epics 2.10.0 → 3.0.0.rc1

data/spec/certificate_handling_spec.rb

@@ -0,0 +1,189 @@
+RSpec.describe 'X.509 certificate handling' do
+  let(:url) { 'https://example.com/ebics' }
+  let(:passphrase) { 'secret' }
+
+  def setup_client(**options)
+    Epics::Client.setup(passphrase, url, 'HOST01', 'USER01', 'PARTNER01', 1024, **options)
+  end
+
+  def foreign_certificate
+    key = OpenSSL::PKey::RSA.generate(1024)
+    Epics::Crypt::X509.new(generate_x_509_crt(key, '/C=GB/O=Other/CN=other.example.org'))
+  end
+
+  describe 'Client.setup on H005' do
+    subject(:client) { setup_client(version: Epics::Keyring::VERSION_30) }
+
+    it 'generates a certificate for every user key' do
+      certificates = [client.keyring.user_signature, client.keyring.user_authentication,
+                      client.keyring.user_encryption].map(&:certificate)
+
+      expect(certificates).to all(be_a(Epics::Crypt::X509))
+    end
+
+    it 'generates certificates that match their key' do
+      signature = client.keyring.user_signature
+
+      expect(signature.certificate.certificate.public_key.to_pem)
+        .to eq(signature.key.key.public_key.to_pem)
+    end
+
+    it 'names the subject after the client identity' do
+      expect(client.keyring.user_signature.certificate.certificate.subject.to_s)
+        .to include('CN=USER01', 'OU=PARTNER01', 'O=HOST01')
+    end
+
+    it 'accepts a custom subject' do
+      client = setup_client(version: Epics::Keyring::VERSION_30, certificate_subject: '/CN=Custom/O=Acme/C=CH')
+
+      expect(client.keyring.user_signature.certificate.certificate.subject.to_s).to include('CN=Custom')
+    end
+
+    it 'accepts a custom validity' do
+      not_after = Time.utc(2030, 1, 1)
+      client = setup_client(version: Epics::Keyring::VERSION_30, certificate_not_after: not_after)
+
+      expect(client.keyring.user_signature.certificate.certificate.not_after).to eq(not_after)
+    end
+
+    it 'keeps a supplied certificate instead of generating one' do
+      supplied = foreign_certificate
+      client = setup_client(version: Epics::Keyring::VERSION_30,
+                            x_509_certificate_a_content: supplied.to_pem)
+
+      expect(client.keyring.user_signature.certificate.fingerprint).to eq(supplied.fingerprint)
+      expect(client.keyring.user_authentication.certificate).not_to be_nil
+    end
+
+    it 'can be turned off' do
+      client = setup_client(version: Epics::Keyring::VERSION_30, generate_certificates: false)
+
+      expect(client.keyring.user_signature.certificate).to be_nil
+    end
+
+    it 'does not mutate the options hash it was given' do
+      options = { version: Epics::Keyring::VERSION_30, signature_version: Epics::Signature::A_VERSION_5 }
+      Epics::Client.setup(passphrase, url, 'HOST01', 'USER01', 'PARTNER01', 1024, options)
+
+      expect(options).to include(signature_version: Epics::Signature::A_VERSION_5)
+    end
+  end
+
+  describe 'Client.setup on H004' do
+    subject(:client) { setup_client }
+
+    it 'generates no certificates' do
+      expect(client.keyring.user_signature.certificate).to be_nil
+    end
+
+    it 'still accepts them explicitly' do
+      client = setup_client(generate_certificates: true)
+
+      expect(client.keyring.user_signature.certificate).to be_a(Epics::Crypt::X509)
+    end
+  end
+
+  describe 'persistence' do
+    let(:client) { setup_client(version: Epics::Keyring::VERSION_30) }
+
+    def reload(json, **options)
+      Epics::Client.new(json, passphrase, url, 'HOST01', 'USER01', 'PARTNER01',
+                        version: Epics::Keyring::VERSION_30, **options)
+    end
+
+    it 'restores user certificates from a key file' do
