Skip to content

Fix Auth with device and device confirmation #183

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 3 commits into
base: main
Choose a base branch
from

Conversation

hgarcianareia
Copy link

Issue #, if available:
N/A

Description of changes:
This pull request fixes an issue where the wrong property was being passed during authentication — username was used instead of deviceKey. To address this, the correct property is now passed. As a result of this fix, several property names and method signatures were updated to reflect the correct usage and improve clarity.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

@peterrsongg peterrsongg requested a review from ashishdhingra May 14, 2025 17:30
@afroz429 afroz429 requested a review from normj May 15, 2025 16:48
@ashishdhingra
Copy link
Contributor

@hgarcianareia While we review your PR, could you please remove .DS_STORE files included in this PR?

@ashishdhingra
Copy link
Contributor

ashishdhingra commented May 15, 2025

Change to use username instead of deviceKey was introduced in 7dc118c.

Per Signing in with a device, below pseudocode demonstrates how to calculate values for DEVICE_PASSWORD_VERIFIER challenge response:

PASSWORD_CLAIM_SECRET_BLOCK = SECRET_BLOCK
TIMESTAMP = "Tue May 27 00:09:40 UTC 2025"
k = SHA256(N || g) as a non-negative integer in big-endian
u = SHA256(SRP_A || SRP_B) as a non-negative integer in big-endian
x = SHA256(salt || SHA256(DeviceGroupKey || DeviceKey || ":" || DeviceSecret)) as a non-negative integer in big-endian
S_USER = (SRP_B - k * g^x)^(a + u * x) % N
K_USER = HKDF_HMAC_SHA256(salt=u, ikm=S_USER, info="Caldera Derived Key", length=16 bytes)
PASSWORD_CLAIM_SIGNATURE = Base64(HMAC_SHA256(key=K_USER, message=(DeviceGroupKey || DeviceKey || PASSWORD_CLAIM_SECRET_BLOCK || TIMESTAMP)))

Excludes macOS .DS_Store files from the repository to prevent unnecessary clutter and potential issues.
@ashishdhingra
Copy link
Contributor

ashishdhingra commented May 22, 2025

@hgarcianareia Your changes revert the update made in commit 7dc118c. Do you have detailed description of issue, steps to reproduce and/or some link to specification that validates your fix? We just don't want to inadvertently break something.

EDIT: I tried to test your changes locally, but it gives Amazon.CognitoIdentityProvider.Model.NotAuthorizedException: 'Incorrect username or password.'. Refer #73 (comment) to details. Do you happen to have the repo setup steps and code for troubleshooting?

Thanks,
Ashish

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants