fernet 0.1 → 1.0

data/README.md

@@ -55,16 +55,24 @@ Otherwise, `verified` will be false, and you should deny the request with an
 HTTP 401, for example.
 
 The specs
-([spec/fernet_spec.rb](https://github.com/hgimenez/fernet/blob/master/spec/fernet_spec.rb))
+([spec/fernet_spec.rb](https://github.com/hgmnz/fernet/blob/master/spec/fernet_spec.rb))
 have more usage examples.
 
+### Generating a secret
+
+Generating appropriate secrets is beyond the scope of `Fernet`, but you should
+generate it using `/dev/random` in a *nix. To generate a base64-encoded 256 bit
+(32 byte) random sequence, try:
+
+    dd if=/dev/urandom bs=32 count=1 2>/dev/null | openssl base64
+
 ### Attribution
 
 This library was largely made possible by [Mr. Tom
 Maher](http://twitter.com/#tmaher), who clearly articulated the mechanics
 behind this process, and further found ways to make it
-[more](https://github.com/hgimenez/fernet/commit/2bf0b4a66b49ef3fc92ef50708a2c8b401950fc2)
-[secure](https://github.com/hgimenez/fernet/commit/051161d0afb0b41480734d84bc824bdbc7f9c563).
+[more](https://github.com/hgmnz/fernet/commit/2bf0b4a66b49ef3fc92ef50708a2c8b401950fc2)
+[secure](https://github.com/hgmnz/fernet/commit/051161d0afb0b41480734d84bc824bdbc7f9c563).
 
 ## License
 

data/lib/fernet.rb

@@ -1,13 +1,14 @@
 require 'fernet/version'
 require 'fernet/generator'
 require 'fernet/verifier'
+require 'fernet/secret'
 
 module Fernet
-  def self.generate(secret, &block)
-    Generator.new(secret).generate(&block)
+  def self.generate(secret, encrypt = true, &block)
+    Generator.new(secret, encrypt).generate(&block)
   end
 
-  def self.verify(secret, token, &block)
-    Verifier.new(secret).verify_token(token, &block)
+  def self.verify(secret, token, decrypt = true, &block)
+    Verifier.new(secret, decrypt).verify_token(token, &block)
   end
 end

data/lib/fernet/generator.rb

@@ -5,18 +5,28 @@ require 'date'
 
 module Fernet
   class Generator
-    attr_accessor :data
+    attr_accessor :data, :payload
 
-    def initialize(secret)
-      @secret = secret
+    def initialize(secret, encrypt)
+      @secret  = Secret.new(secret, encrypt)
+      @encrypt = encrypt
+      @payload = ''
+      @data    = {}
     end
 
     def generate
       yield self if block_given?
       data.merge!(issued_at: DateTime.now)
 
-      mac = OpenSSL::HMAC.hexdigest('sha256', JSON.dump(data), secret)
-      Base64.urlsafe_encode64(JSON.dump(data.merge(signature: mac)))
+      if encrypt?
+        iv = encrypt_data!
+        @payload = "#{base64(data)}|#{base64(iv)}"
+      else
+        @payload = base64(JSON.dump(data))
+      end
+
+      mac = OpenSSL::HMAC.hexdigest('sha256', payload, signing_key)
+      "#{payload}|#{mac}"
     end
 
     def inspect
@@ -30,5 +40,32 @@ module Fernet
 
   private
     attr_reader :secret
+
+    def encrypt_data!
+      cipher = OpenSSL::Cipher.new('AES-128-CBC')
+      cipher.encrypt
+      iv         = cipher.random_iv
+      cipher.iv  = iv
+      cipher.key = encryption_key
+      @data = cipher.update(JSON.dump(data)) + cipher.final
+      iv
+    end
+
+    def base64(chars)
+      Base64.urlsafe_encode64(chars)
+    end
+
+    def encryption_key
+      @secret.encryption_key
+    end
+
+    def signing_key
+      @secret.signing_key
+    end
+
+    def encrypt?
+      @encrypt
+    end
+
   end
 end

data/lib/fernet/secret.rb

@@ -0,0 +1,20 @@
+module Fernet
+  class Secret
+    def initialize(secret, encrypt)
+      @secret  = secret
+      @encrypt = encrypt
+    end
+
+    def encryption_key
+      @secret.byteslice(@secret.bytesize/2, @secret.bytesize)
+    end
+
+    def signing_key
+      if @encrypt
+        @secret.byteslice(0, @secret.bytesize/2)
+      else
+        @secret
+      end
+    end
+  end
+end

data/lib/fernet/verifier.rb

@@ -5,12 +5,12 @@ require 'date'
 
 module Fernet
   class Verifier
-
     attr_reader :token, :data
     attr_writer :seconds_valid
 
-    def initialize(secret)
-      @secret = secret
+    def initialize(secret, decrypt)
+      @secret  = Secret.new(secret, decrypt)
+      @decrypt = decrypt
     end
 
     def verify_token(token)
@@ -35,9 +35,17 @@ module Fernet
     attr_reader :secret
 
     def deconstruct
-      @data               = JSON.parse(Base64.decode64(token))
-      @received_signature = @data.delete('signature')
-      @regenerated_mac    = OpenSSL::HMAC.hexdigest('sha256', JSON.dump(@data), secret)
+      parts = @token.split('|')
+      if decrypt?
+        encrypted_data, iv, @received_signature = *parts
+        @data = JSON.parse(decrypt!(encrypted_data, Base64.urlsafe_decode64(iv)))
+        signing_blob = "#{encrypted_data}|#{iv}"
+      else
+        encoded_data, @received_signature = *parts
+        signing_blob = encoded_data
+        @data = JSON.parse(Base64.urlsafe_decode64(encoded_data))
+      end
+      @regenerated_mac = OpenSSL::HMAC.hexdigest('sha256', signing_blob, signing_key)
     end
 
     def token_recent_enough?
@@ -51,5 +59,26 @@ module Fernet
         accum |= byte ^ regenerated_bytes.shift
       end.zero?
     end
+
+    def decrypt!(encrypted_data, iv)
+      decipher = OpenSSL::Cipher.new('AES-128-CBC')
+      decipher.decrypt
+      decipher.iv  = iv
+      decipher.key = encryption_key
+      decipher.update(Base64.urlsafe_decode64(encrypted_data)) + decipher.final
+    end
+
+    def encryption_key
+      @secret.encryption_key
+    end
+
+    def signing_key
+      @secret.signing_key
+    end
+
+    def decrypt?
+      @decrypt
+    end
+
   end
 end

data/lib/fernet/version.rb

@@ -1,3 +1,3 @@
 module Fernet
-  VERSION = "0.1"
+  VERSION = "1.0"
 end

data/spec/fernet_spec.rb

@@ -6,7 +6,8 @@ describe Fernet do
     { email: 'harold@heroku.com', id: '123', arbitrary: 'data' }
   end
 
-  let(:secret) { 'sekrit123' }
+  let(:secret) { 'JrdICDH6x3M7duQeM8dJEMK4Y5TkBIsYDw1lPy35RiY=' }
+  let(:bad_secret) { 'jrdICDH6x3M7duQeM8dJEMK4Y5TkBIsYDw1lPy35RiY=' }
 
   it 'can verify tokens it generates' do
     token = Fernet.generate(secret) do |generator|
@@ -23,7 +24,7 @@ describe Fernet do
       generator.data = token_data
     end
 
-    Fernet.verify('bad', token) do |verifier|
+    Fernet.verify(bad_secret, token) do |verifier|
       verifier.data['email'] == 'harold@heroku.com'
     end.should be_false
   end
@@ -33,7 +34,7 @@ describe Fernet do
       generator.data = token_data
     end
 
-    Fernet.verify('bad', token) do |verifier|
+    Fernet.verify(bad_secret, token) do |verifier|
       verifier.data['email'] == 'harold@gmail.com'
     end.should be_false
   end
@@ -43,7 +44,7 @@ describe Fernet do
       generator.data = token_data
     end
 
-    Fernet.verify('bad', token) do |verifier|
+    Fernet.verify(bad_secret, token) do |verifier|
       verifier.seconds_valid = 0
     end.should be_false
   end
@@ -61,4 +62,31 @@ describe Fernet do
 
     Fernet.verify(secret, token).should be_true
   end
+
+  it 'can encrypt the payload' do
+    token = Fernet.generate(secret, true) do |generator|
+      generator.data['password'] = 'password1'
+    end
+
+    payload = Base64.decode64(token)
+    payload.should_not match /password1/
+
+    Fernet.verify(secret, token) do |verifier|
+      verifier.data['password'].should == 'password1'
+    end
+  end
+
+  it 'does not encrypt when asked nicely' do
+    token = Fernet.generate(secret, false) do |generator|
+      generator.data['password'] = 'password1'
+    end
+
+    payload = Base64.decode64(token)
+    payload.should match /password1/
+
+    Fernet.verify(secret, token, false) do |verifier|
+      verifier.data['password'].should == 'password1'
+    end
+  end
+
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: fernet
 version: !ruby/object:Gem::Version
-  version: '0.1'
+  version: '1.0'
   prerelease: 
 platform: ruby
 authors:
@@ -9,11 +9,11 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2012-07-23 00:00:00.000000000 Z
+date: 2012-08-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rspec
-  requirement: &70098514672160 !ruby/object:Gem::Requirement
+  requirement: &70135148211780 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -21,7 +21,7 @@ dependencies:
         version: '0'
   type: :development
   prerelease: false
-  version_requirements: *70098514672160
+  version_requirements: *70135148211780
 description: Delicious HMAC Digest(if) authentication
 email:
 - harold.gimenez@gmail.com
@@ -38,6 +38,7 @@ files:
 - fernet.gemspec
 - lib/fernet.rb
 - lib/fernet/generator.rb
+- lib/fernet/secret.rb
 - lib/fernet/verifier.rb
 - lib/fernet/version.rb
 - spec/fernet_spec.rb