Keep leading zero bytes in salt, based on gist by @Gdocal

[magicus]

Apple iCloud login recently switched to using SRP. In an effort to get the Python-based iCloud wrappers (like https://github.com/picklepete/pyicloud and https://github.com/gcobb321/icloud3_v3), it was discovered that the SRP implementation between the Apple original JS login, and the pysrp Python library differed in some cases.

The difference was tracked down by @Gdocal in an heroic effort to be the handling of leading zeros in the salt, where Apple keep them but pysrp loses them, due to a conversion of the salt to a long value instead of keeping it byte-by-byte.

This PR is a cleaned-up version of the patch published by @Gdocal at https://gist.github.com/Gdocal/45c24f542ebd32a2256217bfd856d972. All credit for writing this patch goes to him; I just removed some debug comment and reverted spurious changes.

This is of course not the only way possible to solve the issue; feel free to ignore this PR and implement another solution yourself.

[magicus]

I checked the commit history of the project, and noticed that this is a partial reversal of 0931971. I hope the reintroduction of six is not controversial. I am open to any other possible solution that keeps the salt properly.

[cocagne]

Thanks for the patch. At the time this was originally written, rfc5054 hadn't yet become the de-facto standard for SRP implementations it is to day so I had to wing it for parts of the implementation. Even with all the contributions over the years, it's no surprising that some lingering incompatibilities remain. Thanks for working with @Gdocal to patch this hole.

[a-detiste]

@cocagne @magicus I don't mind re-playing the six changes again.

[cocagne]

Removing the six dependency would be preferable. Im unfamiliar with a couple usages of six in the patch from magicus so I readded the dependency rather than trying to convert it into normal python3 code. If you'd be willing to figure it out and send a PR, I'll definitely accept it.

…

On Tue, Nov 5, 2024, 3:58 PM Alexandre Detiste ***@***.***> wrote: @cocagne <https://github.com/cocagne> @magicus <https://github.com/magicus> I don't mind re-playing the six changes again. — Reply to this email directly, view it on GitHub <#61 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AANMW7H72XPSU5AKBMK4ICDZ7E5PHAVCNFSM6AAAAABRAE2NLCVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDINJYGIZDMOBRGI> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[magicus]

As I said, I'm just the messenger here. The patch was written by Gdocal, and I just submitted it upstream (i.e. here). Unfortunately my knowledge about six in Python is extremely limited, so I cannot be of any assistance. I do however strongly recommend that some kind of test for the leading zero issue (as suggested in #62) to make sure it does not regress.