Transmitting User Login

Description

This requirement details the information sent to the server from a sqrl client.

Response Sequence

This requirement happens upon successful scan of a valid SQRL qrcode and approval from the user to continue.

Requirements

• TUL-1. The client shall transmit the following information to the resource read from the QR Code as a JSON object in the POST body.
• TUL-2.
  client={ base64url encoded name=value list} &
server={ base64url encoded name=value &
ids={ signature corresponding to idk } &
pids={ signature corresponding to pidk} &
urs={ signature to permit SQRL association updates }
• TUL-3. The content of the client name=value pair is base64url encoded and shall contain.
  ver=1<CR,LF>
cmd=setkey|setlock|create|login<CR,LF>
idk={base64url encoded identity key}<CR,LF>
pidk={base64url encoded previous identity key}<CR,LF>
suk={base64url encoded server unlock key}<CR,LF>
vuk={base64url encoded verify unlock key}<CR,LF>
• TUL-4. The content of the server name=value pair is base64url encoded and shall contain an unmodified copy of the scanned SQRL QR Code.
• TUL-5. The ids is the signed concatenation of the client and server values (no name). Signed using the client's private key for the site (the server shall use the idk to verify the signature) and base64url encoded. The signature is created using ed25519.
• TUL-6. The following name=value pairs shall be included, but set to null.

1. client->pidk
2. client->suk
3. client->vuk
4. pids
5. urs

• TUL-6. Once the login information has been transmitted the client shall wait for a response from the server for the transaction information flag as defined at https://www.grc.com/sqrl/semantics.htm; and display the message appropriatey to the user.