CodeReview

[Glusk]

https://github.com/Glusk2/wse/blob/71028ef255745912b082a144ce9027a610c67152/wse-common/src/main/java/com/github/glusk2/wse/common/crypto/srp6/SRP6HashedSesKey.java#L29

Signature should be redefined to return a byte array.

---

Classes:

• SRP6CltSesKey.java
• SRP6SrvSesKey.java
• SRP6HashedSesKey.java

should be renamed in order to avoid confusion regarding the session key. What is now called a session key is more often referred to as <premaster secret> (RFC5054: Appendix B. SRP Test Vectors) or secret (BouncyCastle). In order to obtain a more secure session key, the secret is typically hashed in some way.

---

Is this (InMemoryRecord) class really needed?

---

MySqlRecord doesn't handle unknown users properly - RFC5054: 2.5.1.3. Unknown SRP User Name. In order to fix this, the following is needed:

• HMAC SHA-1 implementation,
• FakeRecord implementation.

[Glusk]

InMemoryRecord and MySqlRecord related problems can be resolved separately, each in it's own issue.