mozilla/picl-idp — pull request #276 by rfk (2013-11-06 06:26:28+00:00)
Title: Refactor token classes

This PR implements the latest tweaks to the token derivation/encryption scheme, as described in #189. It also uses the new level of symmetry between operations to support a substantial refactor and consolidation of the code.

Highlights:

* Token.Bundle.bundle and Token.Bundle.unbundle implement the XOR+HMAC encryption logic as standalone functions. Note that they return promises rather than directly computing the buffer.
* The base Token class implements the now-completely-uniform derivation of tokenid+authkey+bundlekey along with some helper methods common to all token types
* Each Token subclass is a much skinnier wrapper, basically just filling in the specific HKDF parameters, additional token metadata, and providing type-specific convenience methods
* All Token types have uniform constructor API: TokenClass.create({details}) or TokenClass.fromHex(tokendata, {details})

One potentially-controversial change is that I've made SrpToken work basically the same way as the other tokens - it uses a 32-byte random seed to derive id+authKey+bundleKey, then uses the bundleKey as the server-side secret `b` value. Since the seed is never sent to the client, this should satisfy the requirement that `b` remain secret. I like the code-simplicity produced by this approach, but will understand if it makes folks uncomfortable. I've done that as a separate commit so it's easy to undo.

@dannycoates r?
@warner @ncalexan f?

(The diff is useful for reviewing incidental changes to the code, but I recommend just viewing the new files for ./token/*.js)

Fixes #189 and, as a bonus, #247