use native BigInt instead of the big-integer library

.github/workflows/node.js.yml

@@ -27,7 +27,7 @@ jobs:
           --name firebird \
           -e FIREBIRD_ROOT_PASSWORD="masterkey" \
           -e FIREBIRD_CONF_WireCrypt="Enabled" \
-          -e FIREBIRD_CONF_AuthServer="Legacy_Auth;Srp;Win_Sspi" \
+          -e FIREBIRD_CONF_AuthServer="Srp256;Srp;Legacy_Auth" \
           -p 3050:3050 \
           -v /firebird/data:/firebird/data \
           firebirdsql/firebird:${{ matrix.firebird }}

lib/srp.js

@@ -1,20 +1,20 @@
-var BigInt = require('big-integer'),
-    crypto = require('crypto');
+var crypto = require('crypto');
 
 const SRP_KEY_SIZE = 128,
+  SRP_PRIVATE_KEY_SIZE = 32,
   SRP_KEY_MAX = BigInt('340282366920938463463374607431768211456'), // 1 << SRP_KEY_SIZE
   SRP_SALT_SIZE = 32;
 
 const DEBUG = false;
-const DEBUG_PRIVATE_KEY = BigInt('84316857F47914F838918D5C12CE3A3E7A9B2D7C9486346809E9EEFCE8DE7CD4259D8BE4FD0BCC2D259553769E078FA61EE2977025E4DA42F7FD97914D8A33723DFAFBC00770B7DA0C2E3778A05790F0C0F33C32A19ED88A12928567749021B3FD45DCD1CE259C45325067E3DDC972F87867349BA82C303CCCAA9B207218007B', 16);
+const DEBUG_PRIVATE_KEY = BigInt('0x84316857F47914F838918D5C12CE3A3E7A9B2D7C9486346809E9EEFCE8DE7CD4259D8BE4FD0BCC2D259553769E078FA61EE2977025E4DA42F7FD97914D8A33723DFAFBC00770B7DA0C2E3778A05790F0C0F33C32A19ED88A12928567749021B3FD45DCD1CE259C45325067E3DDC972F87867349BA82C303CCCAA9B207218007B');
 
 /**
  * Prime values.
  *
  * @type {{g: (bigInt.BigInteger), k: (bigInt.BigInteger), N: (bigInt.BigInteger)}}
  */
 const PRIME = {
-    N: BigInt('E67D2E994B2F900C3F41F08F5BB2627ED0D49EE1FE767A52EFCD565CD6E768812C3E1E9CE8F0A8BEA6CB13CD29DDEBF7A96D4A93B55D488DF099A15C89DCB0640738EB2CBDD9A8F7BAB561AB1B0DC1C6CDABF303264A08D1BCA932D1F1EE428B619D970F342ABA9A65793B8B2F041AE5364350C16F735F56ECBCA87BD57B29E7', 16),
+    N: BigInt('0xE67D2E994B2F900C3F41F08F5BB2627ED0D49EE1FE767A52EFCD565CD6E768812C3E1E9CE8F0A8BEA6CB13CD29DDEBF7A96D4A93B55D488DF099A15C89DCB0640738EB2CBDD9A8F7BAB561AB1B0DC1C6CDABF303264A08D1BCA932D1F1EE428B619D970F342ABA9A65793B8B2F041AE5364350C16F735F56ECBCA87BD57B29E7'),
     g: BigInt(2),
     k: BigInt('1277432915985975349439481660349303019122249719989')
 };
@@ -25,8 +25,8 @@ const PRIME = {
  * @param a bigInt.BigInteger Client private key.
  * @returns {{private: bigInt.BigInteger, public: bigInt.BigInteger}}
  */
-exports.clientSeed = function(a = toBigInt(crypto.randomBytes(SRP_KEY_SIZE))) {
-    var A = PRIME.g.modPow(a, PRIME.N);
+exports.clientSeed = function(a = toBigInt(crypto.randomBytes(SRP_PRIVATE_KEY_SIZE))) {
+    var A = modPow(PRIME.g, a, PRIME.N);
 
