http_signatures 1.0.4 → 1.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA1:
-  metadata.gz: 7d1755e9596abb9f3ad24afa289d497d069981da
-  data.tar.gz: 4bb1f3a5312fc083a8b406848b84612f4c98bc7c
+SHA256:
+  metadata.gz: '092ae9169cb08c0e6fdca80f3a28aeb61fd2a9abe82b325e64fe0045618eab88'
+  data.tar.gz: 5066113f840fdad906f6eb72f59c253857d726cb2589d50126058c5a817f65b7
 SHA512:
-  metadata.gz: 115cdc1a07cd5382db15acd27d780d73dc8bd02c01ea5a42b6ab39eb5841513bb7eef4b7b05e0dd57716503892ed98bacdc82560b4bd36cd0702930bd13b2b24
-  data.tar.gz: d9981768b583e5b92a97ff01f0cf94117be0b0fd8f2c02e7f7ad57761bebbece07df9cf0e6ef55ad9c3422da21b99db517b02b9f6d5368de8f762ee067331bb7
+  metadata.gz: a0c052a5d01aa9e34ba3b793e025e8c8a55c99112b82509b60ac8089ca140e5e28a94012bfef25b8ef7ed4d560c46dfd1ca3eea7453626e44a9b134f82a62946
+  data.tar.gz: bd443c9209eedb4f926f832e988a35c193e7a5a4573507fa844701f8b467a3c6c79e0d89470ff5b00389d6b0ed17a25fb830193b38101e660922056bb6ba2fd3

data/lib/http_signatures.rb

@@ -1,5 +1,6 @@
 require "http_signatures/algorithm"
 require "http_signatures/algorithm/hmac"
+require "http_signatures/algorithm/rsa"
 require "http_signatures/context"
 require "http_signatures/header_list"
 require "http_signatures/key"
@@ -11,6 +12,9 @@ require "http_signatures/signer"
 require "http_signatures/signing_string"
 require "http_signatures/verification"
 require "http_signatures/verifier"
+require "http_signatures/verification_algorithm"
+require "http_signatures/verification_algorithm/hmac"
+require "http_signatures/verification_algorithm/rsa"
 require "http_signatures/version"
 
 module HttpSignatures

data/lib/http_signatures/algorithm.rb

@@ -5,6 +5,10 @@ module HttpSignatures
       case name
       when "hmac-sha1" then Hmac.new("sha1")
       when "hmac-sha256" then Hmac.new("sha256")
+      when "rsa-sha1" then Rsa.new("sha1")
+      when "rsa-sha256" then Rsa.new("sha256")
+      when "rsa-sha384" then Rsa.new("sha384")
+      when "rsa-sha512" then Rsa.new("sha512")
       else raise UnknownAlgorithm.new(name)
       end
     end

data/lib/http_signatures/algorithm/rsa.rb

@@ -0,0 +1,33 @@
+require "openssl"
+
+module HttpSignatures
+  module Algorithm
+    class Rsa
+      def initialize(digest_name)
+        @digest_name = digest_name
+      end
+
+      def name
+        "rsa-#{@digest_name}"
+      end
+
+      def sign(key, data)
+        OpenSSL::PKey::RSA.new(private_key(key)).sign(@digest_name, data)
+      end
+
+      def verify(key, sign, data)
+        OpenSSL::PKey::RSA.new(public_key(key)).verify(@digest_name, sign, data)
+      end
+
+      private
+
+      def private_key(key)
+        key.fetch(:private_key)
+      end
+
+      def public_key(key)
+        key.fetch(:public_key)
+      end
+    end
+  end
+end

data/lib/http_signatures/verification.rb

@@ -7,7 +7,14 @@ module HttpSignatures
     end
 
     def valid?
-      signature_header_present? && signature_matches?
+      signature_header_present? && VerificationAlgorithm.create(algorithm).valid?(
+        message: @message,
+        key: key,
+        header_list: header_list,
+        provided_signature_base64: provided_signature_base64
+      )
+    rescue SignatureParametersParser::Error
+      false
     end
 
     private
@@ -16,25 +23,6 @@ module HttpSignatures
       @message.key?("Signature")
     end
 
-    def signature_matches?
-      expected_signature_base64 == provided_signature_base64
-    rescue SignatureParametersParser::Error
-      false
-    end
-
-    def expected_signature_base64
-      Base64.strict_encode64(expected_signature_raw)
-    end
-
-    def expected_signature_raw
-      Signature.new(
-        message: @message,
-        key: key,
-        algorithm: algorithm,
-        header_list: header_list,
-      ).to_str
-    end
-
     def provided_signature_base64
       parsed_parameters.fetch("signature")
     end

data/lib/http_signatures/verification_algorithm.rb

@@ -0,0 +1,17 @@
+module HttpSignatures
+  class VerificationAlgorithm
+    def self.create(algorithm)
+      case algorithm
+      when HttpSignatures::Algorithm::Hmac then Hmac.new(algorithm)
+      when HttpSignatures::Algorithm::Rsa then Rsa.new(algorithm)
+      else raise UnknownAlgorithm.new(algorithm)
+      end
+    end
+
+    class UnknownAlgorithm < StandardError
+      def initialize(algorithm)
+        super("Unknown algorithm '#{algorithm}'")
+      end
+    end
+  end
+end

data/lib/http_signatures/verification_algorithm/hmac.rb

@@ -0,0 +1,26 @@
+module HttpSignatures
+  class VerificationAlgorithm
+    class Hmac
+      def initialize(algorithm)
+        @algorithm = algorithm
+      end
+
+      def valid?(message:, key:, header_list:, provided_signature_base64:)
+        expected_signature_base64(message, key, header_list) == provided_signature_base64
+      end
+
+      def expected_signature_base64(message, key, header_list)
+        Base64.strict_encode64(expected_signature_raw(message, key, header_list))
+      end
+
+      def expected_signature_raw(message, key, header_list)
+        Signature.new(
+          message: message,
+          key: key,
+          algorithm: @algorithm,
+          header_list: header_list,
+        ).to_str
+      end
+    end
+  end
+end

data/lib/http_signatures/verification_algorithm/rsa.rb

@@ -0,0 +1,22 @@
+require "base64"
+
+module HttpSignatures
+  class VerificationAlgorithm
+    class Rsa
+      def initialize(algorithm)
+        @algorithm = algorithm
+      end
+
+      def valid?(message:, key:, header_list:, provided_signature_base64:)
+        @algorithm.verify(
+          key.secret,
+          Base64.strict_decode64(provided_signature_base64),
+          SigningString.new(
+            header_list: header_list,
+            message: message,
+          ).to_str
+        )
+      end
+    end
+  end
+end

data/lib/http_signatures/version.rb

@@ -1,3 +1,3 @@
 module HttpSignatures
-  VERSION = "1.0.4"
+  VERSION = "1.1.0"
 end

data/spec/keys/id_rsa

@@ -0,0 +1,15 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIICXgIBAAKBgQDCFENGw33yGihy92pDjZQhl0C36rPJj+CvfSC8+q28hxA161QF
+NUd13wuCTUcq0Qd2qsBe/2hFyc2DCJJg0h1L78+6Z4UMR7EOcpfdUE9Hf3m/hs+F
+UR45uBJeDK1HSFHD8bHKD6kv8FPGfJTotc+2xjJwoYi+1hqp1fIekaxsyQIDAQAB
+AoGBAJR8ZkCUvx5kzv+utdl7T5MnordT1TvoXXJGXK7ZZ+UuvMNUCdN2QPc4sBiA
+QWvLw1cSKt5DsKZ8UETpYPy8pPYnnDEz2dDYiaew9+xEpubyeW2oH4Zx71wqBtOK
+kqwrXa/pzdpiucRRjk6vE6YY7EBBs/g7uanVpGibOVAEsqH1AkEA7DkjVH28WDUg
+f1nqvfn2Kj6CT7nIcE3jGJsZZ7zlZmBmHFDONMLUrXR/Zm3pR5m0tCmBqa5RK95u
+412jt1dPIwJBANJT3v8pnkth48bQo/fKel6uEYyboRtA5/uHuHkZ6FQF7OUkGogc
+mSJluOdc5t6hI1VsLn0QZEjQZMEOWr+wKSMCQQCC4kXJEsHAve77oP6HtG/IiEn7
+kpyUXRNvFsDE0czpJJBvL/aRFUJxuRK91jhjC68sA7NsKMGg5OXb5I5Jj36xAkEA
+gIT7aFOYBFwGgQAQkWNKLvySgKbAZRTeLBacpHMuQdl1DfdntvAyqpAZ0lY0RKmW
+G6aFKaqQfOXKCyWoUiVknQJAXrlgySFci/2ueKlIE1QqIiLSZ8V8OlpFLRnb1pzI
+7U1yQXnTAEFYM560yJlzUpOb1V4cScGd365tiSMvxLOvTA==
+-----END RSA PRIVATE KEY-----

data/spec/keys/id_rsa.pub

@@ -0,0 +1,6 @@
+-----BEGIN PUBLIC KEY-----
+MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDCFENGw33yGihy92pDjZQhl0C3
+6rPJj+CvfSC8+q28hxA161QFNUd13wuCTUcq0Qd2qsBe/2hFyc2DCJJg0h1L78+6
+Z4UMR7EOcpfdUE9Hf3m/hs+FUR45uBJeDK1HSFHD8bHKD6kv8FPGfJTotc+2xjJw
+oYi+1hqp1fIekaxsyQIDAQAB
+-----END PUBLIC KEY-----

