certificate-transparency 0.5.0 → 0.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: a79a012d5182f45a32441f36a7d01853babefce5
-  data.tar.gz: 52007f0dd5ee5ae0f695709ab333e146525aaaf3
+  metadata.gz: f22191737905aa6c892ecfb3a08ad89f7e294fbe
+  data.tar.gz: c0cdac47699adf0b56d0032da06f0ad256114c31
 SHA512:
-  metadata.gz: 6deb537a51d4c064214b2017dbfacfd93ba430836bcaf1adb78d0f1bb28dd5c40233adc8d7591534189a394b8f7194129323640a3068bbbc2cf15386a446c184
-  data.tar.gz: 2e0805987f1c1a2f69fc8cbda8cce94d0685bcf8339210fe4e38f6cb5d6d3a4c4aee4ef23c37a763f98168cbb2bdf51d738dcf556d94a9343ac354cb72f780c2
+  metadata.gz: 476fdeb0fa0e7d85c9bf1bb6e4f104786870176e196bda0c0a597aa5ecfba25afa7f1c9d74e463467a97b392876482ccea5f2c99d95f6528d551607d88c5a599
+  data.tar.gz: 0b92f1a6d0ee4251d7b1572939bcc17345dbbdbad0ac3b14e43e75276ebfb7f9a0bb1951da3e810fd9a1c9fc4cf9cd19eed5cf9857f2402e767e261589cf334f

data/lib/certificate-transparency/certificate_chain.rb

@@ -1,3 +1,5 @@
+require 'forwardable'
+
 # A chain of certificates, from an end-entity certificate to a root certificate
 # presumably trusted by the log.
 #

data/lib/certificate-transparency/signed_tree_head.rb

@@ -26,13 +26,21 @@ class CertificateTransparency::SignedTreeHead
 	# Determine whether or not the signature that was provided in the
 	# signed tree head is a valid one, based on the provided key.
 	#
-	# @param pk [String] the raw binary form of the public key of the
-	#   log.
+	# @param pk [String, OpenSSL::PKey::PKey] either the raw binary form of
+	#   the public key of the log, or an existing OpenSSL public key object.
 	#
 	# @return Boolean
 	#
 	def valid?(pk)
-		key = OpenSSL::PKey::EC.new(pk)
+		key = if pk.is_a?(OpenSSL::PKey::PKey)
+			pk
+		else
+			begin
+				OpenSSL::PKey::EC.new(pk)
+			rescue ArgumentError
+				OpenSSL::PKey::RSA.new(pk)
+			end
+		end
 
 		blob = [
 			CT::Version[:v1],

data/lib/tls/digitally_signed.rb

@@ -14,16 +14,17 @@ class TLS::DigitallySigned
 	#
 	# Takes a number of named options:
 	#
-	# * `:key` -- (required) An instance of `OpenSSL::PKey::EC`.  If you pass
-	#   in `:blob` as well, then this can be either a public key or a private
-	#   key (because you only need a public key for validating a signature),
-	#   but if you only pass in `:content`, you must provide a private key
-	#   here.
+	# * `:key` -- (required) An instance of `OpenSSL::PKey::PKey`.  If you
+	#   pass in `:blob` as well, then this can be either a public key or a
+	#   private key (because you only need a public key for validating a
+	#   signature), but if you only pass in `:content`, you must provide a
+	#   private key here.
 	#
 	#   This key *must* be generated with the NIST P-256 curve (known to
-	#   OpenSSL as `prime256v1`) in order to be compliant with the CT spec.
-	#   However, we can't validate that, so it's up to you to make sure you
-	#   do it right.
+	#   OpenSSL as `prime256v1`), or be an RSA key of at least 2048 bits, in
+	#   order to be compliant with the CT spec.  However, we can't validate
+	#   some of those criteria, so it's up to you to make sure you do it
+	#   right.
 	#
 	# * `:content` -- (required) The content to sign, or verify the signature
 	#   of.  This can be any string.
@@ -37,9 +38,9 @@ class TLS::DigitallySigned
 	def self.from_blob(blob)
 		hash_algorithm, signature_algorithm, sig_blob = blob.unpack("CCa*")
 
-		if signature_algorithm != ::TLS::SignatureAlgorithm[:ecdsa]
+		unless ::TLS::SignatureAlgorithm.values.include?(signature_algorithm)
 			raise ArgumentError,
-			      "Signature specified in blob is not ECDSA"
+			      "invalid signature type specified (#{signature_algorithm})"
 		end
 
 		if hash_algorithm != ::TLS::HashAlgorithm[:sha256]
@@ -62,7 +63,7 @@ class TLS::DigitallySigned
 
 	# Set the key for this instance.
 	#
-	# @param k [OpenSSL::PKey::EC] a key to verify or generate the signature.
+	# @param k [OpenSSL::PKey::PKey] a key to verify or generate the signature.
 	#   If you only want to verify an existing signature (ie you created this
 	#   instance via {.from_blob}, then this key can be a public key.
 	#   Otherwise, if you want to generate a new signature, you must pass in
@@ -74,9 +75,9 @@ class TLS::DigitallySigned
 	#   appropriate type.
 	#
 	def key=(k)
-		unless k.is_a? OpenSSL::PKey::EC
+		unless k.is_a?(OpenSSL::PKey::PKey)
 			raise ArgumentError,
-			      "Key must be an instance of OpenSSL::PKey::EC"
+			      "Key must be an instance of OpenSSL::PKey::PKey (got a #{k.class})"
 		end
 
 		@key = k

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: certificate-transparency
 version: !ruby/object:Gem::Version
-  version: 0.5.0
+  version: 0.6.0
 platform: ruby
 authors:
 - Matt Palmer
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-06-12 00:00:00.000000000 Z
+date: 2015-06-21 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler