8 . GetBytes ( DerivedKeyInfo ) , DerivedKeySize ) ; }
Creates the Password Authentication Key based on the SRP protocol
Creates the Password Authentication Key based on the SRP protocol
// Authenticate the password // u = H(A, B) // x = H(salt | H(poolName | userId | ":" | password)) // Create k for generating the ikm S // Use HKDF to get final password authentication key
Returns the password authentication key for the SRP protocol
Returns the password authentication key for the SRP protocol
userID
string
Username of CognitoUser
Username of CognitoUser
userPassword
string
Password of CognitoUser
Password of CognitoUser
poolName
string
PoolName of CognitoUserPool (part of poolID after "_")
PoolName of CognitoUserPool ( part of poolID after " _ " )
Aa
Tuple<BigInteger, BigInteger>
Returned from TupleAa
Returned from TupleAa
B
BigInteger
BigInteger SRPB from AWS ChallengeParameters
BigInteger SRPB from AWS ChallengeParameters
salt
BigInteger
BigInteger salt from AWS ChallengeParameters
BigInteger salt from AWS ChallengeParameters