@ruc-cheese/node-srp-rs

A high-performance Secure Remote Password (SRP-6a) protocol implementation for Node.js, powered by Rust.

Overview

This library provides a blazing-fast implementation of the Secure Remote Password (SRP-6a) protocol using Rust with N-API bindings for Node.js.

SRP is a password-authenticated key exchange protocol that allows secure authentication without sending passwords over the network.

Features

• 🚀 High Performance: Up to 15x faster than JavaScript implementations
• 🔒 Full SRP-6a Protocol: Complete implementation of the SRP-6a protocol
• 💻 Native Node.js Bindings: Seamless integration with Node.js applications
• 🔄 API Compatible: Drop-in replacement for secure-remote-password
• 🧪 Thoroughly Tested: Comprehensive test suite ensures correctness
• 🔐 RFC 5054 Support: All five parameter groups (1024, 1536, 2048, 3072, 4096 bits)

Installation

Install using your preferred package manager:

# npm
npm install @ruc-cheese/node-srp-rs

# yarn
yarn add @ruc-cheese/node-srp-rs

# pnpm
pnpm add @ruc-cheese/node-srp-rs

Usage

ESM (Recommended)

import { Client, Server, SrpGroup } from '@ruc-cheese/node-srp-rs';

// Create client and server instances with default parameters (2048-bit group)
const client = new Client();
const server = new Server();

// Or specify a different parameter group
const client4096 = new Client(SrpGroup.RFC5054_4096);
const server4096 = new Server(SrpGroup.RFC5054_4096);

// Registration phase
const salt = client.generateSalt();
const privateKey = client.derivePrivateKey(salt, username, password);
const verifier = client.deriveVerifier(privateKey);

// Store salt and verifier on server
// ...

// Authentication phase
// 1. Client generates ephemeral key pair
const clientEphemeral = client.generateEphemeral();

// 2. Server generates ephemeral key pair using stored verifier
const serverEphemeral = server.generateEphemeral(verifier);

// 3. Client computes session and proof
const clientSession = client.deriveSession(
  clientEphemeral.secret,
  serverEphemeral.public,
  salt,
  username,
  privateKey
);

// 4. Server verifies client proof and generates server proof
const serverSession = server.deriveSession(
  serverEphemeral.secret,
  clientEphemeral.public,
  salt,
  username,
  verifier,
  clientSession.proof
);

// 5. Client verifies server proof
client.verifySession(
  clientEphemeral.public,
  clientSession,
  serverSession.proof
);

// Both client and server now have matching session keys
console.log(clientSession.key === serverSession.key); // true

CommonJS

const { Client, Server, SrpGroup } = require('@ruc-cheese/node-srp-rs');

// Same usage as above

API Reference

Client

• new Client(group?): Creates a new client instance with optional parameter group
• client.generateSalt(): Generates a random salt for password hashing
• client.derivePrivateKey(salt, username, password): Derives private key from credentials
• client.deriveVerifier(privateKey): Generates a password verifier from private key
• client.generateEphemeral(): Creates client ephemeral key pair
• client.deriveSession(secret, serverPublic, salt, username, privateKey, [clientPublic]): Computes session key and proof
• client.verifySession(clientPublic, clientSession, serverProof): Verifies server session proof

Server

• new Server(group?): Creates a new server instance with optional parameter group
• server.generateEphemeral(verifier): Creates server ephemeral key pair
• server.deriveSession(secret, clientPublic, salt, username, verifier, clientProof): Verifies client proof and generates server proof

SrpGroup Enum

The library supports all five parameter groups defined in RFC 5054:

• SrpGroup.RFC5054_1024: 1024-bit group
• SrpGroup.RFC5054_1536: 1536-bit group
• SrpGroup.RFC5054_2048: 2048-bit group (default)
• SrpGroup.RFC5054_3072: 3072-bit group
• SrpGroup.RFC5054_4096: 4096-bit group

You can also create a group from a bit size using the utility function:

const { srp_group_from_value } = require('@ruc-cheese/node-srp-rs');

try {
  const group = srp_group_from_value(4096);
  const client = new Client(group);
  // ...
} catch (err) {
  console.error('Invalid SRP group size');
}

Performance

This Rust implementation significantly outperforms JavaScript SRP implementations:

Benchmark Results

| Operation | JS (jsbn) Time/Op | JS (BigInt) Time/Op | Rust Time/Op | BigInt vs jsbn | Rust vs jsbn | |-----------|-------------------|---------------------|--------------|----------------|--------------| | Salt Generation | 0.013 ms | 0.006 ms | 0.001 ms | 2.07x | 10.60x | | Private Key Derivation | 0.015 ms | 0.009 ms | 0.003 ms | 1.55x | 5.14x | | Verifier Generation | 8.890 ms | 2.217 ms | 0.575 ms | 4.01x | 15.45x | | Client Ephemeral Generation | 9.221 ms | 2.600 ms | 0.654 ms | 3.55x | 14.11x | | Server Ephemeral Generation | 9.063 ms | 2.238 ms | 0.730 ms | 4.05x | 12.41x | | Client Session Derivation | 36.613 ms | 9.382 ms | 2.638 ms | 3.90x | 13.88x | | Server Session Derivation | 27.177 ms | 6.852 ms | 1.855 ms | 3.97x | 14.65x | | Complete Authentication Flow | 84.076 ms | 19.956 ms | 5.273 ms | 4.21x | 15.95x |

Implementation Comparison:

• JS (jsbn): Original JavaScript implementation using the jsbn library for BigInt operations
• JS (BigInt): Improved JavaScript implementation using native BigInt in Node.js
• Rust: This library's Rust implementation with NAPI bindings

The Rust implementation is on average 12.77x faster than the original JavaScript implementation and 3.75x faster than the BigInt-based JavaScript implementation.

License

MIT

Acknowledgements

• Based on the work of secure-remote-password

Contributing

Contributions are welcome! Please feel free to submit a Pull Request.