cose 1.2.1 → 1.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3065ed49e2bb4795f22f0fe132fd1645f7db6062ce7102cf6fde7aeb23859657
-  data.tar.gz: c4dc7b4bab6fd4c2898be067c60ca52b43ca743ee8b1dae5359a1a659a0f8d2c
+  metadata.gz: 8a7da6d20b462494510800b95be262f6100a46b0b066c8255de6f1250a41429b
+  data.tar.gz: a758caf5a05445bc36b4c8e2e64f562c181546eb9740d065e48d2c3c5ea22726
 SHA512:
-  metadata.gz: ce3922d45c7dfca8cc649e89e775169ade6bc2ea7d5fdad829380452c7337c79989b33c198105fc134e36719bc147324678638c0e5235fd4a5776412c2e9d07f
-  data.tar.gz: ae49b8afa26ee2bf25f90f3052f9cd9cf20f68c12b2541859b80c524e9b0d8a9d9b433dd82f247ade6b2430bff852eb67c83724ee60edf61676b0505096a393d
+  metadata.gz: 47e4e46bb5e633a1e0eccb8fc9081411d1ff09439046f8ead15070aa2a2f3329d3b34e9744aa56a13a1cb0e6ff0490abc3148efe8e87d5d9efcaeb0f86fa514b
+  data.tar.gz: 2bc529d8091353b0a90a7b04b8e33d490371bfc87c43149a977cde769234b69e9645d9ca8c5677088a91faef8630806c24435ad304551fe467dba4d0cd421971

data/.github/workflows/build.yml

@@ -25,8 +25,12 @@ jobs:
           - openssl_3_0
           - openssl_2_2
           - openssl_2_1
-          - openssl_2_0
           - openssl_default
+        exclude:
+          - ruby: '2.4.10'
+            gemfile: openssl_3_0
+          - ruby: '2.5.8'
+            gemfile: openssl_3_0
     env:
       BUNDLE_GEMFILE: gemfiles/${{ matrix.gemfile }}.gemfile
     steps:

data/Appraisals

@@ -8,10 +8,6 @@ appraise "openssl_2_1" do
   gem "openssl", "~> 2.1.0"
 end
 
-appraise "openssl_2_0" do
-  gem "openssl", "~> 2.0.0"
-end
-
 appraise "openssl_3_0" do
   gem "openssl", "~> 3.0.0"
 end

data/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## [v1.3.0] - 2022-10-28
+
+- Add support for EdDSA (#55). Credits to @bdewater.
+
 ## [v1.2.1] - 2022-07-03
 
 - Support OpenSSL ~>3.0.0. Credits to @ClearlyClaire <3
@@ -139,7 +143,8 @@ NOTE: No breaking changes. Moving out of `v0.x` to express the intention to keep
 - EC2 key object
 - Works with ruby 2.5
 
-[v1.2.0]: https://github.com/cedarcode/cose-ruby/compare/v1.2.0...v1.2.1/
+[v1.3.0]: https://github.com/cedarcode/cose-ruby/compare/v1.2.1...v1.3.0/
+[v1.2.1]: https://github.com/cedarcode/cose-ruby/compare/v1.2.0...v1.2.1/
 [v1.2.0]: https://github.com/cedarcode/cose-ruby/compare/v1.1.0...v1.2.0/
 [v1.1.0]: https://github.com/cedarcode/cose-ruby/compare/v1.0.0...v1.1.0/
 [v1.0.0]: https://github.com/cedarcode/cose-ruby/compare/v0.11.0...v1.0.0/

data/gemfiles/{openssl_2_0.gemfile → openssl_3_0.gemfile}

@@ -2,6 +2,6 @@
 
 source "https://rubygems.org"
 
-gem "openssl", "~> 2.0.0"
+gem "openssl", "~> 3.0.0"
 
 gemspec path: "../"

data/lib/cose/algorithm/eddsa.rb

@@ -0,0 +1,41 @@
+# frozen_string_literal: true
+
+require "cose/algorithm/signature_algorithm"
+require "cose/error"
+require "cose/key/okp"
+require "openssl"
+
+module COSE
+  module Algorithm
+    class EdDSA < SignatureAlgorithm
+      private
+
+      def valid_key?(key)
+        cose_key = to_cose_key(key)
+
+        cose_key.is_a?(COSE::Key::OKP) && (!cose_key.alg || cose_key.alg == id)
+      end
+
+      def to_pkey(key)
+        case key
+        when COSE::Key::OKP
+          key.to_pkey
+        when OpenSSL::PKey::PKey
+          key
+        else
+          raise(COSE::Error, "Incompatible key for algorithm")
+        end
+      end
+
+      def valid_signature?(key, signature, verification_data)
+        pkey = to_pkey(key)
+
+        begin
+          pkey.verify(nil, signature, verification_data)
+        rescue OpenSSL::PKey::PKeyError
+          false
+        end
+      end
+    end
+  end
+end

data/lib/cose/algorithm.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "cose/algorithm/ecdsa"
+require "cose/algorithm/eddsa"
 require "cose/algorithm/hmac"
 require "cose/algorithm/rsa_pss"
 
