From 48c6ab56a73b830c6fcddd32f44636e8b399be85 Mon Sep 17 00:00:00 2001 From: ausiv4 Date: Sat, 8 Aug 2009 20:50:53 +0000 Subject: This adds upgrade functionality so that existing django apps can switch to SRP. If a user exists in the auth table but not the srp table, the server sends back the algorithm and salt needed to hash the password. The hashed password is used to authenticate the user. After the server authenticates the user and the user verifies the identity of the server, the user sends the password in plaintext. The server uses the plaintext password to calculate the verifier and stores. Finally, the client reinitiates the login process. --- django/srpproject/srp/backends.py | 3 -- django/srpproject/srp/views.py | 72 +++++++++++++++++++++++++---------- django/srpproject/urls.py | 2 + javascript/jsPacker/hash.min.js | 2 +- javascript/jsPacker/srp.min.js | 2 +- javascript/srp.js | 79 +++++++++++++++++++++++++++++++++------ 6 files changed, 125 insertions(+), 35 deletions(-) diff --git a/django/srpproject/srp/backends.py b/django/srpproject/srp/backends.py index 1f13173..8882973 100644 --- a/django/srpproject/srp/backends.py +++ b/django/srpproject/srp/backends.py @@ -19,6 +19,3 @@ class SRPBackend: return SRPUser.objects.get(pk=user_id) except SRPUser.DoesNotExist: return None - - - diff --git a/django/srpproject/srp/views.py b/django/srpproject/srp/views.py index 38d5503..8529fa9 100644 --- a/django/srpproject/srp/views.py +++ b/django/srpproject/srp/views.py @@ -2,7 +2,7 @@ from django.http import HttpResponse -from srp import models +from django.contrib.auth.models import User ### ### General methods @@ -41,7 +41,7 @@ def register_page(request): # Step 1. A client submits a username. If the username is available, we generate a salt, store it, and return it. # Otherwise, we return an error. def register_salt(request): - if models.SRPUser.objects.filter(username=request.POST["I"]).count() > 0: + if User.objects.filter(username=request.POST["I"]).count() > 0: return HttpResponse("Username already in use", mimetype="text/xml") request.session["srp_name"] = request.POST["I"] request.session["srp_salt"] = generate_salt() @@ -50,7 +50,8 @@ def register_salt(request): # Step 2. The client creates the password verifier and sends it to the server, along with a username. def register_user(request): from django.contrib import auth - models.SRPUser(salt=request.session["srp_salt"], username=request.session["srp_name"], verifier=request.POST["v"]).save() + from srp.models import SRPUser + SRPUser(salt=request.session["srp_salt"], username=request.session["srp_name"], verifier=request.POST["v"]).save() del request.session["srp_salt"] del request.session["srp_name"] return HttpResponse("", mimetype="text/xml"); @@ -65,6 +66,7 @@ def register_user(request): # The server responds with the salt and public ephemeral key, B def handshake(request): import random, hashlib + from srp.models import SRPUser randomgen = random.SystemRandom() request.session["srp_I"] = request.POST["I"] A = int(request.POST["A"], 16) @@ -72,15 +74,28 @@ def handshake(request): g = 2 N = 125617018995153554710546479714086468244499594888726646874671447258204721048803 k = 88846390364205216646376352624313659232912717719075174937149043299744712465496 + upgrade = False if A % N == 0: return HttpResponse("Invalid ephemeral key.", mimetype="text/xml") else: try: - user = models.SRPUser.objects.get(username=request.session["srp_I"]) - salt = user.salt - v = int(user.verifier, 16) + user = User.objects.get(username=request.session["srp_I"]) + try: + user = user.srpuser + salt = user.salt + v = int(user.verifier, 16) + # The auth.User exists, but the SRPUser does not + # We need to create an SRPUser to correspond to that auth.User + # Initially, the verifier will be based on the known hash of the password + except SRPUser.DoesNotExist: + salt = generate_salt() + algo, dsalt, hashpass = user.password.split("$") + upgrade = True + x = int(hashlib.sha256(salt + hashlib.sha256(user.username + ":" + hashpass).hexdigest()).hexdigest(), 16) + v = pow(2, x, N) + # We don't want to leak that the username doesn't exist. Make up a fake salt and verifier. - except models.SRPUser.DoesNotExist: + except User.DoesNotExist: salt, x = generate_fake_salt(request.POST["I"]) v = pow(g, x, N) @@ -91,31 +106,26 @@ def handshake(request): u = int(hashlib.sha256("%s%s" % (hex(A)[2:-1],hex(B)[2:-1])).hexdigest(), 16) if B % N != 0 and u % N != 0: break - response = "" % (salt, hex(B)[2:-1]) # Ideally, we could return this response and then calculate M concurrently with the user # Unfortunately, django isn't designed to do computations after responding. # Maybe someone will find a way. S = pow(A*pow(v,u,N), b, N) request.session["srp_S"] = hex(S)[2:-1] Mstr = "%s%s%s" % (hex(A)[2:-1],hex(B)[2:-1],hex(S)[2:-1]) - response = "" % (salt, hex(B)[2:-1]) request.session["srp_M"] = hashlib.sha256(Mstr).hexdigest() + response = "" % (salt, hex(B)[2:-1], " a='%s' d='%s'" % (algo, dsalt) if upgrade else "") return HttpResponse(response, mimetype="text/xml") # Step 2: The client sends its proof of S. The server confirms, and sends its proof of S. def verify(request): import hashlib from django.contrib.auth import login, authenticate - try: - user = authenticate(username=request.session["srp_I"], M=(request.POST["M"], request.session["srp_M"])) - if user: - response = "%s" % hashlib.sha256("%s%s%s" % (request.session["srp_A"], request.session["srp_M"], request.session["srp_S"])).hexdigest() - login(request, user) - else: - response = "Invalid username or password." - except models.SRPUser.DoesNotExist: - # This should only happen when authentication is successful with SRP, but the user isn't in the auth table. - response = "Authentication failed. This is likely a server problem." + user = authenticate(username=request.session["srp_I"], M=(request.POST["M"], request.session["srp_M"])) + if user: + response = "%s" % hashlib.sha256("%s%s%s" % (request.session["srp_A"], request.session["srp_M"], request.session["srp_S"])).hexdigest() + login(request, user) + else: + response = "Invalid username or password." try: del request.session["srp_I"] @@ -125,3 +135,27 @@ def verify(request): except KeyError: pass return HttpResponse(response, mimetype="text/xml") + +def upgrade_auth(request): + import hashlib + if request.POST["M"] == request.session["srp_M"]: + response = "%s" % hashlib.sha256("%s%s%s" % (request.session["srp_A"], request.session["srp_M"], request.session["srp_S"])).hexdigest() + request.session["srp_preauth"] = True + else: + response = "Invalid username or password." + return HttpResponse(response, mimetype="text/xml") + +def upgrade_add_verifier(request): + from srp.models import SRPUser + from django.contrib.auth.models import User + import hashlib + salt = generate_salt() + x = int(hashlib.sha256(salt + hashlib.sha256("%s:%s" % (request.session["srp_I"], request.POST["p"])).hexdigest()).hexdigest(), 16) + user = User.objects.get(username=request.session["srp_I"]) + srpuser = SRPUser() + srpuser.