+      fingerprints = %i[user_signature user_authentication user_encryption]
+                     .map { |slot| client.keyring.send(slot).certificate.fingerprint }
+      reloaded = reload(client.send(:dump_keys))
+
+      expect(%i[user_signature user_authentication user_encryption]
+               .map { |slot| reloaded.keyring.send(slot).certificate.fingerprint }).to eq(fingerprints)
+    end
+
+    it 'keeps a restored certificate when no option is passed' do
+      reloaded = reload(client.send(:dump_keys))
+
+      expect(reloaded.keyring.user_signature.certificate).not_to be_nil
+    end
+
+    it 'lets an explicit option override a restored certificate' do
+      supplied = foreign_certificate
+      reloaded = reload(client.send(:dump_keys), x_509_certificate_a_content: supplied.to_pem)
+
+      expect(reloaded.keyring.user_signature.certificate.fingerprint).to eq(supplied.fingerprint)
+    end
+
+    it 'keeps the bare form for keys without a certificate' do
+      h004 = setup_client
+      dumped = JSON.parse(h004.send(:dump_keys))
+
+      expect(dumped.values).to all(be_a(String))
+    end
+  end
+
+  describe 'invalid certificate content' do
+    it 'raises and names the option' do
+      expect do
+        setup_client(version: Epics::Keyring::VERSION_30, x_509_certificate_a_content: 'not-a-pem')
+      end.to raise_error(Epics::InvalidCertificateError, /x_509_certificate_a_content/)
+    end
+
+    it 'ignores empty content' do
+      client = setup_client(version: Epics::Keyring::VERSION_30, x_509_certificate_x_content: '')
+
+      expect(client.keyring.user_authentication.certificate).to be_a(Epics::Crypt::X509)
+    end
+  end
+
+  # H005 carries the public key inside ds:X509Data, so a request built without a
+  # certificate would contain no key material at all.
+  describe 'H005 key management without certificates', without_certificates: true do
+    let(:client) do
+      setup_client(version: Epics::Keyring::VERSION_30, generate_certificates: false)
+    end
+
+    it 'refuses to build INI' do
+      expect { Epics::INI.new(client).key_signature }
+        .to raise_error(Epics::MissingCertificateError, /x_509_certificate_a_content/)
+    end
+
+    it 'refuses to build HIA' do
+      expect { Epics::HIA.new(client).order_data }
+        .to raise_error(Epics::MissingCertificateError, /x_509_certificate_x_content/)
+    end
+  end
+
+  describe 'H005 key management with certificates' do
+    let(:client) { setup_client(version: Epics::Keyring::VERSION_30) }
+
+    it 'carries the certificate in INI order data' do
+      expect(Epics::INI.new(client).key_signature)
+        .to include("<ds:X509Certificate>#{client.keyring.user_signature.certificate.data}</ds:X509Certificate>")
+    end
+
+    it 'carries both certificates in HIA order data' do
+      order_data = Epics::HIA.new(client).order_data
+
+      expect(order_data).to include(client.keyring.user_authentication.certificate.data)
+      expect(order_data).to include(client.keyring.user_encryption.certificate.data)
+    end
+
+    it 'validates INI order data against the S002 schema' do
+      schema = Nokogiri::XML::Schema(File.open(File.join(File.dirname(__FILE__), 'xsd', 'H005',
+                                                         'ebics_signature_S002.xsd')))
+
+      expect(schema.validate(Nokogiri::XML(Epics::INI.new(client).key_signature))).to be_empty
+    end
+  end
+
+  describe 'H004 key management' do
+    let(:client) { setup_client }
+
+    it 'still sends the raw modulus and exponent' do
+      order_data = Epics::INI.new(client).key_signature
+
+      expect(order_data).to include('Modulus')
+      expect(order_data).not_to include('X509Data')
+    end
+  end
+end

