erikmav / passport-sqrl Goto Github PK

The current default implementation of nut generation uses a cryptographic pseudo-random number generator. The SQRL spec allows for this but also recommends the server implement a deeper scheme that creates a 128-bit structure and encrypt it using a server secret. This blob can contain an IPv4 or 32 bits of a hash of an IPv6, along with other information. On return of the nut to the server, the server and decrypt the nut and determine that the nut is not too old, and set a TIF flag in its next response indicating to the SQRL client whether IP that retrieved the nut is the same as the one that returned it to the server.

This feature will require at minimum a static server secret (e.g. a passphrase) to feed the encryption key. More ideally the secret and key should vary over time, updating once in awhile, with the server attempting to decrypt from two or more recent keys.

ed25519 does not work with node 12.

gaoxiangxyz/ed25519#1

Version 0.1.0 does not include support for the SQRL remove command.

• Add API support and needed updates to ISQRLIdentityStorage
• Add MockSqrlClient support
• Add pure unit tests
• Add integration tests
• Update documentation and push new package version.

Maybe it's just me not being a passport.js ninja (yet..) but I read the explanation under ##Using ... and looked at the code, and I feel like there is some info missing. If someone has this figured, maybe a screencast that shows the integration points and a sentence or two about the integration steps?

Version 0.1.0 does not include support for enable+disable.

• Add API support
• Add needed interface updates for ISQRLIdentityStorage
• Add support in the MockSqrlClient
• Add pure unit tests
• Add integration tests
• Update documentation and push new package version.

Some changes to the SQRL protocol happened recently (sometime Jan-Feb?) that forces all clients to upgrade. And such changes might happen again.

It would be awesome if the README could somehow clarify its compatibility level.

Maybe the SQRL protocol has some kind of version numbers?