cose 0.11.0 → 1.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1e9fc90b31beed1be2df01a443242f9ec5a7fdebb05ef995d067777e330be73b
-  data.tar.gz: 99264ff526cfb7d4bfd058ef0ffdd44cc65449fddc0eae35a89eb9520a4bd173
+  metadata.gz: f3fdc6957e5130367c9a1e8ab223b5c145d6caca1c04b01552410ef6d14bc740
+  data.tar.gz: 6849a1803ff3bb2e92bdf90b4226c8d023b07012b7cb18a915b9f816aed2e1dc
 SHA512:
-  metadata.gz: a75f55dfd35bc92435032765b7f69127b1c832c5ffe5d96626f86c159689c4b04bbfd07fe95785d522cdb201a48de2ff129b3af2c0e11623381bdd10ff42fef9
-  data.tar.gz: e3f98bc5c363da8e812fa3ba1e75175c2a0136679a929b96e1b8b353fcbbc1a60fd1fbcc50083a3e5e24378bcc66054b440baaaa472f66def24f260a1f550db2
+  metadata.gz: cc1093c925a437283fb6b7658bacd6bcd2f8427962dd4f1a5ac9a9a81341a5beaa8f1d21ce40b74372dd86fddf5df1f7702a6790f79d166fd1a5ea8ca359d66a
+  data.tar.gz: 6d11eb89cfc72edaaa9d3533c87f39d509efcff65d7c10070321c39144f91b3ef421bf8dd32b250d621f31fde8a766c98e2c516d8091af802749c707a25ee9d0

data/.rspec

@@ -1,3 +1,3 @@
---format documentation
 --color
 --require spec_helper
+--order random

data/.rubocop.yml

@@ -20,13 +20,12 @@ Gemspec:
 Layout:
   Enabled: true
 
+Layout/LineLength:
+  Max: 120
+
 Lint:
   Enabled: true
 
-Metrics/LineLength:
-  Max: 120
-  IgnoreCopDirectives: true
-
 Naming:
   Enabled: true
 

data/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## [v1.0.0] - 2020-03-29
+
+### Added
+
+- Signature verification validates key `alg` is compatible with the signature algorithm
+
+NOTE: No breaking changes. Moving out of v0.x` to express the intention to keep the public API stable.
+
 ## [v0.11.0] - 2020-01-30
 
 ### Added
@@ -115,6 +123,7 @@
 - EC2 key object
 - Works with ruby 2.5
 
+[v1.0.0]: https://github.com/cedarcode/cose-ruby/compare/v0.11.0...v1.0.0/
 [v0.11.0]: https://github.com/cedarcode/cose-ruby/compare/v0.10.0...v0.11.0/
 [v0.10.0]: https://github.com/cedarcode/cose-ruby/compare/v0.9.0...v0.10.0/
 [v0.9.0]: https://github.com/cedarcode/cose-ruby/compare/v0.8.0...v0.9.0/

data/README.md

@@ -2,7 +2,7 @@
 
 Ruby implementation of RFC [8152](https://tools.ietf.org/html/rfc8152) CBOR Object Signing and Encryption (COSE)
 
-[![Gem](https://img.shields.io/gem/v/cose.svg?style=flat-square)](https://rubygems.org/gems/cose)
+[![Gem](https://img.shields.io/gem/v/cose.svg?style=flat-square&color=informational)](https://rubygems.org/gems/cose)
 [![Travis](https://img.shields.io/travis/cedarcode/cose-ruby.svg?style=flat-square)](https://travis-ci.org/cedarcode/cose-ruby)
 
 ## Installation

data/cose.gemspec

@@ -32,13 +32,13 @@ Gem::Specification.new do |spec|
   spec.required_ruby_version = ">= 2.4"
 
   spec.add_dependency "cbor", "~> 0.5.9"
-  spec.add_dependency "openssl-signature_algorithm", "~> 0.3.0"
+  spec.add_dependency "openssl-signature_algorithm", "~> 0.4.0"
 
   spec.add_development_dependency "appraisal", "~> 2.2.0"
   spec.add_development_dependency "bundler", ">= 1.17", "< 3"
   spec.add_development_dependency "byebug", "~> 11.0"
   spec.add_development_dependency "rake", "~> 13.0"
   spec.add_development_dependency "rspec", "~> 3.8"
-  spec.add_development_dependency "rubocop", "0.75.1"
+  spec.add_development_dependency "rubocop", "0.80.1"
   spec.add_development_dependency "rubocop-performance", "~> 1.4"
 end