data/spec/client_setup_block_spec.rb

@@ -0,0 +1,41 @@
+RSpec.describe 'Epics::Client.setup with a block' do
+  # Keys are generated after #initialize returns, so the block cannot be forwarded to
+  # .new -- it would see an empty keyring.
+  it 'yields a client whose keys exist' do
+    yielded = nil
+    Epics::Client.setup('secret', 'https://example.com/ebics', 'HOST01', 'USER01', 'PARTNER01', 1024) do |client|
+      yielded = { signature: client.signature_key, authentication: client.authentication_key,
+                  encryption: client.encryption_key }
+    end
+
+    expect(yielded.values).to all(be_a(Epics::SignatureAlgorithm::Base))
+  end
+
+  it 'yields the client that is returned' do
+    yielded = nil
+    returned = Epics::Client.setup('secret', 'https://example.com/ebics', 'HOST01', 'USER01', 'PARTNER01', 1024) do |c|
+      yielded = c
+    end
+
+    expect(yielded).to be(returned)
+  end
+
+  it 'can render the initialisation letter from inside the block' do
+    expect do
+      Epics::Client.setup('secret', 'https://example.com/ebics', 'HOST01', 'USER01', 'PARTNER01', 1024,
+                          version: Epics::Keyring::VERSION_30) do |client|
+        client.ini_letter('Test Bank')
+      end
+    end.not_to raise_error
+  end
+
+  it 'yields after certificates have been generated on H005' do
+    yielded = nil
+    Epics::Client.setup('secret', 'https://example.com/ebics', 'HOST01', 'USER01', 'PARTNER01', 1024,
+                        version: Epics::Keyring::VERSION_30) do |client|
+      yielded = client.keyring.user_signature.certificate
+    end
+
+    expect(yielded).to be_a(Epics::Crypt::X509)
+  end
+end

data/spec/client_spec.rb

@@ -12,18 +12,13 @@ RSpec.describe Epics::Client do
 
     it 'holds all keys, user and bank' do
       expect(subject.keys).to match(a_hash_including(
-                                      'E002' => be_a(Epics::Key),
-                                      'X002' => be_a(Epics::Key),
-                                      'A006' => be_a(Epics::Key),
-                                      'SIZBN001.E002' => be_a(Epics::Key),
-                                      'SIZBN001.X002' => be_a(Epics::Key)
+                                      'E002' => be_a(Epics::SignatureAlgorithm::RsaPkcs1),
+                                      'X002' => be_a(Epics::SignatureAlgorithm::RsaPkcs1),
+                                      'A006' => be_a(Epics::SignatureAlgorithm::RsaPss),
+                                      'SIZBN001.E002' => be_a(Epics::SignatureAlgorithm::RsaPkcs1),
+                                      'SIZBN001.X002' => be_a(Epics::SignatureAlgorithm::RsaPkcs1)
                                     ))
     end
-
-    it 'assigns x_509_certificates_content' do
-      subject.x_509_certificates_content = { a: 'cert_a', x: 'cert_x', e: 'cert_e' }
-      expect(subject.x_509_certificates_content).to eq({ a: 'cert_a', x: 'cert_x', e: 'cert_e' })
-    end
   end
 
   context 'environment settings' do
@@ -56,33 +51,33 @@ RSpec.describe Epics::Client do
     end
   end
 
-  describe '#e' do
+  describe '#encryption_key' do
     it 'the encryption key' do
-      expect(subject.e.public_digest).to eq('rwIxSUJAVEFDQ0sdYe+CybdspMllDG6ArNtdCzUbT1E=')
+      expect(subject.encryption_key.public_digest).to eq('rwIxSUJAVEFDQ0sdYe+CybdspMllDG6ArNtdCzUbT1E=')
     end
   end
 
-  describe '#x' do
-    it 'the signing key' do
-      expect(subject.x.public_digest).to eq('Jjcu97qg595PPn+0OvqBOBIskMIiStNYYXyjgWHeBhE=')
+  describe '#authentication_key' do
+    it 'the authentication key' do
+      expect(subject.authentication_key.public_digest).to eq('Jjcu97qg595PPn+0OvqBOBIskMIiStNYYXyjgWHeBhE=')
     end
   end
 