__dict__.update(user.__dict__) + srpuser.verifier = hex(pow(2, x, 125617018995153554710546479714086468244499594888726646874671447258204721048803))[2:-1] + srpuser.salt = salt + srpuser.password = "" + srpuser.save() + return HttpResponse("", mimetype="text/xml") diff --git a/django/srpproject/urls.py b/django/srpproject/urls.py index a2da712..550676e 100644 --- a/django/srpproject/urls.py +++ b/django/srpproject/urls.py @@ -21,4 +21,6 @@ urlpatterns = patterns('', (r'^srp/authenticate/$', views.verify), (r'^srp/login/$', views.login_page), (r'^srp/register/$', views.register_page), + (r'^srp/upgrade/authenticate/$', views.upgrade_auth), + (r'^srp/upgrade/verifier/$', views.upgrade_add_verifier), ) diff --git a/javascript/jsPacker/hash.min.js b/javascript/jsPacker/hash.min.js index badbcca..a34be63 100644 --- a/javascript/jsPacker/hash.min.js +++ b/javascript/jsPacker/hash.min.js @@ -1 +1 @@ -eval(function(p,a,c,k,e,d){e=function(c){return(c35?String.fromCharCode(c+29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)d[e(c)]=k[c]||e(c);k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c]);return p}('l 3U(J){l R(n,s){e 2w=(n<>>(32-s));f 2w};l 3T(1J){e 1f="";e i;e 2d;e 2c;w(i=0;i<=6;i+=2){2d=(1J>>>(i*4+4))&2b;2c=(1J>>>(i*4))&2b;1f+=2d.1O(16)+2c.1O(16)}f 1f};l 1e(1J){e 1f="";e i;e v;w(i=7;i>=0;i--){v=(1J>>>(i*4))&2b;1f+=v.1O(16)}f 1f};l 1K(t){t=t.2o(/\\r\\n/g,"\\n");e u="";w(e n=0;n2n)&&(c<2m)){u+=N.M((c>>6)|2l);u+=N.M((c&1a)|U)}1b{u+=N.M((c>>12)|2k);u+=N.M(((c>>6)&1a)|U);u+=N.M((c&1a)|U)}}f u};e 1H;e i,j;e W=2v 1L(3S);e 1G=2i;e 1F=2h;e 1E=2g;e 1D=2f;e 1C=3R;e A,B,C,D,E;e K;J=1K(J);e O=J.T;e S=2v 1L();w(i=0;i>>29);S.1I((O<<3)&Q);w(1H=0;1H>>(32-2a))}l h(1U,1T){e 1S,1R,1d,1c,18;1d=(1U&28);1c=(1T&28);1S=(1U&1Q);1R=(1T&1Q);18=(1U&2t)+(1T&2t);Y(1S&1R){f(18^28^1d^1c)}Y(1S|1R){Y(18&1Q){f(18^3E^1d^1c)}1b{f(18^1Q^1d^1c)}}1b{f(18^1d^1c)}}l F(x,y,z){f(x&y)|((~x)&z)}l G(x,y,z){f(x&z)|(y&(~z))}l H(x,y,z){f(x^y^z)}l I(x,y,z){f(y^(x|(~z)))}l q(a,b,c,d,x,s,X){a=h(a,h(h(F(b,c,d),x),X));f h(1B(a,s),b)};l p(a,b,c,d,x,s,X){a=h(a,h(h(G(b,c,d),x),X));f h(1B(a,s),b)};l o(a,b,c,d,x,s,X){a=h(a,h(h(H(b,c,d),x),X));f h(1B(a,s),b)};l m(a,b,c,d,x,s,X){a=h(a,h(h(I(b,c,d),x),X));f h(1B(a,s),b)};l 2j(t){e Z;e 1z=t.T;e 27=1z+8;e 2r=(27-(27%2s))/2s;e 1P=(2r+1)*16;e V=1L(1P-1);e 1A=0;e P=0;2q(P<1z){Z=(P-(P%4))/4;1A=(P%4)*8;V[Z]=(V[Z]|(t.L(P)<<1A));P++}Z=(P-(P%4))/4;1A=(P%4)*8;V[Z]=V[Z]|(2p<<1A);V[1P-2]=1z<<3;V[1P-1]=1z>>>29;f V};l 1g(1y){e 1M="",1N="",26,1x;w(1x=0;1x<=3;1x++){26=(1y>>>(1x*8))&3D;1N="0"+26.1O(16);1M=1M+1N.3C(1N.T-2,2)}f 1M};l 1K(t){t=t.2o(/\\r\\n/g,"\\n");e u="";w(e n=0;n2n)&&(c<2m)){u+=N.M((c>>6)|2l);u+=N.M((c&1a)|U)}1b{u+=N.M((c>>12)|2k);u+=N.M(((c>>6)&1a)|U);u+=N.M((c&1a)|U)}}f u};e x=1L();e k,25,1Z,1Y,1X,a,b,c,d;e 1w=7,1v=12,1u=17,1t=22;e 1s=5,1r=9,1q=14,1p=20;e 1o=4,1n=11,1m=16,1l=23;e 1k=6,1j=10,1i=15,1h=21;t=1K(t);x=2j(t);a=2i;b=2h;c=2g;d=2f;w(k=0;k35?String.fromCharCode(c+29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)d[e(c)]=k[c]||e(c);k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c]);return p}('l 41(K){l S(n,s){e 2x=(n<>>(32-s));f 2x};l 3Z(1K){e 1g="";e i;e 2e;e 2d;J(i=0;i<=6;i+=2){2e=(1K>>>(i*4+4))&2c;2d=(1K>>>(i*4))&2c;1g+=2e.1P(16)+2d.1P(16)}f 1g};l 1f(1K){e 1g="";e i;e v;J(i=7;i>=0;i--){v=(1K>>>(i*4))&2c;1g+=v.1P(16)}f 1g};l 1L(u){u=u.2p(/\\r\\n/g,"\\n");e w="";J(e n=0;n2o)&&(c<2n)){w+=O.N((c>>6)|2m);w+=O.N((c&1b)|V)}1c{w+=O.N((c>>12)|2l);w+=O.N(((c>>6)&1b)|V);w+=O.N((c&1b)|V)}}f w};e 1I;e i,j;e W=2w 1M(3Y);e 1H=2j;e 1G=2i;e 1F=2h;e 1E=2g;e 1D=3X;e A,B,C,D,E;e L;K=1L(K);e P=K.U;e T=2w 1M();J(i=0;i>>29);T.1J((P<<3)&R);J(1I=0;1I>>(32-2b))}l h(1V,1U){e 1T,1S,1e,1d,1a;1e=(1V&2a);1d=(1U&2a);1T=(1V&1R);1S=(1U&1R);1a=(1V&2u)+(1U&2u);Z(1T&1S){f(1a^2a^1e^1d)}Z(1T|1S){Z(1a&1R){f(1a^3L^1e^1d)}1c{f(1a^1R^1e^1d)}}1c{f(1a^1e^1d)}}l F(x,y,z){f(x&y)|((~x)&z)}l G(x,y,z){f(x&z)|(y&(~z))}l H(x,y,z){f(x^y^z)}l I(x,y,z){f(y^(x|(~z)))}l t(a,b,c,d,x,s,Y){a=h(a,h(h(F(b,c,d),x),Y));f h(1C(a,s),b)};l q(a,b,c,d,x,s,Y){a=h(a,h(h(G(b,c,d),x),Y));f h(1C(a,s),b)};l o(a,b,c,d,x,s,Y){a=h(a,h(h(H(b,c,d),x),Y));f h(1C(a,s),b)};l m(a,b,c,d,x,s,Y){a=h(a,h(h(I(b,c,d),x),Y));f h(1C(a,s),b)};l 2k(u){e 18;e 1A=u.U;e 28=1A+8;e 2s=(28-(28%2t))/2t;e 1Q=(2s+1)*16;e X=1M(1Q-1);e 1B=0;e Q=0;2r(Q<1A){18=(Q-(Q%4))/4;1B=(Q%4)*8;X[18]=(X[18]|(u.M(Q)<<1B));Q++}18=(Q-(Q%4))/4;1B=(Q%4)*8;X[18]=X[18]|(2q<<1B);X[1Q-2]=1A<<3;X[1Q-1]=1A>>>29;f X};l 1h(1z){e 1N="",1O="",27,1y;J(1y=0;1y<=3;1y++){27=(1z>>>(1y*8))&3K;1O="0"+27.1P(16);1N=1N+1O.3J(1O.U-2,2)}f 1N};l 1L(u){u=u.2p(/\\r\\n/g,"\\n");e w="";J(e n=0;n2o)&&(c<2n)){w+=O.N((c>>6)|2m);w+=O.N((c&1b)|V)}1c{w+=O.N((c>>12)|2l);w+=O.N(((c>>6)&1b)|V);w+=O.N((c&1b)|V)}}f w};e x=1M();e k,26,25,1Z,1Y,a,b,c,d;e 1x=7,1w=12,1v=17,1u=22;e 1t=5,1s=9,1r=14,1q=20;e 1p=4,1o=11,1n=16,1m=23;e 1l=6,1k=10,1j=15,1i=21;u=1L(u);x=2k(u);a=2j;b=2i;c=2h;d=2g;J(k=0;k35?String.fromCharCode(c+29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)d[e(c)]=k[c]||e(c);k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c]);return p}('E 1C(s){C 2o=8;C 74=0;E 1e(x,y){C 44=(x&42)+(y&42);C 7d=(x>>16)+(y>>16)+(44>>16);F(7d<<16)|(44&42)}E S(X,n){F(X>>>n)|(X<<(32-n))}E R(X,n){F(X>>>n)}E 78(x,y,z){F((x&y)^((~x)&z))}E 76(x,y,z){F((x&y)^(x&z)^(y&z))}E 77(x){F(S(x,2)^S(x,13)^S(x,22))}E 7a(x){F(S(x,6)^S(x,11)^S(x,25))}E 7b(x){F(S(x,7)^S(x,18)^R(x,3))}E 7c(x){F(S(x,17)^S(x,19)^R(x,10))}E 6Y(m,l){C K=T 1u(b3,b2,b1,b0,aZ,aY,aX,aW,aV,aU,aT,aS,aR,aQ,aP,aO,aN,aM,aL,aK,aJ,aI,aH,aG,aF,aE,aD,aC,aB,aA,az,ay,ax,aw,av,au,at,as,ar,aq,ap,ao,an,al,ak,aj,ai,ah,ag,af,ae,ad,ab,aa,a9,a8,a7,a6,a5,a4,a3,a2,a1,a0);C Z=T 1u(9Z,9Y,9X,9W,9V,9U,9T,9S);C W=T 1u(64);C a,b,c,d,e,f,g,h,i,j;C 3g,40;m[l>>5]|=2G<<(24-l%32);m[((l+64>>9)<<4)+15]=l;P(C i=0;i>5]|=(1L.1Z(i/2o)&75)<<(24-i%32)}F 3Z}E 70(2n){2n=2n.9R(/\\r\\n/g,"\\n");C 1P="";P(C n=0;n<2n.V;n++){C c=2n.1Z(n);D(c<3f){1P+=2q.2p(c)}J D((c>5I)&&(c<9Q)){1P+=2q.2p((c>>6)|9P);1P+=2q.2p((c&63)|3f)}J{1P+=2q.2p((c>>12)|9O);1P+=2q.2p(((c>>6)&63)|3f);1P+=2q.2p((c&63)|3f)}}F 1P}E 6Z(3e){C 3Y=74?"9N":"9M";C 1L="";P(C i=0;i<3e.V*4;i++){1L+=3Y.2I((3e[i>>2]>>((3-i%4)*8+4))&72)+3Y.2I((3e[i>>2]>>((3-i%4)*8))&72)}F 1L}s=70(s);F 6Z(6Y(6X(s),s.V*2o))}E 3d(){o.i=0;o.j=0;o.S=T 1u()}E 6W(2r){C i,j,t;P(i=0;i<1O;++i)o.S[i]=i;j=0;P(i=0;i<1O;++i){j=(j+o.S[i]+2r[i%2r.V])&1B;t=o.S[i];o.S[i]=o.S[j];o.S[j]=t}o.i=0;o.j=0}E 6V(){C t;o.i=(o.i+1)&1B;o.j=(o.j+o.S[o.i])&1B;t=o.S[o.i];o.S[o.i]=o.S[o.j];o.S[o.j]=t;F o.S[(t+o.S[o.i])&1B]}3d.H.6Q=6W;3d.H.6P=6V;E 6R(){F T 3d()}C 3c=1O;C 2M;C 1r;C 1f;E 6U(x){1r[1f++]^=x&1B;1r[1f++]^=(x>>8)&1B;1r[1f++]^=(x>>16)&1B;1r[1f++]^=(x>>24)&1B;D(1f>=3c)1f-=3c}E 3X(){6U(T 9L().9K())}D(1r==Y){1r=T 1u();1f=0;C t;D(3b.3T=="6J"&&3b.9J<"5"&&2v.6T){C z=2v.6T.6S(32);P(t=0;t>>8;1r[1f++]=t&1B}1f=0;3X();}E 6O(){D(2M==Y){3X();2M=6R();2M.6Q(1r);P(1f=0;1f<1r.V;++1f)1r[1f]=0;1f=0;}F 2M.6P()}E 6N(3W){C i;P(i=0;i<3W.V;++i)3W[i]=6O()}E 3v(){}3v.H.5U=6N;C 1J;C 6M=9H;C 3U=((6M&9G)==9F);E G(a,b,c){D(a!=Y)D("5V"==2W a)o.3z(a,b,c);J D(b==Y&&"2n"!=2W a)o.34(a,1O);J o.34(a,b)}E Q(){F T G(Y)}E 6I(i,x,w,j,c,n){L(--n>=0){C v=x*o[i++]+w[j]+c;c=1d.1W(v/9E);w[j++]=v&9D}F c}E 6K(i,x,w,j,c,n){C 2m=x&2J,2l=x>>15;L(--n>=0){C l=o[i]&2J;C h=o[i++]>>15;C m=2l*l+h*2m;l=2m*l+((m&2J)<<15)+w[j]+(c&6L);c=(l>>>30)+(m>>>15)+2l*h+(c>>>30);w[j++]=l&6L}F c}E 6H(i,x,w,j,c,n){C 2m=x&3V,2l=x>>14;L(--n>=0){C l=o[i]&3V;C h=o[i++]>>14;C m=2l*l+h*2m;l=2m*l+((m&3V)<<14)+w[j]+c;c=(l>>28)+(m>>14)+2l*h;w[j++]=l&9C}F c}D(3U&&(3b.3T=="4z 9B 9A")){G.H.am=6K;1J=30}J D(3U&&(3b.3T!="6J")){G.H.am=6I;1J=26}J{G.H.am=6H;1J=28}G.H.O=1J;G.H.1g=((1<<1J)-1);G.H.1l=(1<<1J);C 3a=52;G.H.6F=1d.2w(2,3a);G.H.3R=3a-1J;G.H.3P=2*1J-3a;C 6G="9z";C 2L=T 1u();C 20,1q;20="0".1Z(0);P(1q=0;1q<=9;++1q)2L[20++]=1q;20="a".1Z(0);P(1q=10;1q<36;++1q)2L[20++]=1q;20="A".1Z(0);P(1q=10;1q<36;++1q)2L[20++]=1q;E 3S(n){F 6G.2I(n)}E 3L(s,i){C c=2L[s.1Z(i)];F(c==Y)?-1:c}E 6n(r){P(C i=o.t-1;i>=0;--i)r[i]=o[i];r.t=o.t;r.s=o.s}E 6m(x){o.t=1;o.s=(x<0)?-1:0;D(x>0)o[0]=x;J D(x<-1)o[0]=x+1l;J o.t=0}E 1G(i){C r=Q();r.2c(i);F r}E 6l(s,b){C k;D(b==16)k=4;J D(b==8)k=3;J D(b==1O)k=8;J D(b==2)k=1;J D(b==32)k=5;J D(b==4)k=2;J{o.5C(s,b);F}o.t=0;o.s=0;C i=s.V,1X=1n,1p=0;L(--i>=0){C x=(k==8)?s[i]&2F:3L(s,i);D(x<0){D(s.2I(i)=="-")1X=1D;5W}1X=1n;D(1p==0)o[o.t++]=x;J D(1p+k>o.O){o[o.t-1]|=(x&((1<<(o.O-1p))-1))<<1p;o[o.t++]=(x>>(o.O-1p))}J o[o.t-1]|=x<<1p;1p+=k;D(1p>=o.O)1p-=o.O}D(k==8&&(s[0]&2G)!=0){o.s=-1;D(1p>0)o[o.t-1]|=((1<<(o.O-1p))-1)<<1p}o.1m();D(1X)G.1t.U(o,o)}E 6k(){C c=o.s&o.1g;L(o.t>0&&o[o.t-1]==c)--o.t}E 66(b){D(o.s<0)F"-"+o.2z().1x(b);C k;D(b==16)k=4;J D(b==8)k=3;J D(b==2)k=1;J D(b==32)k=5;J D(b==4)k=2;J F o.5E(b);C 2B=(1<0){D(p>p)>0){m=1D;r=3S(d)}L(i>=0){D(p>(p+=o.O-k)}J{d=(o[i]>>(p-=k))&2B;D(p<=0){p+=o.O;--i}}D(d>0)m=1D;D(m)r+=3S(d)}}F m?r:"0"}E 65(){C r=Q();G.1t.U(o,r);F r}E 62(){F(o.s<0)?o.2z():o}E 60(a){C r=o.s-a.s;D(r!=0)F r;C i=o.t;r=i-a.t;D(r!=0)F r;L(--i>=0)D((r=o[i]-a[i])!=0)F r;F 0}E 2C(x){C r=1,t;D((t=x>>>16)!=0){x=t;r+=16}D((t=x>>8)!=0){x=t;r+=8}D((t=x>>4)!=0){x=t;r+=4}D((t=x>>2)!=0){x=t;r+=2}D((t=x>>1)!=0){x=t;r+=1}F r}E 5Z(){D(o.t<=0)F 0;F o.O*(o.t-1)+2C(o[o.t-1]^(o.s&o.1g))}E 6j(n,r){C i;P(i=o.t-1;i>=0;--i)r[i+n]=o[i];P(i=n-1;i>=0;--i)r[i]=0;r.t=o.t+n;r.s=o.s}E 6i(n,r){P(C i=n;i=0;--i){r[i+1o+1]=(o[i]>>2k)|c;c=(o[i]&2K)<<1A}P(i=1o-1;i>=0;--i)r[i]=0;r[1o]=c;r.t=o.t+1o+1;r.s=o.s;r.1m()}E 6g(n,r){r.s=o.s;C 1o=1d.1W(n/o.O);D(1o>=o.t){r.t=0;F}C 1A=n%o.O;C 2k=o.O-1A;C 2K=(1<<1A)-1;r[0]=o[1o]>>1A;P(C i=1o+1;i>1A}D(1A>0)r[o.t-1o-1]|=(o.s&2K)<<2k;r.t=o.t-1o;r.1m()}E 6f(a,r){C i=0,c=0,m=1d.1K(a.t,o.t);L(i>=o.O}D(a.t>=o.O}c+=o.s}J{c+=o.s;L(i>=o.O}c-=a.s}r.s=(c<0)?-1:0;D(c<-1)r[i++]=o.1l+c;J D(c>0)r[i++]=c;r.t=i;r.1m()}E 6e(a,r){C x=o.1F(),y=a.1F();C i=x.t;r.t=i+y.t;L(--i>=0)r[i]=0;P(i=0;i=0)r[i]=0;P(i=0;i=x.1l){r[i+x.t]-=x.1l;r[i+x.t+1]=1}}D(r.t>0)r[r.t-1]+=x.am(i,x[i],r,2*i,0,1);r.s=0;r.1m()}E 6c(m,q,r){C 1Y=m.1F();D(1Y.t<=0)F;C 39=o.1F();D(39.t<1Y.t){D(q!=Y)q.2c(0);D(r!=Y)o.1H(r);F}D(r==Y)r=Q();C y=Q(),3O=o.s,6C=m.s;C 2j=o.O-2C(1Y[1Y.t-1]);D(2j>0){1Y.2d(2j,y);39.2d(2j,r)}J{1Y.1H(y);39.1H(r)}C 1z=y.t;C 38=y[1z-1];D(38==0)F;C 3Q=38*(1<1)?y[1z-2]>>o.3P:0);C 6E=o.6F/3Q,6D=(1<=0){r[r.t++]=1;r.U(t,r)}G.1s.2h(1z,t);t.U(y,y);L(y.t<1z)y[y.t++]=0;L(--j>=0){C 35=(r[--i]==38)?o.1g:1d.1W(r[i]*6E+(r[i-1]+e)*6D);D((r[i]+=y.am(0,35,r,j,0,1z))<35){y.2h(j,t);r.U(t,r);L(r[i]<--35)r.U(t,r)}}D(q!=Y){r.2E(1z,q);D(3O!=6C)G.1t.U(q,q)}r.t=1z;r.1m();D(2j>0)r.1h(2j,r);D(3O<0)G.1t.U(r,r)}E 5Y(a){C r=Q();o.1F().1I(a,Y,r);D(o.s<0&&r.1c(G.1t)>0)a.U(r,r);F r}E 1N(m){o.m=m}E 6B(x){D(x.s<0||x.1c(o.m)>=0)F x.3F(o.m);J F x}E 6A(x){F x}E 6z(x){x.1I(o.m,Y,x)}E 6y(x,y,r){x.2g(y,r);o.1v(r)}E 6x(x,r){x.2D(r);o.1v(r)}1N.H.2f=6B;1N.H.2e=6A;1N.H.1v=6z;1N.H.1T=6y;1N.H.1y=6x;E 6a(){D(o.t<1)F 0;C x=o[0];D((x&1)==0)F 0;C y=x&3;y=(y*(2-(x&3K)*y))&3K;y=(y*(2-(x&2F)*y))&2F;y=(y*(2-(((x&33)*y)&33)))&33;y=(y*(2-x*y%o.1l))%o.1l;F(y>0)?o.1l-y:-y}E 1M(m){o.m=m;o.3N=m.6b();o.3M=o.3N&2J;o.6v=o.3N>>15;o.6u=(1<<(m.O-15))-1;o.6w=2*m.t}E 6s(x){C r=Q();x.1F().2h(o.m.t,r);r.1I(o.m,Y,r);D(x.s<0&&r.1c(G.1t)>0)o.m.U(r,r);F r}E 6r(x){C r=Q();x.1H(r);o.1v(r);F r}E 6q(x){L(x.t<=o.6w)x[x.t++]=0;P(C i=0;i>15)*o.3M)&o.6u)<<15))&x.1g;j=i+o.m.t;x[j]+=o.m.am(0,6t,x,i,0,o.m.t);L(x[j]>=x.1l){x[j]-=x.1l;x[++j]++}}x.1m();x.2E(o.m.t,x);D(x.1c(o.m)>=0)x.U(o.m,x)}E 6o(x,r){x.2D(r);o.1v(r)}E 6p(x,y,r){x.2g(y,r);o.1v(r)}1M.H.2f=6s;1M.H.2e=6r;1M.H.1v=6q;1M.H.1T=6p;1M.H.1y=6o;E 69(){F((o.t>0)?(o[0]&1):o.s)==0}E 68(e,z){D(e>9y||e<1)F G.1s;C r=Q(),1a=Q(),g=z.2f(o),i=2C(e)-1;g.1H(r);L(--i>=0){z.1y(r,1a);D((e&(1<0)z.1T(1a,g,r);J{C t=r;r=1a;1a=t}}F z.2e(r)}E 5X(e,m){C z;D(e<1O||m.1k())z=T 1N(m);J z=T 1M(m);F o.3G(e,z)}G.H.1H=6n;G.H.2c=6m;G.H.34=6l;G.H.1m=6k;G.H.2h=6j;G.H.2E=6i;G.H.2d=6h;G.H.1h=6g;G.H.U=6f;G.H.2g=6e;G.H.2D=6d;G.H.1I=6c;G.H.6b=6a;G.H.1k=69;G.H.3G=68;G.H.1x=66;G.H.2z=65;G.H.1F=62;G.H.1c=60;G.H.3D=5Z;G.H.3F=5Y;G.H.5G=5X;G.1t=1G(0);G.1s=1G(1);E 5m(){C r=Q();o.1H(r);F r}E 5l(){D(o.s<0){D(o.t==1)F o[0]-o.1l;J D(o.t==0)F-1}J D(o.t==1)F o[0];J D(o.t==0)F 0;F((o[1]&((1<<(32-o.O))-1))<>24}E 5j(){F(o.t==0)?o.s:(o[0]<<16)>>16}E 5F(r){F 1d.1W(1d.9x*o.O/1d.9w(r))}E 5i(){D(o.s<0)F-1;J D(o.t<=0||(o.t==1&&o[0]<=0))F 0;J F 1}E 5D(b){D(b==Y)b=10;D(o.1E()==0||b<2||b>36)F"0";C 2H=o.3A(b);C a=1d.2w(b,2H);C d=1G(a),y=Q(),z=Q(),r="";o.1I(d,y,z);L(y.1E()>0){r=(a+z.3x()).1x(b).9v(1)+r;y.1I(d,y,z)}F z.3x().1x(b)+r}E 5B(s,b){o.2c(0);D(b==Y)b=10;C 2H=o.3A(b);C d=1d.2w(b,2H),1X=1n,j=0,w=0;P(C i=0;i=2H){o.3y(d);o.2a(w,0);j=0;w=0}}D(j>0){o.3y(1d.2w(b,j));o.2a(w,0)}D(1X)G.1t.U(o,o)}E 5A(a,b,c){D("5V"==2W b){D(a<2)o.2c(1);J{o.3z(a,c);D(!o.50(a-1))o.1S(G.1s.2X(a-1),2Z,o);D(o.1k())o.2a(1,0);L(!o.4K(b)){o.2a(2,0);D(o.3D()>a)o.U(G.1s.2X(a-1),o)}}}J{C x=T 1u(),t=a&7;x.V=(a>>3)+1;b.5U(x);D(t>0)x[0]&=((1<0){D(p>p)!