BNETDocs Redux

The New Logon System is based on SRP, the Secure Remote Password protocol, which was designed to obviate the need to send a password,
or its cryptographic equivalent, across a network. This page exists to provide a basic introduction to this protocol. For detailed
explanations and information, see RFC 2945.

In this document, % indicates modulo division, * is multiplication, - is subtraction, and + is addition.

The Server Key (B)

The server key, referred to in the SRP specification as 'B', is a public key generated by the server. A new key is generated for each session. The server sends
this key to the client in S > C [0x53] SID_AUTH_ACCOUNTLOGON.

The Client Key (A)

The client key, referred to in the SRP specification as 'A', is a 256-bit public key generated by the client. A new key is generated for each session. It is generated thus:

A = g^a % N

This value is sent to the server along with the client's username in C > S [0x53] SID_AUTH_ACCOUNTLOGON

The Generator (g)

This value is a constant used generate public keys. Its value is 47 (0x2F).

The Random Value (a)

A random value generated by the client, such that 0 <= a <= N.

The Modulus (N)

N is a large (256-bit) unsigned integer. All SRP calculations are done modulo N. Its value is:

Decimal: 112624315653284427036559548610503669920632123929604336254260115573677366691719

Hex: 0xF8FF1A8B619918032186B68CA092B5557E976C78C73212D91216F6658523C787

Or, in C:

unsigned char N[] = 0x87, 0xc7, 0x23, 0x85, 0x65, 0xf6, 0x16, 0x12, 0xd9, 0x12, 0x32, 0xc7, 0x78, 0x6c, 0x97, 0x7e, 0x55, 0xb5, 0x92, 0xa0, 0x8c, 0xb6, 0x86, 0x21, 0x03, 0x18, 0x99, 0x61, 0x8b, 0x1a, 0xff, 0xf8

The Salt (s)

The salt is a 256-bit random value generated by the client when an account is created. After creation, it is never changed. It is sent to the server in C > S [0x52] SID_AUTH_ACCOUNTCREATE,
and recieved from the server during logons in S > C [0x53] SID_AUTH_ACCOUNTLOGON.

The Verifier (v)

The verifier is a 256-bit value calculated by the client when an account is created. After creation, it is never changed. It is sent to the server in C > S [0x52] SID_AUTH_ACCOUNTCREATE.
It is generated thus:

v = g^x % N

Username & Password Hash (x)

x is a value generated by the client based on the username, password, and salt value. In this formula, a comma (,) indicates concatenation:

SHA1(s, SHA1(Username, ":", Password))

Username and password are converted to UPPER CASE before hashing.

u

Todo: Explain me.

This value is the first four bytes of SHA1(B). This differs slightly from standard SRP, in which this value is generated by the server and sent to the client along with the server key (B).

The Secret (S) (I need a better name)

S is where the magic of NLS happens. Both the client and the server calculate S, using different formulae, and end up with the same result.

Client: S = ((N + B - v) % N)^{(a + u * x)} % N

Server: S = (A * (v^u % N))^b % N

If the Server and Client agree on the value of S, the logon succeeds, otherwise, it fails.

Password Proof (K)

This value is generated by the client and the server as proof that they actually know the value of S. This is another value which differs from standard SRP, which justs sends SHA1(S).
Blizzard's version calculates K as follows:

Place the even bytes of S into one buffer, and the odd bytes into another.

Create a SHA-1 hash of each buffer

Create K by combining the even bytes of the first buffer, and the odd bytes of the second.

Client Password Proof (M₁)

This value is sent to Battle.net to prove that you know your own password. Again, this differs from standard SRP. In this formula, commas (,) indicate concatenation:

M₁ = SHA1(SHA1(g) xor SHA1(N), SHA1(Username), s, A, B, K)

Username and password are converted to UPPER CASE prior to hashing. This value is sent to the server in C > S [0x54] SID_AUTH_ACCOUNTLOGONPROOF

Server Password Proof (M₂)

M₂ = SHA1(A, M[1], K)

Most of the information on this page has come from iago's notes. For more, see his page on the topic.

Links

RSS Feeds