epics 1.0.0

data/lib/epics/key.rb

@@ -0,0 +1,79 @@
+class Epics::Key
+  attr_accessor :key
+
+  def initialize(encoded_key, passphrase = nil)
+    if encoded_key.kind_of?(OpenSSL::PKey::RSA)
+      self.key = encoded_key
+    else
+      self.key = OpenSSL::PKey::RSA.new(encoded_key)
+    end
+  end
+
+  ###
+  # concat the exponent and modulus (hex representation) with a single whitespace
+  # remove leading zeros from both
+  # calculate digest (SHA256)
+  # encode as Base64
+  ####
+  def public_digest
+    c = [ e.gsub(/^0*/,''), n.gsub(/^0*/,'') ].map(&:downcase).join(" ")
+
+    Base64.encode64(digester.digest(c)).strip
+  end
+
+  def n
+    self.key.n.to_s(16)
+  end
+
+  def e
+    self.key.e.to_s(16)
+  end
+
+  def sign(msg, salt = OpenSSL::Random.random_bytes(32) )
+    Base64.encode64(mod_pow(OpenSSL::BN.new(emsa_pss(msg, salt).to_s, 2), self.key.d, self.key.n).to_s(2)).gsub("\n", "")
+  end
+
+  def recover(msg)
+    mod_pow(OpenSSL::BN.new(msg.to_s, 2), self.key.e, self.key.n).to_s(2)
+  end
+
+  def digester
+    @digester ||= OpenSSL::Digest::SHA256.new
+  end
+
+  private
+
+  ##
+  # http://de.wikipedia.org/wiki/Probabilistic_Signature_Scheme
+  ##
+  def emsa_pss(msg, salt)
+    m_tick_hash = digester.digest [("\x00" * 8), digester.digest(msg), salt].join
+
+    ps = "\x00" * 190
+    db = [ps, "\x01", salt].join
+
+    db_mask   = Epics::MGF1.new.generate(m_tick_hash, db.size)
+    masked_db = Epics::MGF1.new.xor(db, db_mask)
+
+    masked_db_msb = OpenSSL::BN.new(masked_db[0], 2).to_i.to_s(2).rjust(8, "0")
+    masked_db_msb[0] = "0"
+
+    masked_db[0] = OpenSSL::BN.new(masked_db_msb.to_i(2).to_s).to_s(2)
+
+    [masked_db, m_tick_hash, ["BC"].pack("H*") ].join
+  end
+
+  def mod_pow(base, power, mod)
+    base  = base.to_i
+    power = power.to_i
+    mod   = mod.to_i
+    result = 1
+    while power > 0
+      result = (result * base) % mod if power & 1 == 1
+      base = (base * base) % mod
+      power >>= 1
+    end
+    OpenSSL::BN.new(result.to_s)
+  end
+
+end

data/lib/epics/mgf.rb

@@ -0,0 +1,41 @@
+class Epics::MGF1
+  def initialize(digest = OpenSSL::Digest::SHA256)
+    @digest = digest.new
+    @hlen = 32
+  end
+
+  def generate(seed, masklen)
+    if masklen > (2 << 31) * @hlen
+      raise ArgumentError, "mask too long"
+    end
+    t = ""
+    divceil(masklen, @hlen).times do |counter|
+      t += @digest.digest(seed + i2osp(counter, 4))
+    end
+    t[0, masklen]
+  end
+
+  def i2osp(x, len)
+    if x >= 256 ** len
+      raise ArgumentError, "integer too large"
+    end
+    [x].pack("N").gsub(/^\x00+/, '').rjust(len, "\x00")
+  end
+
+  def divceil(a, b)
+    (a + b - 1) / b
+  end
+
+  def xor(a, b)
+    if a.size != b.size
+      raise ArgumentError, "different length for a and b"
+    end
+    a = a.unpack('C*')
+    b = b.unpack('C*')
+    a.size.times do |idx|
+      a[idx] ^= b[idx]
+    end
+    a.pack("C*")
+  end
+
+end

data/lib/epics/middleware/parse_ebics.rb

@@ -0,0 +1,15 @@
+class Epics::ParseEbics < Faraday::Middleware
+
+  def initialize(app = nil, options = {})
+    super(app)
+    @client = options[:client]
+  end
+
+  def call(env)
+    @app.call(env).on_complete do |env|
+      env[:body] = ::Epics::Response.new(@client, env[:body])
+      raise Epics::Error::TechnicalError.new(env[:body].technical_code) if env[:body].technical_error?
+      raise Epics::Error::BusinessError.new(env[:body].business_code)  if env[:body].business_error?
+    end
+  end
+end