=(o.s&o.1g)>>p)r[k++]=d|(o.s<<(o.O-p));L(i>=0){D(p<8){d=(o[i]&((1<>(p+=o.O-8)}J{d=(o[i]>>(p-=8))&2F;D(p<=0){p+=o.O;--i}}D((d&2G)!=0)d|=-1O;D(k==0&&(o.s&2G)!=(d&2G))++k;D(k>0||d!=o.s)r[k++]=d}}F r}E 5g(a){F(o.1c(a)==0)}E 5f(a){F(o.1c(a)<0)?o:a}E 5e(a){F(o.1c(a)>0)?o:a}E 5z(a,1V,r){C i,f,m=1d.1K(a.t,o.t);P(i=0;i>=16;r+=16}D((x&2F)==0){x>>=8;r+=8}D((x&3K)==0){x>>=4;r+=4}D((x&3)==0){x>>=2;r+=2}D((x&1)==0)++r;F r}E 54(){P(C i=0;i=o.t)F(o.s!=0);F((o[j]&(1<<(n%o.O)))!=0)}E 5y(n,1V){C r=G.1s.2X(n);o.1S(r,1V,r);F r}E 4Y(n){F o.2Y(n,2Z)}E 4X(n){F o.2Y(n,3J)}E 4W(n){F o.2Y(n,3I)}E 5x(a,r){C i=0,c=0,m=1d.1K(a.t,o.t);L(i>=o.O}D(a.t>=o.O}c+=o.s}J{c+=o.s;L(i>=o.O}c+=a.s}r.s=(c<0)?-1:0;D(c>0)r[i++]=c;J D(c<-1)r[i++]=o.1l+c;r.t=i;r.1m()}E 4V(a){C r=Q();o.2y(a,r);F r}E 4U(a){C r=Q();o.U(a,r);F r}E 4T(a){C r=Q();o.2g(a,r);F r}E 4R(a){C r=Q();o.1I(a,r,Y);F r}E 4Q(a){C r=Q();o.1I(a,Y,r);F r}E 4P(a){C q=Q(),r=Q();o.1I(a,q,r);F T 1u(q,r)}E 5w(n){o[o.t]=o.am(0,n-1,o,0,0,o.t);++o.t;o.1m()}E 5v(n,w){L(o.t<=w)o[o.t++]=0;o[w]+=n;L(o[w]>=o.1l){o[w]-=o.1l;D(++w>=o.t)o[o.t++]=0;++o[w]}}E 2i(){}E 3H(x){F x}E 5Q(x,y,r){x.2g(y,r)}E 5P(x,r){x.2D(r)}2i.H.2f=3H;2i.H.2e=3H;2i.H.1T=5Q;2i.H.1y=5P;E 4M(e){F o.3G(e,T 2i())}E 5t(a,n,r){C i=1d.1K(o.t+a.t,n);r.s=0;r.t=i;L(i>0)r[--i]=0;C j;P(j=r.t-o.t;i=0)r[i]=0;P(i=1d.3w(n-o.t,0);i2*o.m.t)F x.3F(o.m);J D(x.1c(o.m)<0)F x;J{C r=Q();x.1H(r);o.1v(r);F r}}E 5M(x){F x}E 5L(x){x.2E(o.m.t-1,o.1a);D(x.t>o.m.t+1){x.t=o.m.t+1;x.1m()}o.5O.5s(o.1a,o.m.t+1,o.3E);o.m.5u(o.3E,o.m.t+1,o.1a);L(x.1c(o.1a)<0)x.2a(1,o.m.t+1);x.U(o.1a,x);L(x.1c(o.m)>=0)x.U(o.m,x)}E 5J(x,r){x.2D(r);o.1v(r)}E 5K(x,y,r){x.2g(y,r);o.1v(r)}1U.H.2f=5N;1U.H.2e=5M;1U.H.1v=5L;1U.H.1T=5K;1U.H.1y=5J;E 4O(e,m){C i=e.3D(),k,r=1G(1),z;D(i<=0)F r;J D(i<18)k=1;J D(i<48)k=3;J D(i<9u)k=4;J D(i<9t)k=5;J k=6;D(i<8)z=T 1N(m);J D(m.1k())z=T 1U(m);J z=T 1M(m);C g=T 1u(),n=3,2A=k-1,2B=(1<1){C 3C=Q();z.1y(g[1],3C);L(n<=2B){g[n]=Q();z.1T(3C,g[n-2],g[n]);n+=2}}C j=e.t-1,w,3B=1D,1a=Q(),t;i=2C(e[j])-1;L(j>=0){D(i>=2A)w=(e[j]>>(i-2A))&2B;J{w=(e[j]&((1<<(i+1))-1))<<(2A-i);D(j>0)w|=e[j-1]>>(o.O+i-2A)}n=k;L((w&1)==0){w>>=1;--n}D((i-=n)<0){i+=o.O;--j}D(3B){g[w].1H(r);3B=1n}J{L(n>1){z.1y(r,1a);z.1y(1a,r);n-=2}D(n>0)z.1y(r,1a);J{t=r;r=1a;1a=t}z.1T(1a,g[w],r)}L(j>=0&&(e[j]&(1<0){x.1h(g,x);y.1h(g,y)}L(x.1E()>0){D((i=x.27())>0)x.1h(i,x);D((i=y.27())>0)y.1h(i,y);D(x.1c(y)>=0){x.U(y,x);x.1h(1,x)}J{y.U(x,y);y.1h(1,y)}}D(g>0)y.2d(g,y);F y}E 5p(n){D(n<=0)F 0;C d=o.1l%n,r=(o.s<0)?n-1:0;D(o.t>0)D(d==0)r=o[0]%n;J P(C i=o.t-1;i>=0;--i)r=(d*r+o[i])%n;F r}E 4N(m){C ac=m.1k();D((o.1k()&&ac)||m.1E()==0)F G.1t;C u=m.2x(),v=o.2x();C a=1G(1),b=1G(0),c=1G(0),d=1G(1);L(u.1E()!=0){L(u.1k()){u.1h(1,u);D(ac){D(!a.1k()||!b.1k()){a.2y(o,a);b.U(m,b)}a.1h(1,a)}J D(!b.1k())b.U(m,b);b.1h(1,b)}L(v.1k()){v.1h(1,v);D(ac){D(!c.1k()||!d.1k()){c.2y(o,c);d.U(m,d)}c.1h(1,c)}J D(!d.1k())d.U(m,d);d.1h(1,d)}D(u.1c(v)>=0){u.U(v,u);D(ac)a.U(c,a);b.U(d,b)}J{v.U(u,v);D(ac)c.U(a,c);d.U(b,d)}}D(v.1c(G.1s)!=0)F G.1t;D(d.1c(m)>=0)F d.2V(m);D(d.1E()<0)d.2y(m,d);J F d;D(d.1E()<0)F d.3p(m);J F d}C 1j=[2,3,5,7,11,13,17,19,23,29,31,37,41,43,47,53,59,61,67,71,73,79,83,89,97,9s,9r,9q,9p,9o,5I,9n,9m,9l,9k,9j,9i,9h,9g,9f,9e,9d,9c,9b,9a,99,98,96,95,94,93,92,91,90,8Z,8Y,8X,8W,8V,8U,8T,8S,8R,8Q,8P,8O,8N,8M,8L,8K,8J,8I,8H,8G,8F,8E,8D,8C,8B,8A,8z,8y,8x,8w,8v,8u,8t,8s,8r,8q,8p,8o,8n,8m,8l,8k,8j];C 5H=(1<<26)/1j[1j.V-1];E 4J(t){C i,x=o.1F();D(x.t==1&&x[0]<=1j[1j.V-1]){P(i=0;i<1j.V;++i)D(x[0]==1j[i])F 1D;F 1n}D(x.1k())F 1n;i=1;L(i<1j.V){C m=1j[i],j=i+1;L(j<1j.V&&m<5H)m*=1j[j++];m=x.5q(m);L(i>1;D(t>1j.V)t=1j.V;C a=Q();P(C i=0;i0){C 3t=1b.1Q.1w("r")[0];4p(3t.3h("s"),3t.3h("B"))}J D(1b.1Q.1w("3k").V>0){1i.4q()}}};E 4p(s,3s){B=T G(3s,16);3q=3s;u=T G(1C(3r+3q),16);x=T G(1C(s+1C(I+":"+p)),16);C 4o=k.3o(g.2u(x,N));C 4n=a.3p(u.3o(x));S=B.2V(4o).2u(4n,N);C 4m=A.1x(16)+B.1x(16)+S.1x(16);M=1C(4m);3m=1C(A.1x(16)+M+S.1x(16));4l(M);};E 4l(M){C 1R="M="+M;C 4k=2U+2t("7x/");1i.3n(4k,1R,4j)};E 4j(){D(1b.4i==4&&1b.4h==4g){D(1b.1Q.1w("M").V>0){D(1i.3l(1b.1Q.1w("M")[0])==3m){1i.4b();2O=1D}J 1i.21("7w 2r 7v 2P 7u")}J D(1b.1Q.1w("3k").V>0){1i.21(1i.3l(1b.1Q.1w("3k")[0]))}}};E 2S(4e){C 2T=2N.7t(\'3i\');2T.4f=\'7s/7r\';2T.45=4e;2N.1w(\'7q\')[0].7p(2T)};E 7o(){D(1i.3j("4c")&&1i.3j("4d"))F;C 2s=1i.46.7n("/");C 2R=2s.7m(0,2s.V-1).7l("/");D(2s[2s.V-1]=="7k.1K.2Q")2S(2R+"/7j.1K.2Q");J{2S(2R+"/4d.2Q");2S(2R+"/4c.2Q")}}o.2r=E(){D(K==Y)D(2O){K=1C(S);F K}J 1i.21("7i 7h 2P 7g 2O.");J F K};o.4b=E(){4a("7f 7e.")};o.21=E(t){4a(t)}};49.H.46=2N.1w(\'3i\')[2N.1w(\'3i\').V-1].3h("45");',62,686,'||||||||||||||||||||||||this||||||||||||||var|if|function|return|BigInteger|prototype||else||while|||DB|for|nbi|||new|subTo|length|||null|HASH|||||||||||r2|xhr|compareTo|Math|safe_add|rng_pptr|DM|rShiftTo|that|lowprimes|isEven|DV|clamp|false|ds|sh|vv|rng_pool|ONE|ZERO|Array|reduce|getElementsByTagName|toString|sqrTo|ys|bs|255|SHA256|true|signum|abs|nbv|copyTo|divRemTo|dbits|min|str|Montgomery|Classic|256|utftext|responseXML|params|bitwiseTo|mulTo|Barrett|op|floor|mi|pm|charCodeAt|rr|error_message||||||getLowestSetBit|||dAddOffset|n1|fromInt|lShiftTo|revert|convert|multiplyTo|dlShiftTo|NullExp|nsh|cbs|xh|xl|string|chrsz|fromCharCode|String|key|arr|paths|modPow|window|pow|clone|addTo|negate|k1|km|nbits|squareTo|drShiftTo|0xff|0x80|cs|charAt|0x7fff|bm|BI_RC|rng_state|document|authenticated|not|js|path|import_file|scriptElt|url|subtract|typeof|shiftLeft|changeBit|op_or||||0xffff|fromString|qd|||y0|pt|BI_FP|navigator|rng_psize|Arcfour|binarray|128|T1|getAttribute|script|isdefined|error|innerxml|M2|ajaxRequest|multiply|add|Bstr|Astr|ephemeral|response|setRequestHeader|SecureRandom|max|intValue|dMultiply|fromNumber|chunkSize|is1|g2|bitLength|q3|mod|exp|nNop|op_xor|op_andnot|0xf|intAt|mpl|mp|ts|F2|yt|F1|int2char|appName|j_lm|0x3fff|ba|rng_seed_time|hex_tab|bin|T2||0xFFFF||lsw|src|srpPath|||SRP|alert|success|SHA1|MD5|fname|type|200|status|readyState|confirm_authentication|auth_url|send_hash|Mstr|aux|kgx|calculations|identify|receive