-  describe '#a' do
-    it 'the authentication key' do
-      expect(subject.a.public_digest).to eq('9ay3tc+I3MgJBaroeD7XJfOtHcq7IR23fljWefl0dzk=')
+  describe '#signature_key' do
+    it 'the signing key' do
+      expect(subject.signature_key.public_digest).to eq('9ay3tc+I3MgJBaroeD7XJfOtHcq7IR23fljWefl0dzk=')
     end
   end
 
-  describe '#bank_e' do
+  describe '#bank_encryption_key' do
     it 'the banks encryption key' do
-      expect(subject.bank_e.public_digest).to eq('dFAYe281vj9NB7w+VoWIdfHnjY9hNbZLbHsDOu76QAE=')
+      expect(subject.bank_encryption_key.public_digest).to eq('dFAYe281vj9NB7w+VoWIdfHnjY9hNbZLbHsDOu76QAE=')
     end
   end
 
-  describe '#bank_x' do
+  describe '#bank_authentication_key' do
     it 'the banks signing key' do
-      expect(subject.bank_x.public_digest).to eq('dFAYe281vj9NB7w+VoWIdfHnjY9hNbZLbHsDOu76QAE=')
+      expect(subject.bank_authentication_key.public_digest).to eq('dFAYe281vj9NB7w+VoWIdfHnjY9hNbZLbHsDOu76QAE=')
     end
   end
 
@@ -100,7 +95,8 @@ RSpec.describe Epics::Client do
 
   describe '#HPB' do
     let(:e_key) do
-      Epics::Key.new(OpenSSL::PKey::RSA.new(File.read(File.join(File.dirname(__FILE__), 'fixtures', 'bank_e.pem'))))
+      Epics::SignatureAlgorithm::RsaPss.new(OpenSSL::PKey::RSA.new(File.read(File.join(File.dirname(__FILE__),
+                                                                                       'fixtures', 'bank_e.pem'))))
     end
 
     before do
@@ -110,7 +106,7 @@ RSpec.describe Epics::Client do
                                                           'hpb_response_ebics_ns.xml')))
     end
 
-    it { expect(subject.HPB).to match([be_a(Epics::Key), be_a(Epics::Key)]) }
+    it { expect(subject.HPB).to match([be_a(Epics::SignatureAlgorithm::RsaPkcs1), be_a(Epics::SignatureAlgorithm::RsaPkcs1)]) }
 
     it 'changes the SIZBN001.(E|X)002 keys' do
       expect { subject.HPB }.to(change { subject.keys['SIZBN001.E002'] })
@@ -135,6 +131,47 @@ RSpec.describe Epics::Client do
       it { expect(subject.keys['SIZBN001.E002'].public_digest).to eq(e_key.public_digest) }
       it { expect(subject.keys['SIZBN001.X002'].public_digest).to eq(e_key.public_digest) }
     end
+
+    describe 'with X.509 certificates (EBICS 3.0 / H005 format)' do
+      let(:bank_cert) { OpenSSL::X509::Certificate.new(File.read(File.join(File.dirname(__FILE__), 'fixtures', 'bank_x509.pem'))) }
+
+      before do
+        allow(subject).to receive(:download).with(Epics::HPB).and_return(File.read(File.join(File.dirname(__FILE__),
+                                                                                             'fixtures', 'xml', 'hpb_response_x509.xml')))
+      end
+
+      it 'parses X002 bank authentication key from certificate' do
+        subject.HPB
+        expect(subject.bank_authentication_key).not_to be_nil
+        expect(subject.bank_authentication_key).to be_a(Epics::SignatureAlgorithm::RsaPkcs1)
+      end
+
+      it 'parses E002 bank encryption key from certificate' do
+        subject.HPB
+        expect(subject.bank_encryption_key).not_to be_nil
+        expect(subject.bank_encryption_key).to be_a(Epics::SignatureAlgorithm::RsaPkcs1)
+      end
+
+      it 'stores certificate in keyring for bank authentication' do
+        subject.HPB
+        expect(subject.keyring.bank_authentication.certificate).not_to be_nil
+      end
+
+      it 'stores certificate in keyring for bank encryption' do
+        subject.HPB
+        expect(subject.keyring.bank_encryption.certificate).not_to be_nil
+      end
+
+      it 'returns authentication and encryption keys' do
+        expect(subject.HPB).to match([be_a(Epics::SignatureAlgorithm::RsaPkcs1),
+                                      be_a(Epics::SignatureAlgorithm::RsaPkcs1)])
+      end
+
+      it 'parses public key from certificate correctly' do
+        subject.HPB
+        expect(subject.bank_authentication_key.key.to_pem).to eq(bank_cert.public_key.to_pem)
+      end
+    end
   end
 