@@ -30,6 +31,7 @@ module COSE
     register(ECDSA.new(-35, "ES384", hash_function: "SHA384", curve_name: "P-384"))
     register(ECDSA.new(-36, "ES512", hash_function: "SHA512", curve_name: "P-521"))
     register(ECDSA.new(-47, "ES256K", hash_function: "SHA256", curve_name: "secp256k1"))
+    register(EdDSA.new(-8, "EdDSA"))
     register(RSAPSS.new(-37, "PS256", hash_function: "SHA256", salt_length: 32))
     register(RSAPSS.new(-38, "PS384", hash_function: "SHA384", salt_length: 48))
     register(RSAPSS.new(-39, "PS512", hash_function: "SHA512", salt_length: 64))

data/lib/cose/key/curve.rb

@@ -32,4 +32,6 @@ end
 COSE::Key::Curve.register(1, "P-256", "prime256v1")
 COSE::Key::Curve.register(2, "P-384", "secp384r1")
 COSE::Key::Curve.register(3, "P-521", "secp521r1")
+COSE::Key::Curve.register(6, "Ed25519", "ED25519")
+COSE::Key::Curve.register(7, "Ed448", "ED448")
 COSE::Key::Curve.register(8, "secp256k1", "secp256k1")

data/lib/cose/key/ec2.rb

@@ -68,28 +68,33 @@ module COSE
       def to_pkey
         if curve
           group = OpenSSL::PKey::EC::Group.new(curve.pkey_name)
-          pkey = OpenSSL::PKey::EC.new(group)
           public_key_bn = OpenSSL::BN.new("\x04" + x + y, 2)
           public_key_point = OpenSSL::PKey::EC::Point.new(group, public_key_bn)
 
           # RFC5480 SubjectPublicKeyInfo
-          asn1 = OpenSSL::ASN1::Sequence([
-            OpenSSL::ASN1::Sequence([
-              OpenSSL::ASN1::ObjectId("id-ecPublicKey"),
-              OpenSSL::ASN1::ObjectId(curve.pkey_name),
-            ]),
-            OpenSSL::ASN1::BitString(public_key_point.to_octet_string(:uncompressed))
-          ])
+          asn1 = OpenSSL::ASN1::Sequence(
+            [
+              OpenSSL::ASN1::Sequence(
+                [
+                  OpenSSL::ASN1::ObjectId("id-ecPublicKey"),
+                  OpenSSL::ASN1::ObjectId(curve.pkey_name),
+                ]
+              ),
+              OpenSSL::ASN1::BitString(public_key_point.to_octet_string(:uncompressed))
+            ]
+          )
 
           if d
             # RFC5915 ECPrivateKey
-            asn1 = OpenSSL::ASN1::Sequence([
-              OpenSSL::ASN1::Integer.new(1),
-              # Not properly padded but OpenSSL doesn't mind
-              OpenSSL::ASN1::OctetString(OpenSSL::BN.new(d, 2).to_s(2)),
-              OpenSSL::ASN1::ObjectId(curve.pkey_name, 0, :EXPLICIT),
-              OpenSSL::ASN1::BitString(public_key_point.to_octet_string(:uncompressed), 1, :EXPLICIT),
-            ])
+            asn1 = OpenSSL::ASN1::Sequence(
+              [
+                OpenSSL::ASN1::Integer.new(1),
+                # Not properly padded but OpenSSL doesn't mind
+                OpenSSL::ASN1::OctetString(OpenSSL::BN.new(d, 2).to_s(2)),
+                OpenSSL::ASN1::ObjectId(curve.pkey_name, 0, :EXPLICIT),
+                OpenSSL::ASN1::BitString(public_key_point.to_octet_string(:uncompressed), 1, :EXPLICIT),
+              ]
+            )
 
             der = asn1.to_der
             return OpenSSL::PKey::EC.new(der)

data/lib/cose/key/okp.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require "cose/key/curve"
 require "cose/key/curve_key"
 require "openssl"
 