data/lib/epics/middleware/xmlsig.rb

@@ -0,0 +1,18 @@
+class Epics::XMLSIG < Faraday::Middleware
+
+  def initialize(app, options = {})
+    super(app)
+    @client = options[:client]
+  end
+
+  def call(env)
+    @signer = Epics::Signer.new(@client, env["body"])
+    @signer.digest!
+    @signer.sign!
+
+    env["body"] = @signer.doc.to_xml(save_with: Nokogiri::XML::Node::SaveOptions::AS_XML)
+
+    @app.call(env)
+  end
+
+end

data/lib/epics/ptk.rb

@@ -0,0 +1,52 @@
+class Epics::PTK < Epics::GenericRequest
+  attr_accessor :from, :to
+
+  def initialize(client, from, to)
+    super(client)
+    self.from = from
+    self.to = to
+  end
+
+  def header
+   {
+      :@authenticate => true,
+      static: {
+        "HostID" => host_id,
+        "Nonce" => nonce,
+        "Timestamp" => timestamp,
+        "PartnerID" => partner_id,
+        "UserID" => user_id,
+        "Product" => {
+          :@Language => "de",
+          :content! => "EPICS - a ruby ebics kernel"
+        },
+        "OrderDetails" => {
+          "OrderType" => "PTK",
+          "OrderAttribute" => "DZHNN",
+          "StandardOrderParams" => {
+            "DateRange" => {
+              "Start" => from,
+              "End" => to
+            }
+          }
+        },
+        "BankPubKeyDigests" => {
+          "Authentication" => {
+            :@Version => "X002",
+            :@Algorithm => "http://www.w3.org/2001/04/xmlenc#sha256",
+            :content! => client.bank_x.public_digest
+          },
+          "Encryption" => {
+            :@Version => "E002",
+            :@Algorithm => "http://www.w3.org/2001/04/xmlenc#sha256",
+            :content! => client.bank_e.public_digest
+          }
+        },
+        "SecurityMedium" => "0000"
+     },
+      "mutable" => {
+        "TransactionPhase" => "Initialisation"
+      }
+    }
+  end
+end

data/lib/epics/response.rb

@@ -0,0 +1,93 @@
+class Epics::Response
+  attr_accessor :doc
+  attr_accessor :client
+
+  def initialize(client, xml)
+    self.doc = Nokogiri::XML.parse(xml)
+    self.client = client
+  end
+
+  def technical_error?
+    technical_code != "000000"
+  end
+
+  def technical_code
+    doc.xpath("//xmlns:header/xmlns:mutable/xmlns:ReturnCode").text
+  end
+
+  def business_error?
+    business_code != "000000" && business_code != ""
+  end
+
+  def business_code
+    doc.xpath("//xmlns:body/xmlns:ReturnCode").text
+  end
+
+  def ok?
+    !technical_error? & !business_error?
+  end
+
+  def return_code
+    doc.xpath("//xmlns:ReturnCode").last.content
+  rescue NoMethodError
+    nil
+  end
+
+  def report_text
+    doc.xpath("//xmlns:ReportText").first.content
+  end
+
+  def transaction_id
+    doc.xpath("//xmlns:TransactionID").first.content
+  end
+
+  def digest_valid?
+    authenticated = doc.xpath("//*[@authenticate='true']").map(&:canonicalize).join
+    digest_value = doc.xpath("//ds:DigestValue").first
+
+    digest = Base64.encode64(digester.digest(authenticated)).strip
+
+    digest == digest_value.content
+  end
+
+  def signature_valid?
+    signature = doc.xpath("//ds:SignedInfo").first.canonicalize
+    signature_value = doc.xpath("//ds:SignatureValue").first
+
+    client.bank_x.key.verify(digester, Base64.decode64(signature_value.content), signature)
+  end
+
+  def public_digest_valid?
+    encryption_pub_key_digest = doc.xpath("//xmlns:EncryptionPubKeyDigest").first
+
+    client.e.public_digest == encryption_pub_key_digest.content
+  end
+
+  def order_data
+    order_data_encrypted = Base64.decode64(doc.xpath("//xmlns:OrderData").first.content)
+
+    data = (cipher.update(order_data_encrypted) + cipher.final)
+
+    Zlib::Inflate.new.inflate(data)
+  end
+
+  def cipher
+    cipher = OpenSSL::Cipher::Cipher.new("aes-128-cbc")
+
+    cipher.decrypt
+    cipher.padding = 0
+    cipher.key = transaction_key
+    cipher
+  end
+
+  def transaction_key
+    transaction_key_encrypted = Base64.decode64(doc.xpath("//xmlns:TransactionKey").first.content)
+
+    @transaction_key ||= client.e.key.private_decrypt(transaction_key_encrypted)
+  end
+
+  def digester
+    @digester ||= OpenSSL::Digest::SHA256.new
+  end
+
+end