   describe '#CDB' do
@@ -225,6 +262,73 @@ RSpec.describe Epics::Client do
     end
   end
 
+  describe '#HTD (H005)' do
+    let(:subject) do
+      Epics::Client.new(key, 'secret', 'https://zkbisotb.zkb.ch/ebicsweb/ebicsweb', 'ZKBISOTB', 'EBIX', 'EBICS',
+                        version: Epics::Keyring::VERSION_30)
+    end
+
+    before do
+      allow(subject).to receive(:download).and_return(File.read(File.join(File.dirname(__FILE__), 'fixtures', 'xml',
+                                                                          'htd_order_data_h005.xml')))
+    end
+
+    it 'parses H005 Service elements and returns array of service hashes' do
+      subject.HTD
+      expect(subject.instance_variable_get('@order_types')).to match_array([
+                                                                             { service_name: 'OTH', scope: 'BIL',
+                                                                               service_option: 'CH004TPE', container: 'ZIP', msg_name: 'msc' },
+                                                                             { service_name: 'STM', scope: 'BIL',
+                                                                               service_option: 'CH004TPE', container: 'ZIP', msg_name: 'pain.001' },
+                                                                             { service_name: 'SCT', scope: 'BIL',
+                                                                               service_option: 'CH004TPE', container: 'ZIP', msg_name: 'pain.008' },
+                                                                             { service_name: 'CAMT', scope: 'BIL',
+                                                                               service_option: 'CH004TPE', container: 'ZIP', msg_name: 'camt.052' },
+                                                                             { service_name: 'CAMT', scope: 'BIL',
+                                                                               service_option: 'CH004TPE', container: 'ZIP', msg_name: 'camt.053' }
+                                                                           ])
+    end
+  end
+
+  describe '#HAA' do
+    before do
+      allow(subject).to receive(:download).and_return(File.read(File.join(File.dirname(__FILE__), 'fixtures', 'xml',
+                                                                          'haa_response_h004.xml')))
+    end
+
+    it 'returns order types as array of strings for H004' do
+      expect(subject.HAA).to match_array(%w[PTK HPD HTD STA HVD HPB HAA HVT HVU HVZ INI SPR PUB HIA HCA HSA HVE
+                                            HVS CCS CCT CIP CD1 CDB CDD])
+    end
+  end
+
+  describe '#HAA (H005)' do
+    let(:subject) do
+      Epics::Client.new(key, 'secret', 'https://zkbisotb.zkb.ch/ebicsweb/ebicsweb', 'ZKBISOTB', 'EBIX', 'EBICS',
+                        version: Epics::Keyring::VERSION_30)
+    end
+
+    before do
+      allow(subject).to receive(:download).and_return(File.read(File.join(File.dirname(__FILE__), 'fixtures', 'xml',
+                                                                          'haa_response_h005.xml')))
+    end
+
+    it 'parses H005 Service elements and returns array of service hashes' do
+      expect(subject.HAA).to match_array([
+                                           { service_name: 'OTH', scope: 'BIL', service_option: 'CH004TPE',
+                                             container: 'ZIP', msg_name: 'msc' },
+                                           { service_name: 'STM', scope: 'BIL', service_option: 'CH004TPE',
+                                             container: 'ZIP', msg_name: 'pain.001' },
+                                           { service_name: 'SCT', scope: 'BIL', service_option: 'CH004TPE',
+                                             container: 'ZIP', msg_name: 'pain.008' },
+                                           { service_name: 'CAMT', scope: 'BIL', service_option: 'CH004TPE',
+                                             container: 'ZIP', msg_name: 'camt.052' },
+                                           { service_name: 'CAMT', scope: 'BIL', service_option: 'CH004TPE',
+                                             container: 'ZIP', msg_name: 'camt.053' }
+                                         ])
+    end
+  end
+
   describe '#C53/C52/C54/Z52/Z53/Z54 types with zipped data' do
     before do
       allow(subject).to receive(:download).and_return(File.read(File.join(File.dirname(__FILE__), 'fixtures',
@@ -251,77 +355,25 @@ RSpec.describe Epics::Client do
     end
   end
 
-  describe '#x_509_certificate' do
-    let(:epics_client) do
-      Epics::Client.new(key, 'secret', 'https://194.180.18.30/ebicsweb/ebicsweb', 'SIZBN001', 'EBIX', 'EBICS')
-    end
-
-    context 'with valid certificates content' do
-      it 'returns an instance of Epics::X509Certificate' do
-        epics_client.x_509_certificates_content = {
-          a: generate_x_509_crt(epics_client.a.key, '/C=GB/O=TestOrg/CN=test.example.org'),
-          x: generate_x_509_crt(epics_client.x.key, '/C=GB/O=TestOrg/CN=test.example.org'),
-          e: generate_x_509_crt(epics_client.e.key, '/C=GB/O=TestOrg/CN=test.example.org')
-        }
-
-        expect(epics_client.x_509_certificate(:a)).to be_a(Epics::X509Certificate)
-        expect(epics_client.x_509_certificate(:x)).to be_a(Epics::X509Certificate)
-        expect(epics_client.x_509_certificate(:e)).to be_a(Epics::X509Certificate)
-      end
-    end
-
-    context 'with nil or empty content' do
-      it 'returns nil when content is nil' do
-        epics_client.x_509_certificates_content = { a: nil, x: nil, e: nil }
-        expect(epics_client.x_509_certificate(:a)).to be_nil
-        expect(epics_client.x_509_certificate(:x)).to be_nil
-        expect(epics_client.x_509_certificate(:e)).to be_nil
-      end
-
-      it 'returns nil when content is empty string' do
-        epics_client.x_509_certificates_content = { a: '', x: '', e: '' }
-        expect(epics_client.x_509_certificate(:a)).to be_nil
-        expect(epics_client.x_509_certificate(:x)).to be_nil
-        expect(epics_client.x_509_certificate(:e)).to be_nil
-      end
-    end
-  end
+  describe 'x509 certificate assignment via options' do
+    it 'assigns certificates to signatures from constructor options' do
+      epics_client = Epics::Client.new(key, 'secret', 'https://194.180.18.30/ebicsweb/ebicsweb', 'SIZBN001', 'EBIX', 'EBICS',
+                                       x_509_certificate_a_content: generate_x_509_crt(OpenSSL::PKey::RSA.new(2048), '/C=GB/O=TestOrg/CN=test.example.org'),
+                                       x_509_certificate_x_content: generate_x_509_crt(OpenSSL::PKey::RSA.new(2048), '/C=GB/O=TestOrg/CN=test.example.org'),
+                                       x_509_certificate_e_content: generate_x_509_crt(OpenSSL::PKey::RSA.new(2048), '/C=GB/O=TestOrg/CN=test.example.org'))
 
-  describe '#x_509_certificate_hash' do
-    let(:epics_client) do
-      Epics::Client.new(key, 'secret', 'https://194.180.18.30/ebicsweb/ebicsweb', 'SIZBN001', 'EBIX', 'EBICS')
-    end
-    context 'with valid certificates content' do
-      it 'returns SHA256 hash' do
-        epics_client.x_509_certificates_content = {
-          a: generate_x_509_crt(epics_client.a.key, '/C=GB/O=TestOrg/CN=test.example.org'),
-          x: generate_x_509_crt(epics_client.x.key, '/C=GB/O=TestOrg/CN=test.example.org'),
-          e: generate_x_509_crt(epics_client.e.key, '/C=GB/O=TestOrg/CN=test.example.org')
-        }
-
-        expect(epics_client.x_509_certificate_hash(:a)).to be_a(String)
-        expect(epics_client.x_509_certificate_hash(:x)).to be_a(String)
-        expect(epics_client.x_509_certificate_hash(:e)).to be_a(String)
-        expect(epics_client.x_509_certificate_hash(:a).size).to eq(64)
-        expect(epics_client.x_509_certificate_hash(:x).size).to eq(64)
-        expect(epics_client.x_509_certificate_hash(:e).size).to eq(64)
-      end
+      expect(epics_client.keyring.user_signature.certificate).to be_a(Epics::Crypt::X509)
+      expect(epics_client.keyring.user_authentication.certificate).to be_a(Epics::Crypt::X509)
+      expect(epics_client.keyring.user_encryption.certificate).to be_a(Epics::Crypt::X509)
     end
 
-    context 'with nil or empty content' do
-      it 'returns nil when content is nil' do
-        epics_client.x_509_certificates_content = { a: nil, x: nil, e: nil }
-        expect(epics_client.x_509_certificate_hash(:a)).to be_nil
-        expect(epics_client.x_509_certificate_hash(:x)).to be_nil
-        expect(epics_client.x_509_certificate_hash(:e)).to be_nil
-      end
+    it 'leaves certificates nil when no options provided' do
+      epics_client = Epics::Client.new(key, 'secret', 'https://194.180.18.30/ebicsweb/ebicsweb', 'SIZBN001', 'EBIX',
+                                       'EBICS')
 
-      it 'returns nil when content is empty string' do
-        epics_client.x_509_certificates_content = { a: '', x: '', e: '' }
-        expect(epics_client.x_509_certificate_hash(:a)).to be_nil
-        expect(epics_client.x_509_certificate_hash(:x)).to be_nil
-        expect(epics_client.x_509_certificate_hash(:e)).to be_nil
-      end
+      expect(epics_client.keyring.user_signature.certificate).to be_nil
+      expect(epics_client.keyring.user_authentication.certificate).to be_nil
+      expect(epics_client.keyring.user_encryption.certificate).to be_nil
     end
   end
 end

