QcLoginCrypto Namespace
The few cryptographic steps of the minimal login (decision E-252), all HMAC-SHA256 from QtCore: a password key stretched with PBKDF2, a player identity per server derived from the player's installation key, proofs bound to the nonce of one connection and a short fingerprint of an identity. More...
| Header: | #include <common/auth/QcLoginCrypto.h> |
Types
| enum class | Purpose { Password, Identity } |
Variables
| const qsizetype | fingerprintBytes |
| const qsizetype | keyBytes |
| const int | passwordRounds |
Functions
| bool | equal(QByteArrayView a, QByteArrayView b) |
| QString | fingerprint(QByteArrayView identity) |
| QByteArray | hmac(QByteArrayView key, QByteArrayView data) |
| QByteArray | identity(QByteArrayView installationKey, QByteArrayView salt) |
| QByteArray | passwordKey(const QString &password, QByteArrayView salt) |
| QByteArray | pbkdf2(QByteArrayView password, QByteArrayView salt, int rounds) |
| QByteArray | proof(QByteArrayView key, QByteArrayView nonce, QcLoginCrypto::Purpose purpose) |
| QByteArray | randomBytes(qsizetype count) |
Detailed Description
Nothing here encrypts the connection.
Type Documentation
enum class QcLoginCrypto::Purpose
What a proof proves.
| Constant | Value | Description |
|---|---|---|
QcLoginCrypto::Purpose::Password | 0 | The server password. |
QcLoginCrypto::Purpose::Identity | 1 | The player's identity. |
Variable Documentation
const qsizetype QcLoginCrypto::fingerprintBytes
The bytes of SHA-256 a fingerprint keeps.
const qsizetype QcLoginCrypto::keyBytes
The size of a key and an identity (an HMAC-SHA256 output).
const int QcLoginCrypto::passwordRounds
PBKDF2 rounds of the password key: the client pays them once per login, the server once per start; they slow down guessing a password from a recorded login.
Function Documentation
bool QcLoginCrypto::equal(QByteArrayView a, QByteArrayView b)
Returns whether a and b are equal, in time independent of where the bytes differ.
QString QcLoginCrypto::fingerprint(QByteArrayView identity)
Returns the lower-case hex of the first fingerprintBytes of SHA-256 of identity: shown to operators and kept in access.json.
QByteArray QcLoginCrypto::hmac(QByteArrayView key, QByteArrayView data)
Returns the HMAC-SHA256 of data with key.
QByteArray QcLoginCrypto::identity(QByteArrayView installationKey, QByteArrayView salt)
Returns the player's identity on a server: derived from installationKey and the server's salt, so no two servers see the same identity and none learns the installation key.
QByteArray QcLoginCrypto::passwordKey(const QString &password, QByteArrayView salt)
Returns the key both sides derive from the server password and the server's salt; empty without a password.
QByteArray QcLoginCrypto::pbkdf2(QByteArrayView password, QByteArrayView salt, int rounds)
Returns PBKDF2-HMAC-SHA256 of password and salt over rounds, with one output block (32 bytes).
QByteArray QcLoginCrypto::proof(QByteArrayView key, QByteArrayView nonce, QcLoginCrypto::Purpose purpose)
Returns the HMAC of the connection's nonce with key, separated by purpose.
QByteArray QcLoginCrypto::randomBytes(qsizetype count)
Returns count cryptographically strong random bytes of the system.