data/lib/epics/signer.rb

@@ -0,0 +1,40 @@
+class Epics::Signer
+  attr_accessor :doc, :client
+
+  def initialize(client, doc = nil)
+    self.doc = Nokogiri::XML.parse(doc) if doc
+    self.client = client
+  end
+
+  def digest!
+    content_to_digest = Base64.encode64(digester.digest(doc.xpath("//*[@authenticate='true']").map(&:canonicalize).join)).strip
+
+    if digest_node
+      digest_node.content = content_to_digest
+    end
+
+    doc
+  end
+
+  def sign!
+    signature_value_node = doc.xpath("//ds:SignatureValue").first
+
+    if signature_node
+      signature_value_node.content = Base64.encode64(client.x.key.sign(digester, signature_node.canonicalize)).gsub(/\n/,'')
+    end
+
+    doc
+  end
+
+  def digest_node
+    @d ||= doc.xpath("//ds:DigestValue").first
+  end
+
+  def signature_node
+    @s ||= doc.xpath("//ds:SignedInfo").first
+  end
+
+  def digester
+    OpenSSL::Digest::SHA256.new
+  end
+end

data/lib/epics/sta.rb

@@ -0,0 +1,52 @@
+class Epics::STA < Epics::GenericRequest
+  attr_accessor :from, :to
+
+  def initialize(client, from, to)
+    super(client)
+    self.from = from
+    self.to = to
+  end
+
+  def header
+    {
+      :@authenticate => true,
+      static: {
+        "HostID" => host_id,
+        "Nonce" => nonce,
+        "Timestamp" => timestamp,
+        "PartnerID" => partner_id,
+        "UserID" => user_id,
+        "Product" => {
+          :@Language => "de",
+          :content! => "EPICS - a ruby ebics kernel"
+        },
+        "OrderDetails" => {
+          "OrderType" => "STA",
+          "OrderAttribute" => "DZHNN",
+          "StandardOrderParams" => {
+            "DateRange" => {
+              "Start" => from,
+              "End" => to
+            }
+          }
+        },
+        "BankPubKeyDigests" => {
+          "Authentication" => {
+            :@Version => "X002",
+            :@Algorithm => "http://www.w3.org/2001/04/xmlenc#sha256",
+            :content! => client.bank_x.public_digest
+          },
+          "Encryption" => {
+            :@Version => "E002",
+            :@Algorithm => "http://www.w3.org/2001/04/xmlenc#sha256",
+            :content! => client.bank_e.public_digest
+          }
+        },
+        "SecurityMedium" => "0000"
+     },
+      "mutable" => {
+        "TransactionPhase" => "Initialisation"
+      }
+    }
+  end
+end