data/spec/crypt_service_spec.rb

@@ -0,0 +1,132 @@
+RSpec.describe Epics::Services::CryptService do
+  subject(:service) { described_class.new }
+
+  let(:rsa_key) { OpenSSL::PKey::RSA.generate(2048) }
+  let(:rsa_algo) { Epics::SignatureAlgorithm::Rsa.new(rsa_key) }
+
+  describe '#encrypt' do
+    let(:data) { 'data to encrypt' }
+    let(:rsa_pss_algo) { Epics::SignatureAlgorithm::RsaPss.new(rsa_key) }
+
+    context 'with A006 (RSA-PSS sign)' do
+      let(:signature) { Epics::Signature.new(Epics::Signature::A_VERSION_6, rsa_pss_algo) }
+
+      it 'delegates to signature_algorithm#sign' do
+        expect(rsa_pss_algo).to receive(:sign).with(data).and_call_original
+        service.encrypt(signature, data)
+      end
+    end
+
+    context 'with X002' do
+      let(:signature) { Epics::Signature.new(Epics::Signature::X_VERSION_2, rsa_pss_algo) }
+
+      it 'delegates to signature_algorithm#sign' do
+        expect(rsa_pss_algo).to receive(:sign).with(data).and_call_original
+        service.encrypt(signature, data)
+      end
+    end
+
+    context 'with A005 (RSA PKCS#1 private encrypt)' do
+      let(:signature) { Epics::Signature.new(Epics::Signature::A_VERSION_5, rsa_algo) }
+
+      it 'delegates to signature_algorithm#private_encrypt' do
+        expect(rsa_algo).to receive(:private_encrypt).with(data).and_call_original
+        service.encrypt(signature, data)
+      end
+    end
+  end
+
+  describe '#encrypt_by_key / #decrypt_by_key' do
+    let(:plaintext) { 'Hello EBICS world!' }
+
+    it 'round-trips: decrypt(encrypt(data)) == data' do
+      aes_key = OpenSSL::Cipher::AES.new(128, :CBC).random_key
+      encrypted = service.encrypt_by_key(aes_key, plaintext)
+      decrypted = service.decrypt_by_key(aes_key, encrypted)
+      expect(decrypted).to eq(plaintext)
+    end
+
+    it 'produces ciphertext different from plaintext' do
+      aes_key = OpenSSL::Cipher::AES.new(128, :CBC).random_key
+      encrypted = service.encrypt_by_key(aes_key, plaintext)
+      expect(encrypted).not_to eq(plaintext)
+    end
+
+    it 'produces different ciphertext with different keys' do
+      key1 = OpenSSL::Cipher::AES.new(128, :CBC).random_key
+      key2 = OpenSSL::Cipher::AES.new(128, :CBC).random_key
+      enc1 = service.encrypt_by_key(key1, plaintext)
+      enc2 = service.encrypt_by_key(key2, plaintext)
+      expect(enc1).not_to eq(enc2)
+    end
+  end
+
+  describe '#encrypt_transaction_key' do
+    it 'encrypts with RSA public key and is decryptable with private key' do
+      transaction_key = OpenSSL::Cipher::AES.new(128, :CBC).random_key
+      encrypted = service.encrypt_transaction_key(rsa_algo, transaction_key)
+      decrypted = rsa_key.private_decrypt(encrypted)
+      expect(decrypted).to eq(transaction_key)
+    end
+  end
+
+  describe '#hash' do
+    it 'returns SHA256 digest by default' do
+      result = service.hash('test')
+      expect(result).to eq(OpenSSL::Digest::SHA256.digest('test'))
+    end
+
+    it 'supports alternative algorithms' do
+      result = service.hash('test', 'sha512')
+      expect(result).to eq(OpenSSL::Digest::SHA512.digest('test'))
+    end
+
+    it 'returns binary digest' do
+      result = service.hash('test')
+      expect(result.encoding).to eq(Encoding::BINARY)
+    end
+  end
+
+  describe '#calculate_digest' do
+    it 'returns SHA256 hash of "exponent modulus" (hex, lowercase, no leading zeros)' do
+      exponent_hex = rsa_key.e.to_s(16).gsub(/^0*/, '').downcase
+      modulus_hex = rsa_key.n.to_s(16).gsub(/^0*/, '').downcase
+      expected = OpenSSL::Digest::SHA256.digest("#{exponent_hex} #{modulus_hex}")
+
+      result = service.calculate_digest(rsa_algo)
+      expect(result).to eq(expected)
+    end
+
+    it 'strips leading zeros from exponent and modulus' do
+      key_text = service.calculate_key('000ABC', '00DEF123')
+      expect(key_text).to eq('abc def123')
+    end
+  end
+
+  describe '#calculate_key' do
+    it 'concatenates exponent and modulus lowercase without leading zeros' do
+      expect(service.calculate_key('10001', 'ABCDEF')).to eq('10001 abcdef')
+    end
+
+    it 'strips leading zeros' do
+      expect(service.calculate_key('010001', '00ABCDEF')).to eq('10001 abcdef')
+    end
+  end
+
+  describe '#calculate_certificate_fingerprint' do
+    let(:dn) { '/C=DE/O=TestBank/CN=test.ebics.org' }
+    let(:cert_pem) { generate_x_509_crt(rsa_key, dn) }
+    let(:x509) { Epics::Crypt::X509.new(cert_pem) }
+
+    it 'returns SHA256 hash of DER-encoded certificate' do
+      expected = OpenSSL::Digest::SHA256.digest(x509.to_der)
+      result = service.calculate_certificate_fingerprint(x509)
+      expect(result).to eq(expected)
+    end
+
+    it 'returns binary digest' do
+      result = service.calculate_certificate_fingerprint(x509)
+      expect(result.encoding).to eq(Encoding::BINARY)
+    end
+  end
+end