OF-3327: Refactor SCRAM key derivation into ScramUtils

Extract the common SCRAM key derivation logic from DefaultAuthProvider into ScramUtils, eliminating duplicated code between password verification and password storage.

Author: guusdk

xmppserver/src/main/java/org/jivesoftware/openfire/auth/DefaultAuthProvider.java

@@ -16,7 +16,6 @@
 
 package org.jivesoftware.openfire.auth;
 
-import java.security.MessageDigest;
 import java.security.NoSuchAlgorithmException;
 import java.security.SecureRandom;
 import java.sql.Connection;
@@ -345,17 +344,16 @@ public boolean checkPassword(String username, String testPassword) throws UserNo
                 Log.debug("No available SCRAM-SHA-1 credentials for checkPassword for user {}", username);
                 return false;
             }
-            final byte[] testStoredKey;
             try {
                 final byte[] saltShaker = DatatypeConverter.parseBase64Binary(credential.salt);
-                final byte[] saltedPassword = ScramUtils.createSaltedPassword(saltShaker, testPassword, credential.iterations, ScramSha1SaslServer.HMAC_ALGORITHM_NAME);
-                final byte[] clientKey = ScramUtils.computeHmac(saltedPassword, "Client Key", ScramSha1SaslServer.HMAC_ALGORITHM_NAME);
-                testStoredKey = MessageDigest.getInstance(ScramSha1SaslServer.DIGEST_ALGORITHM_NAME).digest(clientKey);
+                final ScramUtils.ScramKeys keys = ScramUtils.deriveScramKeys(
+                    saltShaker, testPassword, credential.iterations,
+                    ScramSha1SaslServer.HMAC_ALGORITHM_NAME, ScramSha1SaslServer.DIGEST_ALGORITHM_NAME);
+                return DatatypeConverter.printBase64Binary(keys.storedKey).equals(credential.storedKey);
             } catch(SaslException | NoSuchAlgorithmException | IllegalArgumentException e) {
                 Log.warn("Unable to check SCRAM values for PLAIN authentication for user '{}'", username, e);
                 return false;
             }
-            return DatatypeConverter.printBase64Binary(testStoredKey).equals(credential.storedKey);
         }
         catch (SQLException sqle) {
             Log.warn("A database error occurred while authenticating user {}:", username, sqle);
@@ -388,15 +386,15 @@ public void setPassword(String username, String password) throws UserNotFoundExc
         byte[] saltShaker = new byte[SALT_LENGTH];
         random.nextBytes(saltShaker);
         final String salt = DatatypeConverter.printBase64Binary(saltShaker);
+        ScramUtils.ScramKeys keys = null;
         final int iterations = ScramSha1SaslServer.ITERATION_COUNT.getValue();
-        byte[] saltedPassword = null, clientKey = null, storedKey = null, serverKey = null;
         try {
-            saltedPassword = ScramUtils.createSaltedPassword(saltShaker, password, iterations, ScramSha1SaslServer.HMAC_ALGORITHM_NAME);
-            clientKey = ScramUtils.computeHmac(saltedPassword, "Client Key", ScramSha1SaslServer.HMAC_ALGORITHM_NAME);
-            storedKey = MessageDigest.getInstance(ScramSha1SaslServer.DIGEST_ALGORITHM_NAME).digest(clientKey);
-            serverKey = ScramUtils.computeHmac(saltedPassword, "Server Key", ScramSha1SaslServer.HMAC_ALGORITHM_NAME);
+            keys = ScramUtils.deriveScramKeys(
+                saltShaker, password, iterations,
+                ScramSha1SaslServer.HMAC_ALGORITHM_NAME,
+                ScramSha1SaslServer.DIGEST_ALGORITHM_NAME);
         } catch (SaslException | NoSuchAlgorithmException e) {
-            Log.warn("Unable to persist values for SCRAM authentication.");
+            Log.warn("Unable to derive SCRAM credential while trying to persist values for SCRAM authentication", e);
         }
 
         String plaintextToStore = password;
@@ -453,8 +451,8 @@ public void setPassword(String username, String password) throws UserNotFoundExc
                     ScramSha1SaslServer.MECHANISM_NAME,
                     salt,
                     iterations,
-                    storedKey == null ? null : DatatypeConverter.printBase64Binary(storedKey),
-                    serverKey == null ? null : DatatypeConverter.printBase64Binary(serverKey)
+                    keys == null ? null : DatatypeConverter.printBase64Binary(keys.storedKey),
+                    keys == null ? null : DatatypeConverter.printBase64Binary(keys.serverKey)
                 )
             );
         }