     dump('a', a);
     dump('A', A);
@@ -46,11 +46,11 @@ exports.clientSeed = function(a = toBigInt(crypto.randomBytes(SRP_KEY_SIZE))) {
  * @param b bigInt.BigInteger Server private key.
  * @returns {{private: bigInt.BigInteger, public: bigInt.BigInteger}}
  */
-exports.serverSeed = function(user, password, salt, b = toBigInt(crypto.randomBytes(SRP_KEY_SIZE))) {
+exports.serverSeed = function(user, password, salt, b = toBigInt(crypto.randomBytes(SRP_PRIVATE_KEY_SIZE))) {
     var v = getVerifier(user, password, salt);
-    var gb = PRIME.g.modPow(b, PRIME.N);
-    var kv = PRIME.k.multiply(v).mod(PRIME.N);
-    var B = kv.add(gb).mod(PRIME.N);
+    var gb = modPow(PRIME.g, b, PRIME.N);
+    var kv = (PRIME.k * v) % PRIME.N;
+    var B = (kv + gb) % PRIME.N;
 
     dump('v', v);
     dump('b', b);
@@ -75,25 +75,42 @@ exports.serverSeed = function(user, password, salt, b = toBigInt(crypto.randomBy
  * @param b bigInt.BigInteger Server private key.
  * @returns {bigInt.BigInteger}
  */
-exports.serverSession = function(user, password, salt, A, B, b) {
-    var u = getScramble(A, B);
-    var v = getVerifier(user, password, salt);
-    var vu = v.modPow(u, PRIME.N);
-    var Avu = A.multiply(vu).mod(PRIME.N);
-    var sessionSecret = Avu.modPow(b, PRIME.N);
-    var K = getHash('sha1', toBuffer(sessionSecret));
+exports.serverSession = function(user, password, salt, A, B, b, hashAlgo) {
+    A = toBigInt(A);
+    B = toBigInt(B);
+    b = toBigInt(b);
 
-    dump('server sessionSecret', sessionSecret);
-    dump('server K', K);
-
-    return BigInt(K, 16);
+    var u = getScramble(A, B);
+    var x = getUserHash(user, salt, password);
+    var ux = (u * x) % PRIME.N;
+    var vu = modPow(PRIME.g, ux, PRIME.N);
+    var Avu = (A * vu) % PRIME.N;
+    var sessionSecret = modPow(Avu, b, PRIME.N);
+
+    var K = getHash(hashAlgo || 'sha1', toBuffer(sessionSecret));
+
+    dump('Server A (Client Public Key)', A);
+    dump('Server B (Server Public Key)', B);
+    dump('Server u (Scramble) = H(A, B)', u);
+    dump('Server x (User Hash) = H(s, H(u, : , p))', x);
+    dump('Server ux (u * x % N)', ux);
+    dump('Server vu (g^ux % N)', vu);
+    dump('Server Avu (A * vu % N)', Avu);
+    dump('server sessionSecret (S = Avu^b % N)', sessionSecret);
+    dump('server K = H(S)', K);
+
+    return BigInt('0x' + K);
 };
 
 /**
  * M = H(H(N) xor H(g), H(I), s, A, B, K)
  */
 exports.clientProof = function(user, password, salt, A, B, a, hashAlgo) {
-    var K = clientSession(user, password, salt, A, B, a);
+    A = toBigInt(A);
+    B = toBigInt(B);
+    a = toBigInt(a);
+
+    var K = clientSession(user, password, salt, A, B, a, hashAlgo);
     var n1, n2;
 
     n1 = toBigInt(getHash('sha1', toBuffer(PRIME.N)));
@@ -102,7 +119,7 @@ exports.clientProof = function(user, password, salt, A, B, a, hashAlgo) {
     dump('n1', n1);
     dump('n2', n2);
 
-    n1 = n1.modPow(n2, PRIME.N);
+    n1 = modPow(n1, n2, PRIME.N);
     n2 = toBigInt(getHash('sha1', user));
     var M = toBigInt(getHash(hashAlgo, toBuffer(n1), toBuffer(n2), salt, toBuffer(A), toBuffer(B), toBuffer(K)));
 
@@ -137,6 +154,10 @@ exports.hexPad = hexPad;
 function pad(n) {
     var buff = Buffer.from(hexPad(n.toString(16)), 'hex');
 
+    if (buff.length < SRP_KEY_SIZE) {
+        var prefix = Buffer.alloc(SRP_KEY_SIZE - buff.length, 0);
+        buff = Buffer.concat([prefix, buff]);
+    }
     if (buff.length > SRP_KEY_SIZE) {
         buff = buff.slice(buff.length - SRP_KEY_SIZE, buff.length);
     }
@@ -152,7 +173,7 @@ function pad(n) {
  * @returns {bigInt.BigInteger}
  */
 function getScramble(A, B) {
-    return BigInt(getHash('sha1', pad(A), pad(B)), 16);
+    return BigInt('0x' + getHash('sha1', pad(A), pad(B)));
 }
 
 /**
@@ -170,35 +191,32 @@ function getScramble(A, B) {
  * @param B bigInt.BigInteger Server public key.
  * @param a bigInt.BigInteger Client private key.
  */
-function clientSession(user, password, salt, A, B, a) {
+function clientSession(user, password, salt, A, B, a, hashAlgo) {
     var u = getScramble(A, B);
     var x = getUserHash(user, salt, password);
-    var gx = PRIME.g.modPow(x, PRIME.N);
-    var kgx = PRIME.k.multiply(gx).mod(PRIME.N);
-    var diff = B.subtract(kgx).mod(PRIME.N);
+    var gx = modPow(PRIME.g, x, PRIME.N);
+    var kgx = (PRIME.k * gx) % PRIME.N;
+    var diff = (B - kgx) % PRIME.N;
 
-    if (diff.lesser(0)) {
-        diff = diff.add(PRIME.N);
+    if (diff < 0n) {
+        diff = diff + PRIME.N;
     }
 
-    // Note: While the SRP specification says exponents should not be reduced mod N,
-    // the Firebird engine implementation does reduce these exponents mod N.
-    // We must match the server's behavior for authentication to succeed.
-    var ux = u.multiply(x).mod(PRIME.N);
-    var aux = a.add(ux).mod(PRIME.N);
-    var sessionSecret = diff.modPow(aux, PRIME.N);
-    var K = toBigInt(getHash('sha1', toBuffer(sessionSecret)));
-
-    dump('B', B);
-    dump('u', u);
-    dump('x', x);
-    dump('gx', gx);
-    dump('kgx', kgx);
-    dump('diff', diff);
-    dump('ux', ux);
-    dump('aux', aux);
-    dump('sessionSecret', sessionSecret);
-    dump('sessionKey(K)', K);
+    var ux = (u * x) % PRIME.N;
+    var aux = (a + ux) % PRIME.N;
+    var sessionSecret = modPow(diff, aux, PRIME.N);
+    var K = toBigInt(getHash(hashAlgo || 'sha1', toBuffer(sessionSecret)));
+
+    dump('Client B (Server Public Key)', B);
+    dump('Client u (Scramble) = H(A, B)', u);
+    dump('Client x (User Hash) = H(s, H(u, : , p))', x);
+    dump('Client gx (g^x % N)', gx);
+    dump('Client kgx (k * gx % N)', kgx);
+    dump('Client diff (B - kgx % N)', diff);
+    dump('Client ux (u * x % N)', ux);
+    dump('Client aux (a + ux)', aux);
+    dump('Client sessionSecret (S = diff^aux % N)', sessionSecret);
+    dump('Client sessionKey(K) = H(S)', K);
 
     return K;
 }
@@ -227,7 +245,7 @@ function getUserHash(user, salt, password) {
  * @returns {bigInt.BigInteger}
  */
 function getVerifier(user, password, salt) {
-    return PRIME.g.modPow(getUserHash(user, salt, password), PRIME.N);
+    return modPow(PRIME.g, getUserHash(user, salt, password), PRIME.N);
 }
 
 /**
@@ -254,7 +272,7 @@ function getHash(algo, ...data) {
  * @returns {*}
  */
 function toBuffer(bigInt) {
-    return Buffer.from(BigInt.isInstance(bigInt) ? hexPad(bigInt.toString(16)) : bigInt, 'hex');
+    return Buffer.from(typeof bigInt === 'bigint' ? hexPad(bigInt.toString(16)) : bigInt, 'hex');
 }
 
 /**
@@ -264,7 +282,39 @@ function toBuffer(bigInt) {
  * @returns {bigInt.BigInteger}
  */
 function toBigInt(hex) {
-    return BigInt(Buffer.isBuffer(hex) ? hex.toString('hex') : hex, 16);
+    if (hex == null) {
+        return 0n;
+    }
+    if (typeof hex === 'bigint') {
+        return hex;
+    }
+    if (typeof hex === 'number') {
+        try {
+            return BigInt(Math.trunc(hex));
+        } catch (e) {
+            return 0n;
+        }
+    }
+
+    if (Buffer.isBuffer(hex)) {
+        return BigInt('0x' + hex.toString('hex'));
+    }
+
+    const str = String(hex);
+    // Fix: Hex strings often contain 'e' (e.g. '1e2f...').
+    // Only treat as scientific notation/float if it contains a dot
+    // or if it is NOT a valid hex string.
+    const isHex = /^[0-9a-fA-F]+$/.test(str);
+
+    if (str.includes('.') || (!isHex && str.toLowerCase().includes('e'))) {
+        try {
+            return BigInt(Math.trunc(Number(str)));
+        } catch (e) {
+            return 0n;
+        }
+    }
+
+    return BigInt('0x' + str);
 }
 
 /**
@@ -275,10 +325,26 @@ function toBigInt(hex) {
  */
 function dump(key, value) {
     if (DEBUG) {
-        if (BigInt.isInstance(value)) {
+        if (typeof value === 'bigint') {
             value = value.toString(16);
         }
 
         console.log(key + '=' + value);
     }
+}
+
+/**
+ * Calculates (base ^ exp) % mod using native BigInt.
+ */
+function modPow(base, exp, mod) {
+    let result = 1n;
+    base = base % mod;
+    while (exp > 0n) {
+        if (exp & 1n) {
+            result = (result * base) % mod;
+        }
+        base = (base * base) % mod;
+        exp >>= 1n;
+    }
+    return result;
 }

lib/wire/connection.js

@@ -1,7 +1,6 @@
 const Events = require('events');
 const os = require('os');
 const path = require('path');
-const BigInt = require('big-integer');
 
 const {XdrWriter, BlrWriter, XdrReader, BitSet, BlrReader} = require('./serialize');
 const {doCallback, doError} = require('../callback');
@@ -1762,7 +1761,7 @@ function decodeResponse(data, callback, cnx, lowercase_keys, cb) {
                             // Server keys
                             cnx.serverKeys = {
                                 salt: d.buffer.slice(2, saltLen + 2).toString('utf8'),
-                                public: BigInt(d.buffer.slice(keyStart, d.buffer.length).toString('utf8'), 16)
+                                public: BigInt('0x' + d.buffer.slice(keyStart, d.buffer.length).toString('utf8'))
                             };
 
                             var proof = srp.clientProof(

package.json

@@ -28,7 +28,6 @@
         "test": "vitest run"
     },
     "dependencies": {
-        "big-integer": "^1.6.51",
         "long": "^5.2.3"
     },
     "devDependencies": {

test/index.js

@@ -20,12 +20,12 @@
 
 describe('Connection', function () {
 
     it('should attach or create database', async function () {
         const db = await fromCallback(cb => Firebird.attachOrCreate(config, cb));
         await fromCallback(cb => db.detach(cb));
     });
 
     it('should reconnect when socket is closed', { timeout: 5000 }, async function () {
         const db = await fromCallback(cb => Firebird.attach(config, cb));
 
         db.connection._socket.destroy();
@@ -47,12 +47,12 @@
     });
 
     var testCreateConfig = Config.extends(config, {database: config.database.replace(/\.fdb/, '2.fdb')});
     it('should create', async function() {
         const db = await fromCallback(cb => Firebird.create(testCreateConfig, cb));
         await fromCallback(cb => db.detach(cb));
     });
 
     it('should drop', async function() {
         await fromCallback(cb => Firebird.drop(testCreateConfig, cb));
     });
 
@@ -70,7 +70,7 @@
 
     let db;
 
     beforeAll(async function () {
         db = await fromCallback(cb => Firebird.attachOrCreate(config, cb));
         await fromCallback(cb => db.query(table_sql, [], cb));
         await fromCallback(cb => db.query(`CREATE TRIGGER TRG_TEST_TRIGGER FOR TEST_EVENTS AFTER INSERT OR UPDATE AS BEGIN POST_EVENT('TRG_TEST_EVENTS'); END`, [], cb));
@@ -154,7 +154,7 @@
     });
 
     // On firebird 2.5 or higher with only Legacy_Auth enabled on server for fallback to Srp on Legacy or Srp connect
     it('should attach on firebird 3.0 and fallback to Legacy or Srp', async function () {
         const db = await fromCallback(cb => Firebird.attachOrCreate(Config.extends(config), cb));
         await fromCallback(cb => db.detach(cb));
     });
@@ -172,16 +172,24 @@
 
     describe('FB3 - Srp', function () {
         // Must be test with firebird 3.0 or higher with Srp enable on server
-        it('should attach with srp plugin', async function () {
+        it('should attach with srp plugin', { timeout: 20000 }, async function () {
             const db = await fromCallback(cb => Firebird.attachOrCreate(Config.extends(config, { pluginName: Firebird.AUTH_PLUGIN_SRP }), cb));
             await fromCallback(cb => db.detach(cb));
         });
 
         // FB 3.0 : Should be tested with Srp256 enabled on server configuration
-        /*it('should attach with srp 256 plugin', async function () {
-            const db = await fromCallback(cb => Firebird.attachOrCreate(Config.extends(config, { pluginName: Firebird.AUTH_PLUGIN_SRP256 }), cb));
-            await fromCallback(cb => db.detach(cb));
-        });*/
+        it('should attach with srp 256 plugin', { timeout: 20000 }, async function () {
+            try {
+                const db = await fromCallback(cb => Firebird.attachOrCreate(Config.extends(config, { pluginName: Firebird.AUTH_PLUGIN_SRP256 }), cb));
+                await fromCallback(cb => db.detach(cb));
+            } catch (e) {
+                if (e.message.indexOf('Server don\'t accept plugin : Srp256') !== -1) {
+                    console.log('Skipping test: Server does not support Srp256');
+                    return;
+                }
+                throw e;
+            }
+        });
     });
 });
 
@@ -190,7 +198,7 @@
     var poolSize = 2;
     var pool;
 
     beforeAll(async function () {
         // create database if not exists (case of run only this test sequence)
         const db = await fromCallback(cb => Firebird.attachOrCreate(config, cb));
         await fromCallback(cb => db.detach(cb));
@@ -198,7 +206,7 @@
     });
 
     afterAll(async function () {
         await fromCallback(cb => pool.destroy(cb));
     });
 
     it('should wait when all connections are in use', function () {
@@ -238,7 +246,7 @@
     var blobSize = fs.readFileSync(blobPath).length;
     var db;
 
     beforeAll(async function() {
         db = await fromCallback(cb => Firebird.attachOrCreate(config, cb));
         await fromCallback(cb => db.query(TEST_TABLE, cb));
     });