data/lib/epics/version.rb

@@ -0,0 +1,3 @@
+module Epics
+  VERSION = "1.0.0"
+end

data/lib/letter/ini.erb

@@ -0,0 +1,231 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
+  <head>
+    <meta http-equiv="content-type" content="text/html; charset=utf-8">
+    <meta charset="UTF-8" />
+    <title>EBICS ini</title>
+  </head>
+  <body>
+    <div>
+      <h2>EBICS-Initialisierungsbrief (INI)</h2>
+      <table>
+        <tr>
+          <td>
+            Datum
+          </td>
+          <td>
+            <%= Date.today.strftime("%d.%m.%Y") %>
+          </td>
+        </tr>
+        <tr>
+          <td>
+            Uhrzeit
+          </td>
+          <td>
+            <%= Time.now.strftime("%H:%M:%S") %>
+          </td>
+        </tr>
+        <tr>
+          <td>
+            Empfänger
+          </td>
+          <td>
+            <%= bankname %>
+          </td>
+        </tr>
+        <tr>
+          <td>
+            User-ID
+          </td>
+          <td>
+            <%= user_id %>
+          </td>
+        </tr>
+        <tr>
+          <td>
+            Kunden-ID
+          </td>
+          <td>
+            <%= partner_id %>
+          </td>
+        </tr>
+      </table>
+      <p>Öffentlicher Schlüssel für die elektronische Unterschrift (A006)</p>
+      <p>Exponent (<%= a.key.e.num_bytes * 8 %> Bit):</p>
+      <p><code><%= a.e %></code></p>
+      <p>Modulus (<%= a.key.n.num_bytes * 8 %> Bit):</p>
+      <p><code><%= a.n.scan(/.{2}/).join(" ") %></code></p>
+      <p>Hash (SHA-256):</p>
+      <p>
+      <code><%= Base64.decode64(a.public_digest).unpack("H*").join.upcase.scan(/.{2}/).join(" ") %></code>
+      </p>
+      <p>Ich bestätige hiermit den obigen öffentlichen Schlüssel für meine elektronische Unterschrift.</p>
+      <br/>
+      <br/>
+      <br/>
+      <br/>
+      <table>
+        <tr>
+          <td>
+            _________________________
+          </td>
+          <td>
+            _________________________
+          </td>
+          <td>
+            _________________________
+          </td>
+        </tr>
+        <tr>
+          <td>
+            Ort/Datum
+          </td>
+          <td>
+            Name/Firma
+          </td>
+          <td>
+            Unterschrift
+          </td>
+        </tr>
+      </table>
+    </div>
+    <div style="page-break-after:always"></div>
+    <h2>EBICS-Initialisierungsbrief (HIA) - Seite 1/2</h2>
+    <table>
+      <tr>
+        <td>
+          Datum
+        </td>
+        <td>
+          <%= Date.today.strftime("%d.%m.%Y") %>
+        </td>
+      </tr>
+      <tr>
+        <td>
+          Uhrzeit
+        </td>
+        <td>
+          <%= Time.now.strftime("%H:%M:%S") %>
+        </td>
+      </tr>
+      <tr>
+        <td>
+          Empfänger
+        </td>
+        <td>
+          <%= bankname %>
+        </td>
+      </tr>
+      <tr>
+        <td>
+          User-ID
+        </td>
+        <td>
+          <%= user_id %>
+        </td>
+      </tr>
+      <tr>
+        <td>
+          Kunden-ID
+        </td>
+        <td>
+          <%= partner_id %>
+        </td>
+      </tr>
+    </table>
+    <div>
+      <p>Öffentlicher Authentifikationsschlüssel (X002)</p>
+      <p>Exponent (<%= x.key.e.num_bytes * 8 %> Bit):</p>
+      <p><code><%= x.e %></code></p>
+      <p>Modulus (<%= x.key.n.num_bytes * 8 %> Bit):</p>
+      <p><code><%= x.n.scan(/.{2}/).join(" ") %></code></p>
+      <p>Hash (SHA-256):</p>
+      <p>
+      <code><%= Base64.decode64(x.public_digest).unpack("H*").join.upcase.scan(/.{2}/).join(" ") %></code>
+      </p>
+      <p> Fortsetzung auf Seite 2 ...</p>
+      <div style="page-break-after:always"></div>
+      <h2>EBICS-Initialisierungsbrief (HIA) - Seite 2/2</h2>
+      <table>
+        <tr>
+          <td>
+            Datum
+          </td>
+          <td>
+            <%= Date.today.strftime("%d.%m.%Y") %>
+          </td>
+        </tr>
+        <tr>
+          <td>
+            Uhrzeit
+          </td>
+          <td>
+            <%= Time.now.strftime("%H:%M:%S") %>
+          </td>
+        </tr>
+        <tr>
+          <td>
+            Empfänger
+          </td>
+          <td>
+            <%= bankname %>
+          </td>
+        </tr>
+        <tr>
+          <td>
+            User-ID
+          </td>
+          <td>
+            <%= user_id %>
+          </td>
+        </tr>
+        <tr>
+          <td>
+            Kunden-ID
+          </td>
+          <td>
+            <%= partner_id %>
+          </td>
+        </tr>
+      </table>
+    </div>
+    <div>
+      <p>Öffentlicher Verschlüsselungsschlüssel (E002)</p>
+      <p>Exponent (<%= e.key.e.num_bytes * 8 %> Bit):</p>
+      <p><code><%= e.e %></code></p>
+      <p>Modulus (<%= e.key.n.num_bytes * 8 %> Bit):</p>
+      <p><code><%= e.n.scan(/.{2}/).join(" ") %></code></p>
+      <p>Hash (SHA-256):</p>
+      <p><code><%= Base64.decode64(e.public_digest).unpack("H*").join.upcase.scan(/.{2}/).join(" ") %></code></p>
+      <p>Ich bestätige hiermit die obigen öffentlichen Schlüssel für meinen EBICS-Zugang.</p>
+      <br/>
+      <br/>
+      <br/>
+      <br/>
+      <table>
+        <tr>
+          <td>
+            _________________________
+          </td>
+          <td>
+            _________________________
+          </td>
+          <td>
+            _________________________
+          </td>
+        </tr>
+        <tr>
+          <td>
+            Ort/Datum
+          </td>
+          <td>
+            Name/Firma
+          </td>
+          <td>
+            Unterschrift
+          </td>
+        </tr>
+      </table>
+    </div>
+  </body>
+</html>