xmppserver/src/main/java/org/jivesoftware/openfire/auth/ScramUtils.java

@@ -20,6 +20,7 @@
 
 import java.nio.charset.StandardCharsets;
 import java.security.InvalidKeyException;
+import java.security.MessageDigest;
 import java.security.NoSuchAlgorithmException;
 
 import javax.crypto.Mac;
@@ -41,6 +42,32 @@ public class ScramUtils {
 
     private ScramUtils() {}
 
+    /**
+     * Derives the stored key and server key for a SCRAM credential.
+     *
+     * The keys are derived from the supplied password using the specified salt, iteration count, HMAC algorithm and
+     * digest algorithm, as defined by the SCRAM specification.
+     *
+     * @param salt the salt.
+     * @param password the plaintext password.
+     * @param iterations the SCRAM iteration count.
+     * @param hmacAlgorithm the HMAC algorithm (for example {@code HmacSHA1} or {@code HmacSHA256}).
+     * @param digestAlgorithm the digest algorithm corresponding to the HMAC algorithm (for example {@code SHA-1} or {@code SHA-256}).
+     * @return the derived stored key and server key.
+     * @throws SaslException if the salted password or HMAC values cannot be derived.
+     * @throws NoSuchAlgorithmException if the requested digest algorithm is unavailable.
+     */
+    public static ScramKeys deriveScramKeys(final byte[] salt, final String password, final int iterations, final String hmacAlgorithm, final String digestAlgorithm) throws SaslException, NoSuchAlgorithmException
+    {
+        final byte[] saltedPassword = createSaltedPassword(salt, password, iterations, hmacAlgorithm);
+        final byte[] clientKey = computeHmac(saltedPassword, "Client Key", hmacAlgorithm);
+        final byte[] storedKey = MessageDigest.getInstance(digestAlgorithm).digest(clientKey);
+
+        final byte[] serverKey = computeHmac(saltedPassword, "Server Key", hmacAlgorithm);
+
+        return new ScramKeys(storedKey, serverKey);
+    }
+
     /**
      * Computes a salted password ({@code Hi(password, salt, iterations)} as defined in RFC 5802), using the provided
      * HMAC algorithm.
@@ -151,4 +178,23 @@ public static Mac createSha1Hmac(final byte[] keyBytes) throws SaslException
     {
         return createHmac(keyBytes, ScramSha1SaslServer.HMAC_ALGORITHM_NAME);
     }
+
+    /**
+     * The derived SCRAM keys for a password.
+     *
+     * These keys are derived from a password, salt and iteration count as defined by the SCRAM specification. The
+     * stored key is persisted and used to verify client authentication, while the server key is used by the server when
+     * constructing SCRAM protocol messages.
+     */
+    public static final class ScramKeys
+    {
+        public final byte[] storedKey;
+        public final byte[] serverKey;
+
+        private ScramKeys(byte[] storedKey, byte[] serverKey)
+        {
+            this.storedKey = storedKey;
+            this.serverKey = serverKey;
+        }
+    }
 }

xmppserver/src/test/java/org/jivesoftware/openfire/auth/ScramUtilsTest.java

@@ -165,4 +165,28 @@ public void testScramSha1ComputeHmac2() throws Exception
         // Verify results.
         assertArrayEquals(StringUtils.decodeHex("0fe09258b3ac852ba502cc62ba903eaacdbf7d31"), result); // test against 'server key' from the test vectors.
     }
+
+    /**
+     * Verifies the implementation of {@link ScramUtils#deriveScramKeys(byte[], String, int, String, String)}
+     * by using SCRAM-SHA-1(-PLUS) test vectors that are provided by the XSF.
+     *
+     * @see <a href="https://wiki.xmpp.org/web/SASL_Authentication_and_SCRAM">XSF SCRAM test vectors.</a>
+     */
+    @Test
+    public void testScramSha1DeriveScramKeys() throws Exception
+    {
+        // Setup test fixture.
+        final byte[] salt = StringUtils.decodeHex("4125c247e43ab1e93c6dff76");
+        final String password = "pencil";
+        final int iterations = 4096;
+        final String hmacAlgorithm = "HmacSHA1";
+        final String digestAlgorithm = "SHA-1";
+
+        // Execute system under test.
+        final ScramUtils.ScramKeys result = ScramUtils.deriveScramKeys(salt, password, iterations, hmacAlgorithm, digestAlgorithm);
+
+        // Verify results.
+        assertArrayEquals(StringUtils.decodeHex("e9d94660c39d65c38fbad91c358f14da0eef2bd6"), result.storedKey);
+        assertArrayEquals(StringUtils.decodeHex("0fe09258b3ac852ba502cc62ba903eaacdbf7d31"), result.serverKey);
+    }
 }