Security Model

Node JS server start-up

When a the node js server is loaded:

1. a cryptographic server-secret-id random string is generated
2. a cryptographic server-secret random string is generated

Server side home page load

When the home page loads:

1. a server-session-id random string is generated by the server (and is given to the client javascript)
2. a server-session-id-validation string is generated by the server (and is given to the client javascript) using the following algorithm: hash(server-secret-id + ":" + server-session-id + ":" + server-secret)
3. the previously generated server-secret-id is sent to the javascript client
4. a cryptographic server-session-salt random string is generated by the server (and is given to the client javascript)
5. a cryptographic server-session-key random string is generated by the server (and is given to the client javascript)
6. a cryptographic client-session-key random string is generated by the client javascript (which is NOT sent to the server)

NOTE: The server-secret is NEVER given to the javascript client.

The end-user picks a question from the preset questions (or types their own). The answer is then normalized.

Client side answer normalization

The answer normalization process:

1. strip all pre/post white space from the string
2. collapse all white space between words to a single space
3. collapse spaces before and after and - symbol
4. make all characters uppercase (or perhaps lowercase; doesn't matter but we have to be consistent)
5. remove any trailing punctuation (no . or ?)
6. ensure the minimum 4 character rule is satisfied

NOTE: All of this normalization processing must be done entire on the client side javascript as the server will never receive the answer.

Client side answer proof generation

The javascript client must generate proof for the remote party to prove that the remote party's javascript client indeed know the correct answer.

Generating proof of the correct answer:

answer-proof = hash("answer:" + server-secret-id + ":" + server-session-id + ":" + server-session-id-validation + ":" + server-session-salt + ":" + server-session-key + client-session-key)

This proof is used to validate both client know the same answer.

Client cipher key

Generate the client-to-client encryption/decryption cipher key:

cipher-key = hash("cipher:" + server-secret-id + ":" + server-session-id + ":" + server-session-id-validation + ":" + server-session-salt + ":" + server-session-key + client-session-key)

This cipher key is the master key used to encrypt or decrypt data send between two clients.