@@ -14,9 +15,56 @@ module COSE
         end
       end
 
+      def self.from_pkey(pkey)
+        curve = Curve.by_pkey_name(pkey.oid) || raise("Unsupported edwards curve #{pkey.oid}")
+        attributes = { crv: curve.id }
+
+        asymmetric_key = pkey.public_to_der
+        public_key_bit_string = OpenSSL::ASN1.decode(asymmetric_key).value.last.value
+        attributes[:x] = public_key_bit_string
+        begin
+          asymmetric_key = pkey.private_to_der
+          private_key = OpenSSL::ASN1.decode(asymmetric_key).value.last.value
+          curve_private_key = OpenSSL::ASN1.decode(private_key).value
+          attributes[:d] = curve_private_key
+        rescue OpenSSL::PKey::PKeyError
+          # work around lack of https://github.com/ruby/openssl/pull/527, otherwise raises this error
+          # with message 'i2d_PKCS8PrivateKey_bio: error converting private key' for public keys
+          nil
+        end
+
+        new(**attributes)
+      end
+
       def map
         super.merge(LABEL_KTY => KTY_OKP)
       end
+
+      def to_pkey
+        if curve
+          private_key_algo = OpenSSL::ASN1::Sequence.new(
+            [OpenSSL::ASN1::ObjectId.new(curve.pkey_name)]
+          )
+          seq = if d
+                  version = OpenSSL::ASN1::Integer.new(0)
+                  curve_private_key = OpenSSL::ASN1::OctetString.new(d).to_der
+                  private_key = OpenSSL::ASN1::OctetString.new(curve_private_key)
+                  [version, private_key_algo, private_key]
+                else
+                  public_key = OpenSSL::ASN1::BitString.new(x)
+                  [private_key_algo, public_key]
+                end
+
+          asymmetric_key = OpenSSL::ASN1::Sequence.new(seq)
+          OpenSSL::PKey.read(asymmetric_key.to_der)
+        else
+          raise "Unsupported curve #{crv}"
+        end
+      end
+
+      def curve
+        Curve.find(crv)
+      end
     end
   end
 end

data/lib/cose/key/rsa.rb

@@ -89,25 +89,29 @@ module COSE
 
       def to_pkey
         # PKCS#1 RSAPublicKey
-        asn1 = OpenSSL::ASN1::Sequence([
-          OpenSSL::ASN1::Integer.new(bn(n)),
-          OpenSSL::ASN1::Integer.new(bn(e)),
-        ])
+        asn1 = OpenSSL::ASN1::Sequence(
+          [
+            OpenSSL::ASN1::Integer.new(bn(n)),
+            OpenSSL::ASN1::Integer.new(bn(e)),
+          ]
+        )
         pkey = OpenSSL::PKey::RSA.new(asn1.to_der)
 
         if private?
           # PKCS#1 RSAPrivateKey
-          asn1 = OpenSSL::ASN1::Sequence([
-            OpenSSL::ASN1::Integer.new(0),
-            OpenSSL::ASN1::Integer.new(bn(n)),
-            OpenSSL::ASN1::Integer.new(bn(e)),
-            OpenSSL::ASN1::Integer.new(bn(d)),
-            OpenSSL::ASN1::Integer.new(bn(p)),
-            OpenSSL::ASN1::Integer.new(bn(q)),
-            OpenSSL::ASN1::Integer.new(bn(dp)),
-            OpenSSL::ASN1::Integer.new(bn(dq)),
-            OpenSSL::ASN1::Integer.new(bn(qinv)),
-          ])
+          asn1 = OpenSSL::ASN1::Sequence(
+            [
+              OpenSSL::ASN1::Integer.new(0),
+              OpenSSL::ASN1::Integer.new(bn(n)),
+              OpenSSL::ASN1::Integer.new(bn(e)),
+              OpenSSL::ASN1::Integer.new(bn(d)),
+              OpenSSL::ASN1::Integer.new(bn(p)),
+              OpenSSL::ASN1::Integer.new(bn(q)),
+              OpenSSL::ASN1::Integer.new(bn(dp)),
+              OpenSSL::ASN1::Integer.new(bn(dq)),
+              OpenSSL::ASN1::Integer.new(bn(qinv)),
+            ]
+          )
 
           pkey = OpenSSL::PKey::RSA.new(asn1.to_der)
         end

data/lib/cose/key.rb

@@ -24,6 +24,8 @@ module COSE
         COSE::Key::EC2.from_pkey(pkey)
       when OpenSSL::PKey::RSA
         COSE::Key::RSA.from_pkey(pkey)
+      when OpenSSL::PKey::PKey
+        COSE::Key::OKP.from_pkey(pkey)
       else
         raise "Unsupported #{pkey.class} object"
       end

data/lib/cose/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module COSE
-  VERSION = "1.2.1"
+  VERSION = "1.3.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: cose
 version: !ruby/object:Gem::Version
-  version: 1.2.1
+  version: 1.3.0
 platform: ruby
 authors:
 - Gonzalo Rodriguez
@@ -9,7 +9,7 @@ authors:
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2022-07-03 00:00:00.000000000 Z
+date: 2022-10-28 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: cbor
@@ -166,14 +166,15 @@ files:
 - bin/console
 - bin/setup
 - cose.gemspec
-- gemfiles/openssl_2_0.gemfile
 - gemfiles/openssl_2_1.gemfile
 - gemfiles/openssl_2_2.gemfile
+- gemfiles/openssl_3_0.gemfile
 - gemfiles/openssl_default.gemfile
 - lib/cose.rb
 - lib/cose/algorithm.rb
 - lib/cose/algorithm/base.rb
 - lib/cose/algorithm/ecdsa.rb
+- lib/cose/algorithm/eddsa.rb
 - lib/cose/algorithm/hmac.rb
 - lib/cose/algorithm/rsa_pss.rb
 - lib/cose/algorithm/signature_algorithm.rb