From eff5cdc41f1d542c2a3d6b7be6f99de29376f5cb Mon Sep 17 00:00:00 2001 From: HimbeerserverDE Date: Fri, 17 Feb 2023 22:38:24 +0100 Subject: exclude password from hash used in client proof --- srp/src/server.rs | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'srp/src/server.rs') diff --git a/srp/src/server.rs b/srp/src/server.rs index e1eb331..08c0475 100644 --- a/srp/src/server.rs +++ b/srp/src/server.rs @@ -145,13 +145,13 @@ impl<'a, D: Digest> SrpServer<'a, D> { let mut d = D::new(); d.update(username); - let identity_hash = d.finalize(); + let username_hash = d.finalize(); let key = self.compute_premaster_secret(&a_pub, &v, &u, &b); let m1 = compute_m1::( self.params, - identity_hash.as_slice(), + username_hash.as_slice(), &a_pub.to_bytes_be(), &b_pub.to_bytes_be(), &key.to_bytes_be(), -- cgit v1.2.3