data/spec/rsa_spec.rb

@@ -0,0 +1,144 @@
+# NOTE: All test data in this spec are same as
+# https://github.com/tomitribe/http-signatures-java/blob/master/src/test/java/org/tomitribe/auth/signatures/RsaTest.java
+
+RSpec.shared_examples_for "signer" do |expected_signature|
+  let(:provided_signature) { HttpSignatures::SignatureParametersParser.new(message["signature"]).parse.fetch("signature") }
+  it "returns expected signature" do
+    context.signer.sign message
+    expect(provided_signature).to eq(expected_signature)
+  end
+end
+
+RSpec.shared_examples_for "verifier" do
+  it "validates signature" do
+    context.signer.sign message
+    expect(context.verifier.valid? message).to eq(true)
+  end
+
+  it "rejects if a signed header has changed" do
+    context.signer.sign message
+    message["Date"] = "Thu, 12 Jan 2012 21:31:40 GMT"
+    expect(context.verifier.valid? message).to eq(false)
+  end
+end
+
+RSpec.describe "Using RSA" do
+  let(:public_key) { File.read(File.join(__dir__, "keys", "id_rsa.pub")) }
+  let(:private_key) { File.read(File.join(__dir__, "keys", "id_rsa")) }
+
+  let(:message) do
+    Net::HTTP::Post.new(
+      "/foo?param=value&pet=dog",
+      "Host" => "example.org",
+      "Date" => "Thu, 05 Jan 2012 21:31:40 GMT",
+      "Content-Type" => "application/json",
+      "Digest" => "SHA-256=X48E9qOokqqrvdts8nOJRJN3OWDUoyWxBf7kbu9DBPE=",
+      "Accept" => "*/*",
+      "Content-Length" => "18"
+    )
+  end
+
+  let(:context) do
+    HttpSignatures::Context.new(
+      keys: {
+        "my_rsa_key_pair" => {
+          private_key: private_key,
+          public_key: public_key,
+        },
+      },
+      signing_key_id: "my_rsa_key_pair",
+      algorithm: algorithm,
+      headers: headers,
+    )
+  end
+
+  describe "context.signer.sign and context.verifier.valid?" do
+    context "algorithm is rsa-sha1" do
+      let(:algorithm) { "rsa-sha1" }
+
+      context "headers are %w{date}" do
+        let(:headers) { %w{date} }
+        it_behaves_like "signer", "kcX/cWMRQEjUPfF6AO7ANZ/eQkpRd" +
+          "/4+dr3g1B5HZBn3vRDxGFbDRY19HeJUUlBAgmvolRwLlrVkz" +
+          "LOmYdug6Ff01UUl6gX+TksGbsxagbNUNoEx0hrX3+8Jbd+x8" +
+          "gx9gZxA7DwXww1u3bGrmChnfkdOofY52KhUllUox4mmBeI="
+        it_behaves_like "verifier"
+      end
+
+      context "headers are %w{(request-target) host date}" do
+        let(:headers) { %w{(request-target) host date} }
+        it_behaves_like "signer", "F6g4qdBSHBcWo1iMsHetQU9TnPF39" +
+          "naVHQogAhgvY6wh0/cdkquN4D6CInTyEHtMuv7xlOt0yBaVt" +
+          "brrNP5JZKquYMW2JC3FXdtIiaYWhLUb/Nmb+JPr6C8AnxMzc" +
+          "fNfuOZFn3X7ekA32qbfnYr7loHqpEGUr+G1NYsckEXdlM4="
+        it_behaves_like "verifier"
+      end
+    end
+
+    context "algorithm is sha256" do
+      let(:algorithm) { "rsa-sha256" }
+
+      context "headers are %w{date}" do
+        let(:headers) { %w{date} }
+        it_behaves_like "signer", "ATp0r26dbMIxOopqw0OfABDT7CKMI" +
+          "oENumuruOtarj8n/97Q3htHFYpH8yOSQk3Z5zh8UxUym6FYT" +
+          "b5+A0Nz3NRsXJibnYi7brE/4tx5But9kkFGzG+xpUmimN4c3" +
+          "TMN7OFH//+r8hBf7BT9/GmHDUVZT2JzWGLZES2xDOUuMtA="
+        it_behaves_like "verifier"
+      end
+
+      context "headers are %w{(request-target) host date}" do
+        let(:headers) { %w{(request-target) host date} }
+        it_behaves_like "signer", "DT9vcDFbit2ahGZowjUzzih+sVpKM" +
+          "IPZrXy1DMljImYNSJ3UEweTMfF3MUFjdNwYH59IDJoB+QTg3" +
+          "Rpm5xLvMWD7tql/Ng/NCJs8gYSNjOQidArEpWp88c5IQPDXn" +
+          "1lnJMU6dNXZNxc8Yqj+mIYhwHpKEKTqnvEtnCvB/6y/dIM="
+        it_behaves_like "verifier"
+      end
+    end
+