data/lib/cose/algorithm/ecdsa.rb

@@ -19,6 +19,12 @@ module COSE
 
       private
 
+      def valid_key?(key)
+        cose_key = to_cose_key(key)
+
+        cose_key.is_a?(COSE::Key::EC2) && (!cose_key.alg || cose_key.alg == id)
+      end
+
       def signature_algorithm_class
         OpenSSL::SignatureAlgorithm::ECDSA
       end

data/lib/cose/algorithm/rsa_pss.rb

@@ -20,6 +20,10 @@ module COSE
 
       private
 
+      def valid_key?(key)
+        to_cose_key(key).is_a?(COSE::Key::RSA)
+      end
+
       def signature_algorithm_class
         OpenSSL::SignatureAlgorithm::RSAPSS
       end

data/lib/cose/algorithm/signature_algorithm.rb

@@ -7,11 +7,12 @@ module COSE
   module Algorithm
     class SignatureAlgorithm < Base
       def verify(key, signature, verification_data)
+        compatible_key?(key) || raise(COSE::Error, "Incompatible key for signature verification")
         valid_signature?(key, signature, verification_data) || raise(COSE::Error, "Signature verification failed")
       end
 
       def compatible_key?(key)
-        to_pkey(key)
+        valid_key?(key) && to_pkey(key)
       rescue COSE::Error
         false
       end
@@ -29,10 +30,25 @@ module COSE
         end
       end
 
+      def to_cose_key(key)
+        case key
+        when COSE::Key::Base
+          key
+        when OpenSSL::PKey::PKey
+          COSE::Key.from_pkey(key)
+        else
+          raise(COSE::Error, "Don't know how to transform #{key.class} to COSE::Key")
+        end
+      end
+
       def signature_algorithm_class
         raise NotImplementedError
       end
 
+      def valid_key?(_key)
+        raise NotImplementedError
+      end
+
       def to_pkey(_key)
         raise NotImplementedError
       end

data/lib/cose/key/curve_key.rb

@@ -20,7 +20,7 @@ module COSE
         }
       end
 
-      def initialize(crv:, x: nil, d: nil, **keyword_arguments) # rubocop:disable Naming/UncommunicativeMethodParamName
+      def initialize(crv:, x: nil, d: nil, **keyword_arguments) # rubocop:disable Naming/MethodParameterName
         super(**keyword_arguments)
 
         if !crv

data/lib/cose/key/ec2.rb

@@ -48,7 +48,7 @@ module COSE
 
       attr_reader :y
 
-      def initialize(y: nil, **keyword_arguments) # rubocop:disable Naming/UncommunicativeMethodParamName
+      def initialize(y: nil, **keyword_arguments) # rubocop:disable Naming/MethodParameterName
         if (!y || !keyword_arguments[:x]) && !keyword_arguments[:d]
           raise ArgumentError, "Both x and y are required if d is missing"
         else

data/lib/cose/key/rsa.rb

@@ -47,7 +47,7 @@ module COSE
 
       attr_reader :n, :e, :d, :p, :q, :dp, :dq, :qinv
 
-      def initialize(n:, e:, d: nil, p: nil, q: nil, dp: nil, dq: nil, qinv: nil, **keyword_arguments) # rubocop:disable Naming/UncommunicativeMethodParamName
+      def initialize(n:, e:, d: nil, p: nil, q: nil, dp: nil, dq: nil, qinv: nil, **keyword_arguments) # rubocop:disable Naming/MethodParameterName
         super(**keyword_arguments)
 
         if !n

data/lib/cose/key/symmetric.rb

@@ -17,7 +17,7 @@ module COSE
         end
       end
 
-      def initialize(k:, **keyword_arguments) # rubocop:disable Naming/UncommunicativeMethodParamName
+      def initialize(k:, **keyword_arguments) # rubocop:disable Naming/MethodParameterName
         super(**keyword_arguments)
 
         if !k

data/lib/cose/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module COSE
-  VERSION = "0.11.0"
+  VERSION = "1.0.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: cose
 version: !ruby/object:Gem::Version
-  version: 0.11.0
+  version: 1.0.0
 platform: ruby
 authors:
 - Gonzalo Rodriguez
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2020-01-30 00:00:00.000000000 Z
+date: 2020-03-29 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: cbor
@@ -31,14 +31,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.3.0
+        version: 0.4.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.3.0
+        version: 0.4.0
 - !ruby/object:Gem::Dependency
   name: appraisal
   requirement: !ruby/object:Gem::Requirement
@@ -121,14 +121,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.75.1
+        version: 0.80.1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.75.1
+        version: 0.80.1
 - !ruby/object:Gem::Dependency
   name: rubocop-performance
   requirement: !ruby/object:Gem::Requirement