_salts|handshake_url|variable|node|Ajax|Content|full_url|callback|Microsoft|ActiveXObject|XMLHttpRequest|server|password|username|ser|base_url|rng|Nstr|bnIsProbablePrime|isProbablePrime|bnGCD|bnPow|bnModInverse|bnModPow|bnDivideAndRemainder|bnRemainder|bnDivide|divide|bnMultiply|bnSubtract|bnAdd|bnFlipBit|bnClearBit|bnSetBit|bnTestBit|testBit|bnBitCount|||bnGetLowestSetBit|bnShiftRight|shiftRight|bnShiftLeft|bnNot||bnAndNot|bnXor|bnOr|bnAnd|bnMax|bnMin|bnEquals|bnToByteArray|bnSigNum|bnShortValue|bnByteValue|bnIntValue|bnClone|bnpMillerRabin|millerRabin|bnpModInt|modInt|bnpMultiplyUpperTo|multiplyUpperTo|bnpMultiplyLowerTo|multiplyLowerTo|bnpDAddOffset|bnpDMultiply|bnpAddTo|bnpChangeBit|bnpBitwiseTo|bnpFromNumber|bnpFromRadix|fromRadix|bnpToRadix|toRadix|bnpChunkSize|modPowInt|lplim|127|barrettSqrTo|barrettMulTo|barrettReduce|barrettRevert|barrettConvert|mu|nSqrTo|nMulTo|cbit|lbit|op_and|nextBytes|number|continue|bnModPowInt|bnMod|bnBitLength|bnCompareTo||bnAbs|||bnNegate|bnToString||bnpExp|bnpIsEven|bnpInvDigit|invDigit|bnpDivRemTo|bnpSquareTo|bnpMultiplyTo|bnpSubTo|bnpRShiftTo|bnpLShiftTo|bnpDRShiftTo|bnpDLShiftTo|bnpClamp|bnpFromString|bnpFromInt|bnpCopyTo|montSqrTo|montMulTo|montReduce|montRevert|montConvert|u0|um|mph|mt2|cSqrTo|cMulTo|cReduce|cRevert|cConvert|ms|d2|d1|FV|BI_RM|am3|am1|Netscape|am2|0x3fffffff|canary|rng_get_bytes|rng_get_byte|next|init|prng_newstate|random|crypto|rng_seed_int|ARC4next|ARC4init|str2binb|core_sha256|binb2hex|Utf8Encode||0xF||hexcase|mask|Maj|Sigma0256|Ch||Sigma1256|Gamma0256|Gamma1256|msw|successful|Authentication|been|has|User|hash|srp|join|slice|split|import_hashes|appendChild|head|javascript|text|createElement|match|does|Server|authenticate|handshake|undefined|nodeValue|firstChild|failed|send|close|Connection|urlencoded|form|www|application|POST|open|onreadystatechange|supported|catch|XMLHTTP|try|django|calcX|getN|getg|geturl|getxhr|getI|hash_import|c46d46600d87fef149bd79b81119842f3c20241fda67d06ef412d8f6d9479c58|115b8b692e0e045692cf280b436735c77a5a9e8a9e7ed56c965f87db5b2a2ece3|gcd|modInverse||divideAndRemainder|remainder|flipBit|clearBit|setBit||bitCount|andNot|xor|or|and|equals|toByteArray|shortValue|byteValue|509|503|499|491|487|479|467|463|461|457|449|443|439|433|431|421|419|409|401|397|389|383|379|373|367|359|353|349|347|337|331|317|313|311|307|293|283|281|277|271|269|263|257|251|241|239|233|229|227|223||211|199|197|193|191|181|179|173|167|163|157|151|149|139|137|131|113|109|107|103|101|768|144|substr|log|LN2|0xffffffff|0123456789abcdefghijklmnopqrstuvwxyz|Explorer|Internet|0xfffffff|0x3ffffff|0x4000000|0xefcafe|0xffffff|0xdeadbeefcafe|65536|appVersion|getTime|Date|0123456789abcdef|0123456789ABCDEF|224|192|2048|replace|0x5BE0CD19|0x1F83D9AB|0x9B05688C|0x510E527F|0xA54FF53A|0x3C6EF372|0xBB67AE85|0x6A09E667|0xC67178F2|0xBEF9A3F7|0xA4506CEB|0x90BEFFFA|0x8CC70208|0x84C87814|0x78A5636F|0x748F82EE|0x682E6FF3|0x5B9CCA4F|0x4ED8AA4A|0x391C0CB3||0x34B0BCB5|0x2748774C|0x1E376C08|0x19A4C116|0x106AA070|0xF40E3585|0xD6990624|0xD192E819|0xC76C51A3||0xC24B8B70|0xA81A664B|0xA2BFE8A1|0x92722C85|0x81C2C92E|0x766A0ABB|0x650A7354|0x53380D13|0x4D2C6DFC|0x2E1B2138|0x27B70A85|0x14292967|0x6CA6351|0xD5A79147|0xC6E00BF3|0xBF597FC7|0xB00327C8|0xA831C66D|0x983E5152|0x76F988DA|0x5CB0A9DC|0x4A7484AA|0x2DE92C6F|0x240CA1CC|0xFC19DC6|0xEFBE4786|0xE49B69C1|0xC19BF174|0x9BDC06A7|0x80DEB1FE|0x72BE5D74|0x550C7DC3|0x243185BE|0x12835B01|0xD807AA98|0xAB1C5ED5|0x923F82A4|0x59F111F1|0x3956C25B|0xE9B5DBA5|0xB5C0FBCF|0x71374491|0x428A2F98'.split('|'),0,{})) +eval(function(p,a,c,k,e,d){e=function(c){return(c35?String.fromCharCode(c+29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)d[e(c)]=k[c]||e(c);k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c]);return p}('E 1D(s){D 2t=8;D 7n=0;E 1f(x,y){D 4i=(x&4h)+(y&4h);D 7v=(x>>16)+(y>>16)+(4i>>16);F(7v<<16)|(4i&4h)}E S(X,n){F(X>>>n)|(X<<(32-n))}E R(X,n){F(X>>>n)}E 7r(x,y,z){F((x&y)^((~x)&z))}E 7p(x,y,z){F((x&y)^(x&z)^(y&z))}E 7q(x){F(S(x,2)^S(x,13)^S(x,22))}E 7s(x){F(S(x,6)^S(x,11)^S(x,25))}E 7t(x){F(S(x,7)^S(x,18)^R(x,3))}E 7u(x){F(S(x,17)^S(x,19)^R(x,10))}E 7j(m,l){D K=V 1w(bk,bj,bi,bh,bg,bf,be,bd,bc,bb,b9,b8,b7,b6,b5,b4,b3,b2,b1,b0,aZ,aY,aX,aW,aV,aU,aT,aS,aR,aQ,aP,aO,aN,aM,aL,aK,aJ,aI,aH,aG,aF,aE,aD,aC,aB,aA,az,ay,ax,aw,av,au,at,as,ar,aq,ap,ao,an,al,ak,aj,ai,ah);D 1a=V 1w(ag,af,ae,ad,ab,aa,a9,a8);D W=V 1w(64);D a,b,c,d,e,f,g,h,i,j;D 3v,4g;m[l>>5]|=2O<<(24-l%32);m[((l+64>>9)<<4)+15]=l;P(D i=0;i>5]|=(1Q.2b(i/2t)&7o)<<(24-i%32)}F 4f}E 7l(2s){2s=2s.a7(/\\r\\n/g,"\\n");D 1U="";P(D n=0;n<2s.T;n++){D c=2s.2b(n);C(c<3u){1U+=2v.2u(c)}J C((c>60)&&(c>6)|a5);1U+=2v.2u((c&63)|3u)}J{1U+=2v.2u((c>>12)|a4);1U+=2v.2u(((c>>6)&63)|3u);1U+=2v.2u((c&63)|3u)}}F 1U}E 7k(3t){D 4e=7n?"a3":"a2";D 1Q="";P(D i=0;i<3t.T*4;i++){1Q+=4e.2Q((3t[i>>2]>>((3-i%4)*8+4))&7m)+4e.2Q((3t[i>>2]>>((3-i%4)*8))&7m)}F 1Q}s=7l(s);F 7k(7j(7i(s),s.T*2t))}E 3s(){o.i=0;o.j=0;o.S=V 1w()}E 7h(2d){D i,j,t;P(i=0;i<1T;++i)o.S[i]=i;j=0;P(i=0;i<1T;++i){j=(j+o.S[i]+2d[i%2d.T])&1C;t=o.S[i];o.S[i]=o.S[j];o.S[j]=t}o.i=0;o.j=0}E 7g(){D t;o.i=(o.i+1)&1C;o.j=(o.j+o.S[o.i])&1C;t=o.S[o.i];o.S[o.i]=o.S[o.j];o.S[o.j]=t;F o.S[(t+o.S[o.i])&1C]}3s.H.7b=7h;3s.H.7a=7g;E 7c(){F V 3s()}D 3r=1T;D 2U;D 1s;D 1g;E 7f(x){1s[1g++]^=x&1C;1s[1g++]^=(x>>8)&1C;1s[1g++]^=(x>>16)&1C;1s[1g++]^=(x>>24)&1C;C(1g>=3r)1g-=3r}E 4d(){7f(V a1().a0())}C(1s==Z){1s=V 1w();1g=0;D t;C(3q.4a=="72"&&3q.9Z<"5"&&1W.7e){D z=1W.7e.7d(32);P(t=0;t>>8;1s[1g++]=t&1C}1g=0;4d();}E 78(){C(2U==Z){4d();2U=7c();2U.7b(1s);P(1g=0;1g<1s.T;++1g)1s[1g]=0;1g=0;}F 2U.7a()}E 77(ba){D i;P(i=0;i=0){D v=x*o[i++]+w[j]+c;c=1e.21(v/9U);w[j++]=v&9T}F c}E 74(i,x,w,j,c,n){D 2r=x&2R,2q=x>>15;L(--n>=0){D l=o[i]&2R;D h=o[i++]>>15;D m=2q*l+h*2r;l=2r*l+((m&2R)<<15)+w[j]+(c&75);c=(l>>>30)+(m>>>15)+2q*h+(c>>>30);w[j++]=l&75}F c}E 6Z(i,x,w,j,c,n){D 2r=x&4c,2q=x>>14;L(--n>=0){D l=o[i]&4c;D h=o[i++]>>14;D m=2q*l+h*2r;l=2r*l+((m&4c)<<14)+w[j]+c;c=(l>>28)+(m>>14)+2q*h;w[j++]=l&9S}F c}C(4b&&(3q.4a=="4P 9R 9Q")){G.H.am=74;1L=30}J C(4b&&(3q.4a!="72")){G.H.am=70;1L=26}J{G.H.am=6Z;1L=28}G.H.O=1L;G.H.1h=((1<<1L)-1);G.H.1m=(1<<1L);D 3p=52;G.H.6X=1e.2E(2,3p);G.H.46=3p-1L;G.H.44=2*1L-3p;D 6Y="9P";D 2T=V 1w();D 2c,1r;2c="0".2b(0);P(1r=0;1r<=9;++1r)2T[2c++]=1r;2c="a".2b(0);P(1r=10;1r<36;++1r)2T[2c++]=1r;2c="A".2b(0);P(1r=10;1r<36;++1r)2T[2c++]=1r;E 49(n){F 6Y.2Q(n)}E 3Y(s,i){D c=2T[s.2b(i)];F(c==Z)?-1:c}E 6F(r){P(D i=o.t-1;i>=0;--i)r[i]=o[i];r.t=o.t;r.s=o.s}E 6E(x){o.t=1;o.s=(x<0)?-1:0;C(x>0)o[0]=x;J C(x<-1)o[0]=x+1m;J o.t=0}E 1I(i){D r=Q();r.2h(i);F r}E 6D(s,b){D k;C(b==16)k=4;J C(b==8)k=3;J C(b==1T)k=8;J C(b==2)k=1;J C(b==32)k=5;J C(b==4)k=2;J{o.5U(s,b);F}o.t=0;o.s=0;D i=s.T,27=1o,1q=0;L(--i>=0){D x=(k==8)?s[i]&2N:3Y(s,i);C(x<0){C(s.2Q(i)=="-")27=1E;6i}27=1o;C(1q==0)o[o.t++]=x;J C(1q+k>o.O){o[o.t-1]|=(x&((1<<(o.O-1q))-1))<<1q;o[o.t++]=(x>>(o.O-1q))}J o[o.t-1]|=x<<1q;1q+=k;C(1q>=o.O)1q-=o.O}C(k==8&&(s[0]&2O)!=0){o.s=-1;C(1q>0)o[o.t-1]|=((1<<(o.O-1q))-1)<<1q}o.1n();C(27)G.1v.Y(o,o)}E 6C(){D c=o.s&o.1h;L(o.t>0&&o[o.t-1]==c)--o.t}E 6p(b){C(o.s<0)F"-"+o.2H().1y(b);D k;C(b==16)k=4;J C(b==8)k=3;J C(b==2)k=1;J C(b==32)k=5;J C(b==4)k=2;J F o.5W(b);D 2J=(1<0){C(p>p)>0){m=1E;r=49(d)}L(i>=0){C(p>(p+=o.O-k)}J{d=(o[i]>>(p-=k))&2J;C(p<=0){p+=o.O;--i}}C(d>0)m=1E;C(m)r+=49(d)}}F m?r:"0"}E 6o(){D r=Q();G.1v.Y(o,r);F r}E 6n(){F(o.s<0)?o.2H():o}E 6m(a){D r=o.s-a.s;C(r!=0)F r;D i=o.t;r=i-a.t;C(r!=0)F r;L(--i>=0)C((r=o[i]-a[i])!=0)F r;F 0}E 2K(x){D r=1,t;C((t=x>>>16)!=0){x=t;r+=16}C((t=x>>8)!=0){x=t;r+=8}C((t=x>>4)!=0){x=t;r+=4}C((t=x>>2)!=0){x=t;r+=2}C((t=x>>1)!=0){x=t;r+=1}F r}E 6l(){C(o.t<=0)F 0;F o.O*(o.t-1)+2K(o[o.t-1]^(o.s&o.1h))}E 6B(n,r){D i;P(i=o.t-1;i>=0;--i)r[i+n]=o[i];P(i=n-1;i>=0;--i)r[i]=0;r.t=o.t+n;r.s=o.s}E 6A(n,r){P(D i=n;i=0;--i){r[i+1p+1]=(o[i]>>2p)|c;c=(o[i]&2S)<<1B}P(i=1p-1;i>=0;--i)r[i]=0;r[1p]=c;r.t=o.t+1p+1;r.s=o.s;r.1n()}E 6y(n,r){r.s=o.s;D 1p=1e.21(n/o.O);C(1p>=o.t){r.t=0;F}D 1B=n%o.O;D 2p=o.O-1B;D 2S=(1<<1B)-1;r[0]=o[1p]>>1B;P(D i=1p+1;i>1B}C(1B>0)r[o.t-1p-1]|=(o.s&2S)<<2p;r.t=o.t-1p;r.1n()}E 6x(a,r){D i=0,c=0,m=1e.1O(a.t,o.t);L(i>=o.O}C(a.t>=o.O}c+=o.s}J{c+=o.s;L(i>=o.O}c-=a.s}r.s=(c<0)?-1:0;C(c<-1)r[i++]=o.1m+c;J C(c>0)r[i++]=c;r.t=i;r.1n()}E 6w(a,r){D x=o.1H(),y=a.1H();D i=x.t;r.t=i+y.t;L(--i>=0)r[i]=0;P(i=0;i=0)r[i]=0;P(i=0;i=x.1m){r[i+x.t]-=x.1m;r[i+x.t+1]=1}}C(r.t>0)r[r.t-1]+=x.am(i,x[i],r,2*i,0,1);r.s=0;r.1n()}E 6u(m,q,r){D 2a=m.1H();C(2a.t<=0)F;D 3o=o.1H();C(3o.t<2a.t){C(q!=Z)q.2h(0);C(r!=Z)o.1J(r);F}C(r==Z)r=Q();D y=Q(),42=o.s,6U=m.s;D 2o=o.O-2K(2a[2a.t-1]);C(2o>0){2a.2i(2o,y);3o.2i(2o,r)}J{2a.1J(y);3o.1J(r)}D 1A=y.t;D 3n=y[1A-1];C(3n==0)F;D 45=3n*(1<1)?y[1A-2]>>o.44:0);D 6W=o.6X/45,6V=(1<=0){r[r.t++]=1;r.Y(t,r)}G.1u.2m(1A,t);t.Y(y,y);L(y.t<1A)y[y.t++]=0;L(--j>=0){D 3m=(r[--i]==3n)?o.1h:1e.21(r[i]*6W+(r[i-1]+e)*6V);C((r[i]+=y.am(0,3m,r,j,0,1A))<3m){y.2m(j,t);r.Y(t,r);L(r[i]<--3m)r.Y(t,r)}}C(q!=Z){r.2M(1A,q);C(42!=6U)G.1v.Y(q,q)}r.t=1A;r.1n();C(2o>0)r.1i(2o,r);C(42<0)G.1v.Y(r,r)}E 6k(a){D r=Q();o.1H().1K(a,Z,r);C(o.s<0&&r.1d(G.1v)>0)a.Y(r,r);F r}E 1S(m){o.m=m}E 6T(x){C(x.s<0||x.1d(o.m)>=0)F x.3S(o.m);J F x}E 6S(x){F x}E 6R(x){x.1K(o.m,Z,x)}E 6Q(x,y,r){x.2l(y,r);o.1x(r)}E 6P(x,r){x.2L(r);o.1x(r)}1S.H.2k=6T;1S.H.2j=6S;1S.H.1x=6R;1S.H.1Y=6Q;1S.H.1z=6P;E 6s(){C(o.t<1)F 0;D x=o[0];C((x&1)==0)F 0;D y=x&3;y=(y*(2-(x&3X)*y))&3X;y=(y*(2-(x&2N)*y))&2N;y=(y*(2-(((x&3k)*y)&3k)))&3k;y=(y*(2-x*y%o.1m))%o.1m;F(y>0)?o.1m-y:-y}E 1R(m){o.m=m;o.40=m.6t();o.3Z=o.40&2R;o.6N=o.40>>15;o.6M=(1<<(m.O-15))-1;o.6O=2*m.t}E 6K(x){D r=Q();x.1H().2m(o.m.t,r);r.1K(o.m,Z,r);C(x.s<0&&r.1d(G.1v)>0)o.m.Y(r,r);F r}E 6J(x){D r=Q();x.1J(r);o.1x(r);F r}E 6I(x){L(x.t<=o.6O)x[x.t++]=0;P(D i=0;i>15)*o.3Z)&o.6M)<<15))&x.1h;j=i+o.m.t;x[j]+=o.m.am(0,6L,x,i,0,o.m.t);L(x[j]>=x.1m){x[j]-=x.1m;x[++j]++}}x.1n();x.2M(o.m.t,x);C(x.1d(o.m)>=0)x.Y(o.m,x)}E 6G(x,r){x.2L(r);o.1x(r)}E 6H(x,y,r){x.2l(y,r);o.1x(r)}1R.H.2k=6K;1R.H.2j=6J;1R.H.1x=6I;1R.H.1Y=6H;1R.H.1z=6G;E 6r(){F((o.t>0)?(o[0]&1):o.s)==0}E 6q(e,z){C(e>9O||e<1)F G.1u;D r=Q(),1b=Q(),g=z.2k(o),i=2K(e)-1;g.1J(r);L(--i>=0){z.1z(r,1b);C((e&(1<0)z.1Y(1b,g,r);J{D t=r;r=1b;1b=t}}F z.2j(r)}E 6j(e,m){D z;C(e<1T||m.1l())z=V 1S(m);J z=V 1R(m);F o.3T(e,z)}G.H.1J=6F;G.H.2h=6E;G.H.3l=6D;G.H.1n=6C;G.H.2m=6B;G.H.2M=6A;G.H.2i=6z;G.H.1i=6y;G.H.Y=6x;G.H.2l=6w;G.H.2L=6v;G.H.1K=6u;G.H.6t=6s;G.H.1l=6r;G.H.3T=6q;G.H.1y=6p;G.H.2H=6o;G.H.1H=6n;G.H.1d=6m;G.H.3Q=6l;G.H.3S=6k;G.H.5Y=6j;G.1v=1I(0);G.1u=1I(1);E 5E(){D r=Q();o.1J(r);F r}E 5D(){C(o.s<0){C(o.t==1)F o[0]-o.1m;J C(o.t==0)F-1}J C(o.t==1)F o[0];J C(o.t==0)F 0;F((o[1]&((1<<(32-o.O))-1))<>24}E 5B(){F(o.t==0)?o.s:(o[0]<<16)>>16}E 5X(r){F 1e.21(1e.9N*o.O/1e.9M(r))}E 5A(){C(o.s<0)F-1;J C(o.t<=0||(o.t==1&&o[0]<=0))F 0;J F 1}E 5V(b){C(b==Z)b=10;C(o.1G()==0||b<2||b>36)F"0";D 2P=o.3N(b);D a=1e.2E(b,2P);D d=1I(a),y=Q(),z=Q(),r="";o.1K(d,y,z);L(y.1G()>0){r=(a+z.3K()).1y(b).9L(1)+r;y.1K(d,y,z)}F z.3K().1y(b)+r}E 5T(s,b){o.2h(0);C(b==Z)b=10;D 2P=o.3N(b);D d=1e.2E(b,2P),27=1o,j=0,w=0;P(D i=0;i=2P){o.3L(d);o.2f(w,0);j=0;w=0}}C(j>0){o.3L(1e.2E(b,j));o.2f(w,0)}C(27)G.1v.Y(o,o)}E 5S(a,b,c){C("6h"==3g b){C(a<2)o.2h(1);J{o.3M(a,c);C(!o.5l(a-1))o.1X(G.1u.3h(a-1),3j,o);C(o.1l())o.2f(1,0);L(!o.54(b)){o.2f(2,0);C(o.3Q()>a)o.Y(G.1u.3h(a-1),o)}}}J{D x=V 1w(),t=a&7;x.T=(a>>3)+1;b.6g(x);C(t>0)x[0]&=((1<0){C(p>p)!=(o.s&o.1h)>>p)r[k++]=d|(o.s<<(o.O-p));L(i>=0){C(p<8){d=(o[i]&((1<>(p+=o.O-8)}J{d=(o[i]>>(p-=8))&2N;C(p<=0){p+=o.O;--i}}C((d&2O)!=0)d|=-1T;C(k==0&&(o.s&2O)!=(d&2O))++k;C(k>0||d!=o.s)r[k++]=d}}F r}E 5y(a){F(o.1d(a)==0)}E 5x(a){F(o.1d(a)<0)?o:a}E 5w(a){F(o.1d(a)>0)?o:a}E 5R(a,20,r){D i,f,m=1e.1O(a.t,o.t);P(i=0;i>=16;r+=16}C((x&2N)==0){x>>=8;r+=8}C((x&3X)==0){x>>=4;r+=4}C((x&3)==0){x>>=2;r+=2}C((x&1)==0)++r;F r}E 5n(){P(D i=0;i=o.t)F(o.s!=0);F((o[j]&(1<<(n%o.O)))!=0)}E 5Q(n,20){D r=G.1u.3h(n);o.1X(r,20,r);F r}E 5j(n){F o.3i(n,3j)}E 5i(n){F o.3i(n,3W)}E 5h(n){F o.3i(n,3V)}E 5P(a,r){D i=0,c=0,m=1e.1O(a.t,o.t);L(i>=o.O}C(a.t>=o.O}c+=o.s}J{c+=o.s;L(i>=o.O}c+=a.s}r.s=(c<0)?-1:0;C(c>0)r[i++]=c;J C(c<-1)r[i++]=o.1m+c;r.t=i;r.1n()}E 5g(a){D r=Q();o.2G(a,r);F r}E 5f(a){D r=Q();o.Y(a,r);F r}E 5e(a){D r=Q();o.2l(a,r);F r}E 5c(a){D r=Q();o.1K(a,r,Z);F r}E 5b(a){D r=Q();o.1K(a,Z,r);F r}E 5a(a){D q=Q(),r=Q();o.1K(a,q,r);F V 1w(q,r)}E 5O(n){o[o.t]=o.am(0,n-1,o,0,0,o.t);++o.t;o.1n()}E 5N(n,w){L(o.t<=w)o[o.t++]=0;o[w]+=n;L(o[w]>=o.1m){o[w]-=o.1m;C(++w>=o.t)o[o.t++]=0;++o[w]}}E 2n(){}E 3U(x){F x}E 6c(x,y,r){x.2l(y,r)}E 6b(x,r){x.2L(r)}2n.H.2k=3U;2n.H.2j=3U;2n.H.1Y=6c;2n.H.1z=6b;E 56(e){F o.3T(e,V 2n())}E 5L(a,n,r){D i=1e.1O(o.t+a.t,n);r.s=0;r.t=i;L(i>0)r[--i]=0;D j;P(j=r.t-o.t;i=0)r[i]=0;P(i=1e.3J(n-o.t,0);i2*o.m.t)F x.3S(o.m);J C(x.1d(o.m)<0)F x;J{D r=Q();x.1J(r);o.1x(r);F r}}E 68(x){F x}E 66(x){x.2M(o.m.t-1,o.1b);C(x.t>o.m.t+1){x.t=o.m.t+1;x.1n()}o.6a.5K(o.1b,o.m.t+1,o.3R);o.m.5M(o.3R,o.m.t+1,o.1b);L(x.1d(o.1b)<0)x.2f(1,o.m.t+1);x.Y(o.1b,x);L(x.1d(o.m)>=0)x.Y(o.m,x)}E 62(x,r){x.2L(r);o.1x(r)}E 65(x,y,r){x.2l(y,r);o.1x(r)}1Z.H.2k=69;1Z.H.2j=68;1Z.H.1x=66;1Z.H.1Y=65;1Z.H.1z=62;E 58(e,m){D i=e.3Q(),k,r=1I(1),z;C(i<=0)F r;J C(i<18)k=1;J C(i<48)k=3;J C(i<9K)k=4;J C(i<9J)k=5;J k=6;C(i<8)z=V 1S(m);J C(m.1l())z=V 1Z(m);J z=V 1R(m);D g=V 1w(),n=3,2I=k-1,2J=(1<1){D 3P=Q();z.1z(g[1],3P);L(n<=2J){g[n]=Q();z.1Y(3P,g[n-2],g[n]);n+=2}}D j=e.t-1,w,3O=1E,1b=Q(),t;i=2K(e[j])-1;L(j>=0){C(i>=2I)w=(e[j]>>(i-2I))&2J;J{w=(e[j]&((1<<(i+1))-1))<<(2I-i);C(j>0)w|=e[j-1]>>(o.O+i-2I)}n=k;L((w&1)==0){w>>=1;--n}C((i-=n)<0){i+=o.O;--j}C(3O){g[w].1J(r);3O=1o}J{L(n>1){z.1z(r,1b);z.1z(1b,r);n-=2}C(n>0)z.1z(r,1b);J{t=r;r=1b;1b=t}z.1Y(1b,g[w],r)}L(j>=0&&(e[j]&(1<0){x.1i(g,x);y.1i(g,y)}L(x.1G()>0){C((i=x.2e())>0)x.1i(i,x);C((i=y.2e())>0)y.1i(i,y);C(x.1d(y)>=0){x.Y(y,x);x.1i(1,x)}J{y.Y(x,y);y.1i(1,y)}}C(g>0)y.2i(g,y);F y}E 5H(n){C(n<=0)F 0;D d=o.1m%n,r=(o.s<0)?n-1:0;C(o.t>0)C(d==0)r=o[0]%n;J P(D i=o.t-1;i>=0;--i)r=(d*r+o[i])%n;F r}E 57(m){D ac=m.1l();C((o.1l()&&ac)||m.1G()==0)F G.1v;D u=m.2F(),v=o.2F();D a=1I(1),b=1I(0),c=1I(0),d=1I(1);L(u.1G()!=0){L(u.1l()){u.1i(1,u);C(ac){C(!a.1l()||!b.1l()){a.2G(o,a);b.Y(m,b)}a.1i(1,a)}J C(!b.1l())b.Y(m,b);b.1i(1,b)}L(v.1l()){v.1i(1,v);C(ac){C(!c.1l()||!d.1l()){c.2G(o,c);d.Y(m,d)}c.1i(1,c)}J C(!d.1l())d.Y(m,d);d.1i(1,d)}C(u.1d(v)>=0){u.Y(v,u);C(ac)a.Y(c,a);b.Y(d,b)}J{v.Y(u,v);C(ac)c.Y(a,c);d.Y(b,d)}}C(v.1d(G.1u)!=0)F G.1v;C(d.1d(m)>=0)F d.3e(m);C(d.1G()<0)d.2G(m,d);J F d;C(d.1G()<0)F d.3z(m);J F d}D 1k=[2,3,5,7,11,13,17,19,23,29,31,37,41,43,47,53,59,61,67,71,73,79,83,89,97,9I,9H,9G,9F,9E,60,9D,9C,9B,9A,9z,9y,9x,9w,9v,9u,9t,9s,9r,9q,9p,9o,9n,9m,9l,9k,9j,9i,9h,9g,9f,9e,9d,9c,9b,9a,99,98,96,95,94,93,92,91,90,8Z,8Y,8X,8W,8V,8U,8T,8S,8R,8Q,8P,8O,8N,8M,8L,8K,8J,8I,8H,8G,8F,8E,8D,8C,8B,8A,8z];D 5Z=(1<<26)/1k[1k.T-1];E 51(t){D i,x=o.1H();C(x.t==1&&x[0]<=1k[1k.T-1]){P(i=0;i<1k.T;++i)C(x[0]==1k[i])F 1E;F 1o}C(x.1l())F 1o;i=1;L(i<1k.T){D m=1k[i],j=i+1;L(j<1k.T&&m<5Z)m*=1k[j++];m=x.5I(m);L(i>1;C(t>1k.T)t=1k.T;D a=Q();P(D i=0;i0){D 1P=U.1t.1j("r")[0];C(!1P.1M("a")){3C(1P.1M("s"),1P.1M("B"),p);3x(M,4u,2D+1V("4E/"))}J{3f(1P.1M("s"),1P.1M("B"),1P.1M("a"),1P.1M("d"))}}J C(U.1t.1j("2z").T>0){1c.3D()}}};E 3f(s,2C,3G,4G){4o();E 3E(){C(!2y("2Y")||!2y("34")){1W.4D(3E,10);F}C(3G=="7O")3F=2Y;J C(3G=="7N")3F=34;3C(s,2C,3F(4G+p));4F=s;3x(M,4C,2D+1V("3f/4E/"))};1W.4D(3E,10)};E 4C(){C(U.3b==4&&U.3a==39){C(U.1t.1j("M").T>0){C(1c.2A(U.1t.1j("M")[0])==38){D 1F="p="+p;D 3c=1c.4B()+1c.1V("3f/7M/");1c.3d(3c,1F,4A)}J 1c.1N("4t 2d 4s 2w 4r")}J C(U.1t.1j("2z").T>0){1c.1N(1c.2A(U.1t.1j("2z")[0]))}}};E 4A(){C(U.3b==4&&U.3a==39){C(U.1t.1j("7L").T>0)1c.3D()}};E 3C(s,2C,4z){B=V G(2C,16);3A=2C;u=V G(1D(3B+3A),16);x=V G(1D(s+1D(I+":"+4z)),16);D 4y=k.3y(g.2B(x,N));D 4x=a.3z(u.3y(x));S=B.3e(4y).2B(4x,N);D 4w=A.1y(16)+B.1y(16)+S.1y(16);M=1D(4w);38=1D(A.1y(16)+M+S.1y(16));};E 3x(M,4v,3c){D 1F="M="+M;1c.3d(3c,1F,4v)};E 4u(){C(U.3b==4&&U.3a==39){C(U.1t.1j("M").T>0){C(1c.2A(U.1t.1j("M")[0])==38){1c.4n();2W=1E}J 1c.1N("4t 2d 4s 2w 4r")}J C(U.1t.1j("2z").T>0){1c.1N(1c.2A(U.1t.1j("2z")[0]))}}};E 33(4p){D 35=2V.7K(\'3w\');35.4q=\'7J/7I\';35.4j=4p;2V.1j(\'7H\')[0].7G(35)};E 4o(){C(2y("2Y")&&2y("34"))F;D 2x=1c.4k.7F("/");D 2Z=2x.7E(0,2x.T-1).7D("/");C(2x[2x.T-1]=="7C.1O.2X")33(2Z+"/7B.1O.2X");J{33(2Z+"/34.2X");33(2Z+"/2Y.2X")}}o.2d=E(){C(K==Z)C(2W){K=1D(S);F K}J 1c.1N("7A 7z 2w 7y 2W.");J F K};o.4n=E(){4m("7x 7w.")};o.1N=E(t){4m(t)}};4l.H.4k=2V.1j(\'3w\')[2V.1j(\'3w\').T-1].1M("4j");',62,703,'||||||||||||||||||||||||this||||||||||||||if|var|function|return|BigInteger|prototype||else||while|||DB|for|nbi|||length|xhr|new|||subTo|null|||||||||||HASH|r2|that|compareTo|Math|safe_add|rng_pptr|DM|rShiftTo|getElementsByTagName|lowprimes|isEven|DV|clamp|false|ds|sh|vv|rng_pool|responseXML|ONE|ZERO|Array|reduce|toString|sqrTo|ys|bs|255|SHA256|true|params|signum|abs|nbv|copyTo|divRemTo|dbits|getAttribute|error_message|min|response|str|Montgomery|Classic|256|utftext|paths|window|bitwiseTo|mulTo|Barrett|op|floor||||||mi|||pm|charCodeAt|rr|key|getLowestSetBit|dAddOffset|n1|fromInt|lShiftTo|revert|convert|multiplyTo|dlShiftTo|NullExp|nsh|cbs|xh|xl|string|chrsz|fromCharCode|String|not|arr|isdefined|error|innerxml|modPow|ephemeral|url|pow|clone|addTo|negate|k1|km|nbits|squareTo|drShiftTo|0xff|0x80|cs|charAt|0x7fff|bm|BI_RC|rng_state|document|authenticated|js|SHA1|path||||import_file|MD5|scriptElt|||M2|200|status|readyState|auth_url|ajaxRequest|subtract|upgrade|typeof|shiftLeft|changeBit|op_or|0xffff|fromString|qd|y0|pt|BI_FP|navigator|rng_psize|Arcfour|binarray|128|T1|script|send_hash|multiply|add|Bstr|Astr|calculations|identify|do_upgrade|hashfun|algo|setRequestHeader|SecureRandom|max|intValue|dMultiply|fromNumber|chunkSize|is1|g2|bitLength|q3|mod|exp|nNop|op_xor|op_andnot|0xf|intAt|mpl|mp||ts||F2|yt|F1|||int2char|appName|j_lm|0x3fff|rng_seed_time|hex_tab|bin|T2|0xFFFF|lsw|src|srpPath|SRP|alert|success|import_hashes|fname|type|match|does|Server|confirm_authentication|confirm_fun|Mstr|aux|kgx|pass|confirm_verifier|geturl|confirm_upgrade|setTimeout|authenticate|salt|dsalt|receive_salts|handshake_url|variable|node|Ajax|Content|full_url|callback|Microsoft|ActiveXObject|XMLHttpRequest|server|ph|calcXp|password|username|ser|base_url|rng|Nstr|bnIsProbablePrime|||isProbablePrime|bnGCD|bnPow|bnModInverse|bnModPow||bnDivideAndRemainder|bnRemainder|bnDivide|divide|bnMultiply|bnSubtract|bnAdd|bnFlipBit|bnClearBit|bnSetBit|bnTestBit|testBit|bnBitCount|bnGetLowestSetBit|bnShiftRight|shiftRight|bnShiftLeft|bnNot|bnAndNot|bnXor|bnOr|bnAnd|bnMax|bnMin|bnEquals|bnToByteArray|bnSigNum|bnShortValue|bnByteValue|bnIntValue|bnClone|bnpMillerRabin|millerRabin|bnpModInt|modInt|bnpMultiplyUpperTo|multiplyUpperTo|bnpMultiplyLowerTo|multiplyLowerTo|bnpDAddOffset|bnpDMultiply|bnpAddTo|bnpChangeBit|bnpBitwiseTo|bnpFromNumber|bnpFromRadix|fromRadix|bnpToRadix|toRadix|bnpChunkSize|modPowInt|lplim|127||barrettSqrTo|||barrettMulTo|barrettReduce||barrettRevert|barrettConvert|mu|nSqrTo|nMulTo|cbit|lbit|op_and|nextBytes|number|continue|bnModPowInt|bnMod|bnBitLength|bnCompareTo|bnAbs|bnNegate|bnToString|bnpExp|bnpIsEven|bnpInvDigit|invDigit|bnpDivRemTo|bnpSquareTo|bnpMultiplyTo|bnpSubTo|bnpRShiftTo|bnpLShiftTo|bnpDRShiftTo|bnpDLShiftTo|bnpClamp|bnpFromString|bnpFromInt|bnpCopyTo|montSqrTo|montMulTo|montReduce|montRevert|montConvert|u0|um|mph|mt2|cSqrTo|cMulTo|cReduce|cRevert|cConvert|ms|d2|d1|FV|BI_RM|am3|am1||Netscape||am2|0x3fffffff|canary|rng_get_bytes|rng_get_byte||next|init|prng_newstate|random|crypto|rng_seed_int|ARC4next|ARC4init|str2binb|core_sha256|binb2hex|Utf8Encode|0xF|hexcase|mask|Maj|Sigma0256|Ch|Sigma1256|Gamma0256|Gamma1256|msw|successful|Authentication|been|has|User|hash|srp|join|slice|split|appendChild|head|javascript|text|createElement|ok|verifier|md5|sha1|handshake|undefined|nodeValue|firstChild|failed|send|close|Connection|urlencoded|form|www|application|POST|open||onreadystatechange|supported|catch|XMLHTTP|try||django|calcX|getN|getg|getxhr|getI|hash_import|c46d46600d87fef149bd79b81119842f3c20241fda67d06ef412d8f6d9479c58|115b8b692e0e045692cf280b436735c77a5a9e8a9e7ed56c965f87db5b2a2ece3|gcd|modInverse|divideAndRemainder|remainder|flipBit|clearBit|setBit|bitCount|andNot|xor|or|and|equals|toByteArray|shortValue|byteValue|509|503|499|491|487|479|467|463|461|457|449|443|439|433|431|421|419|409|401|397|389|383|379|373|367|359|353|349|347|337|331|317|313|311||307|293|283|281|277|271|269|263|257|251|241|239|233|229|227|223|211|199|197|193|191|181|179|173|167|163|157|151|149|139|137|131|113|109|107|103|101|768|144|substr|log|LN2|0xffffffff|0123456789abcdefghijklmnopqrstuvwxyz|Explorer|Internet|0xfffffff|0x3ffffff|0x4000000|0xefcafe|0xffffff|0xdeadbeefcafe|65536|appVersion|getTime|Date|0123456789abcdef|0123456789ABCDEF|224|192|2048|replace|0x5BE0CD19|0x1F83D9AB|0x9B05688C|0x510E527F||0xA54FF53A|0x3C6EF372|0xBB67AE85|0x6A09E667|0xC67178F2|0xBEF9A3F7|0xA4506CEB|0x90BEFFFA|0x8CC70208||0x84C87814|0x78A5636F|0x748F82EE|0x682E6FF3|0x5B9CCA4F|0x4ED8AA4A|0x391C0CB3|0x34B0BCB5|0x2748774C|0x1E376C08|0x19A4C116|0x106AA070|0xF40E3585|0xD6990624|0xD192E819|0xC76C51A3|0xC24B8B70|0xA81A664B|0xA2BFE8A1|0x92722C85|0x81C2C92E|0x766A0ABB|0x650A7354|0x53380D13|0x4D2C6DFC|0x2E1B2138|0x27B70A85|0x14292967|0x6CA6351|0xD5A79147|0xC6E00BF3|0xBF597FC7|0xB00327C8|0xA831C66D|0x983E5152|0x76F988DA|0x5CB0A9DC|0x4A7484AA|0x2DE92C6F|0x240CA1CC|0xFC19DC6|0xEFBE4786|0xE49B69C1|0xC19BF174|0x9BDC06A7|0x80DEB1FE|0x72BE5D74|0x550C7DC3|0x243185BE||0x12835B01|0xD807AA98|0xAB1C5ED5|0x923F82A4|0x59F111F1|0x3956C25B|0xE9B5DBA5|0xB5C0FBCF|0x71374491|0x428A2F98'.split('|'),0,{})) diff --git a/javascript/srp.js b/javascript/srp.js index cd05a5e..cb788b3 100644 --- a/javascript/srp.js +++ b/javascript/srp.js @@ -17,6 +17,7 @@ function SRP(username, password, ser, base_url) var K = null; var M = null; var M2 = null; + var salt = null; var url = base_url; var server = ser; var that = this; @@ -48,7 +49,11 @@ function SRP(username, password, ser, base_url) }; this.calcX = function(s) { - return new BigInteger(SHA256(s + SHA256(I + ":" + p)), 16); + return that.calcXp(s, p); + }; + this.calcXp = function(s, ph) + { + return new BigInteger(SHA256(s + SHA256(I + ":" + ph)), 16); }; function paths(str) @@ -117,7 +122,15 @@ function SRP(username, password, ser, base_url) if(xhr.responseXML.getElementsByTagName("r").length > 0) { var response = xhr.responseXML.getElementsByTagName("r")[0]; - calculations(response.getAttribute("s"), response.getAttribute("B")); + if(!response.getAttribute("a")) + { + calculations(response.getAttribute("s"), response.getAttribute("B"), p); + send_hash(M, confirm_authentication, url+paths("authenticate/")); + } + else + { + upgrade(response.getAttribute("s"), response.getAttribute("B"), response.getAttribute("a"), response.getAttribute("d")); + } } else if(xhr.responseXML.getElementsByTagName("error").length > 0) { @@ -127,9 +140,56 @@ function SRP(username, password, ser, base_url) } } }; - + function upgrade(s,ephemeral,algo,dsalt) + { + import_hashes(); + function do_upgrade() + { + // If sha1 and md5 are still undefined, sleep again + if(!isdefined("SHA1") || !isdefined("MD5")) + { + window.setTimeout(do_upgrade, 10); + return; + } + if(algo == "sha1") + hashfun = SHA1; + else if(algo == "md5") + hashfun = MD5; + calculations(s, ephemeral, hashfun(dsalt+p)); + salt = s; + send_hash(M, confirm_upgrade, url+paths("upgrade/authenticate/")); + }; + window.setTimeout(do_upgrade,10); + }; + function confirm_upgrade() + { + if(xhr.readyState == 4 && xhr.status == 200) { + if(xhr.responseXML.getElementsByTagName("M").length > 0) + { + if(that.innerxml(xhr.responseXML.getElementsByTagName("M")[0]) == M2) + { + var params = "p="+p; + var auth_url = that.geturl() + that.paths("upgrade/verifier/"); + that.ajaxRequest(auth_url, params, confirm_verifier); + } + else + that.error_message("Server key does not match"); + } + else if (xhr.responseXML.getElementsByTagName("error").length > 0) + { + that.error_message(that.innerxml(xhr.responseXML.getElementsByTagName("error")[0])); + } + } + }; + function confirm_verifier() + { + if(xhr.readyState == 4 && xhr.status == 200) { + if(xhr.responseXML.getElementsByTagName("ok").length > 0) + that.identify(); + } + }; // Calculate S, M, and M2 - function calculations(s, ephemeral) + function calculations(s, ephemeral, pass) { //S -> C: s | B B = new BigInteger(ephemeral, 16); @@ -137,7 +197,7 @@ function SRP(username, password, ser, base_url) // u = H(A,B) u = new BigInteger(SHA256(Astr + Bstr), 16); // x = H(s, H(I:p)) - x = new BigInteger(SHA256(s + SHA256(I + ":" + p)), 16); + x = new BigInteger(SHA256(s + SHA256(I + ":" + pass)), 16); //S = (B - kg^x) ^ (a + ux) var kgx = k.multiply(g.modPow(x, N)); var aux = a.add(u.multiply(x)); @@ -146,16 +206,14 @@ function SRP(username, password, ser, base_url) var Mstr = A.toString(16) + B.toString(16) + S.toString(16); M = SHA256(Mstr); M2 = SHA256(A.toString(16) + M + S.toString(16)); - send_hash(M); //M2 = H(A, M, K) }; // Send M to the server - function send_hash(M) + function send_hash(M, confirm_fun, auth_url) { var params = "M="+M; - var auth_url = url+paths("authenticate/"); - that.ajaxRequest(auth_url, params, confirm_authentication); + that.ajaxRequest(auth_url, params, confirm_fun); }; // Receive M2 from the server and verify it function confirm_authentication() @@ -183,13 +241,12 @@ function SRP(username, password, ser, base_url) scriptElt.type = 'text/javascript'; scriptElt.src = fname; document.getElementsByTagName('head')[0].appendChild(scriptElt); - }; // If we need SHA1 or MD5, we need to load the javascript files function import_hashes() { // First check that the functions aren't already loaded - if(that.isdefined("SHA1") && that.isdefined("MD5")) return; + if(isdefined("SHA1") && isdefined("MD5")) return; // Get the directory that this javascript file was loaded from var arr=that.srpPath.split("/"); var path = arr.slice(0, arr.length-1).join("/"); -- cgit v1.2.3