+    context "algorithm is sha384" do
+      let(:algorithm) { "rsa-sha384" }
+
+      context "headers are %w{date}" do
+        let(:headers) { %w{date} }
+        it_behaves_like "signer", "AYtR6NQy+59Ta3X1GYNlfOzJo4Sg+" +
+          "aB+ulDkR6Q2/8egvByRx5l0+t/2abAaFHf33SDojHYWPlpuj" +
+          "HM26ExZPFXeYzG9sRctKD7XKrA/F6LRXEm1RXLFvfvLXQw4P" +
+          "4HE1PMH+gCw2E+6IoTnbcimQtZ82SkF1uDRtLDhR6iqpFI="
+        it_behaves_like "verifier"
+      end
+
+      context "headers are %w{(request-target) host date}" do
+        let(:headers) { %w{(request-target) host date} }
+        it_behaves_like "signer", "mRaP0Z5lh9XKGDahdsomoKR9Kjsj9" +
+          "a/lgUEpZDQpvSZq5NhODEjmQh1qRn6Sx/c+AFl67yzDYAMXx" +
+          "9h49ZOpKpuj4FGrz5/DIK7cdn9wXBKqDYgDfwOF9O5jNOE1r" +
+          "9zbORTH0XxA8WE9H/MXoOrDIH1NjM5o9I4ErT4zKnD5OsQ="
+        it_behaves_like "verifier"
+      end
+    end
+
+    context "algorithm is sha512" do
+      let(:algorithm) { "rsa-sha512" }
+
+      context "headers are %w{date}" do
+        let(:headers) { %w{date} }
+        it_behaves_like "signer", "IItboA8OJgL8WSAnJa8MND04s9j7d" +
+          "B6IJIBVpOGJph8Tmkc5yUAYjvO/UQUKytRBe5CSv2GLfTAmE" +
+          "7SuRgGGMwdQZubNJqRCiVPKBpuA47lXrKgC/wB0QAMkPHI6c" +
+          "PllBZRixmjZuU9mIbuLjXMHR+v/DZwOHT9k8x0ILUq2rKE="
+        it_behaves_like "verifier"
+      end
+
+      context "headers are %w{(request-target) host date}" do
+        let(:headers) { %w{(request-target) host date} }
+        it_behaves_like "signer", "ggIa4bcI7q377gNoQ7qVYxTA4pEOl" +
+          "xlFzRtiQV0SdPam4sK58SFO9EtzE0P1zVTymTnsSRChmFU2p" +
+          "n+R9VzkAhQ+yEbTqzu+mgHc4P1L5IeeXQ5aAmGENfkRbm2vd" +
+          "OZzP5j6ruB+SJXIlhnaum2lsuyytSS0m/GkWvFJVZFu33M="
+        it_behaves_like "verifier"
+      end
+    end
+  end
+end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: http_signatures
 version: !ruby/object:Gem::Version
-  version: 1.0.4
+  version: 1.1.0
 platform: ruby
 authors:
 - Paul Annesley
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-03-17 00:00:00.000000000 Z
+date: 2019-07-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -70,6 +70,7 @@ files:
 - lib/http_signatures.rb
 - lib/http_signatures/algorithm.rb
 - lib/http_signatures/algorithm/hmac.rb
+- lib/http_signatures/algorithm/rsa.rb
 - lib/http_signatures/context.rb
 - lib/http_signatures/header_list.rb
 - lib/http_signatures/key.rb
@@ -80,12 +81,18 @@ files:
 - lib/http_signatures/signer.rb
 - lib/http_signatures/signing_string.rb
 - lib/http_signatures/verification.rb
+- lib/http_signatures/verification_algorithm.rb
+- lib/http_signatures/verification_algorithm/hmac.rb
+- lib/http_signatures/verification_algorithm/rsa.rb
 - lib/http_signatures/verifier.rb
 - lib/http_signatures/version.rb
 - spec/algorithm_spec.rb
 - spec/context_spec.rb
 - spec/header_list_spec.rb
 - spec/key_store_spec.rb
+- spec/keys/id_rsa
+- spec/keys/id_rsa.pub
+- spec/rsa_spec.rb
 - spec/signature_parameters_parser_spec.rb
 - spec/signature_parameters_spec.rb
 - spec/signer_spec.rb
@@ -111,8 +118,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubyforge_project: 
-rubygems_version: 2.2.2
+rubygems_version: 3.0.3
 signing_key: 
 specification_version: 4
 summary: Sign and verify HTTP messages
@@ -121,10 +127,12 @@ test_files:
 - spec/context_spec.rb
 - spec/header_list_spec.rb
 - spec/key_store_spec.rb
+- spec/keys/id_rsa
+- spec/keys/id_rsa.pub
+- spec/rsa_spec.rb
 - spec/signature_parameters_parser_spec.rb
 - spec/signature_parameters_spec.rb
 - spec/signer_spec.rb
 - spec/signing_string_spec.rb
 - spec/spec_helper.rb
 - spec/verifier_spec.rb
-has_rdoc: