jose 0.1.0

data/lib/jose/jwe/zip.rb

@@ -0,0 +1,7 @@
+module JOSE::JWE::ZIP
+
+  extend self
+
+end
+
+require 'jose/jwe/zip_def'

data/lib/jose/jwe/zip_def.rb

@@ -0,0 +1,28 @@
+class JOSE::JWE::ZIP_DEF
+
+  # JOSE::JWE callbacks
+
+  def self.from_map(fields)
+    case fields['zip']
+    when 'DEF'
+      return new(), fields.except('zip')
+    else
+      raise ArgumentError, "invalid 'zip' for JWE: #{fields['zip'].inspect}"
+    end
+  end
+
+  def to_map(fields)
+    return fields.put('zip', 'DEF')
+  end
+
+  # JOSE::JWE::ZIP callbacks
+
+  def compress(plain_text)
+    return Zlib.deflate(plain_text)
+  end
+
+  def uncompress(cipher_text)
+    return Zlib.inflate(cipher_text)
+  end
+
+end

data/lib/jose/jwk.rb

@@ -0,0 +1,347 @@
+module JOSE
+  class JWK < Struct.new(:keys, :kty, :fields)
+
+    # Decode API
+
+    def self.from(object, modules = nil, key = nil)
+      case object
+      when JOSE::Map, Hash
+        return from_map(object, modules, key)
+      when String
+        return from_binary(object, modules, key)
+      when JOSE::JWK
+        return object
+      else
+        raise ArgumentError, "'object' must be a Hash, String, or JOSE::JWK"
+      end
+    end
+
+    def self.from_binary(object, modules = nil, key = nil)
+      if (modules.is_a?(String) or modules.is_a?(JOSE::JWK)) and key.nil?
+        key = modules
+        modules = {}
+      end
+      modules ||= {}
+      case object
+      when String
+        if key
+          plain_text, jwe = JOSE::JWE.block_decrypt(key, object)
+          return from_binary(plain_text, modules), jwe
+        else
+          return from_map(JOSE.decode(object), modules)
+        end
+      else
+        raise ArgumentError, "'object' must be a String"
+      end
+    end
+
+    def self.from_file(file, modules = nil, key = nil)
+      return from_binary(File.binread(file), modules, key)
+    end
+
+    def self.from_key(object, modules = {})
+      kty = modules[:kty] || JOSE::JWK::KTY
+      return JOSE::JWK.new(nil, *kty.from_key(object))
+    end
+
+    def self.from_map(object, modules = nil, key = nil)
+      if (modules.is_a?(String) or modules.is_a?(JOSE::JWK)) and key.nil?
+        key = modules
+        modules = {}
+      end
+      modules ||= {}
+      case object
+      when JOSE::Map, Hash
+        if key
+          plain_text, jwe = JOSE::JWE.block_decrypt(key, object)
+          return from_binary(plain_text, modules), jwe
+        else
+          return from_fields(JOSE::JWK.new(nil, nil, JOSE::Map.new(object)), modules)
+        end
+      else
+        raise ArgumentError, "'object' must be a String"
+      end
+    end
+
+    def self.from_pem(object, modules = nil, password = nil)
+      if modules.is_a?(String) and password.nil?
+        password = modules
+        modules  = {}
+      end
+      modules ||= {}
+      kty = modules[:kty] || JOSE::JWK::PEM
+      return JOSE::JWK.new(nil, *kty.from_binary(object, password))
+    end
+
+    def self.from_pem_file(file, modules = nil, password = nil)
+      return from_pem(File.binread(file), modules, password)
+    end
+
+    def self.from_oct(object, modules = {})
+      kty = modules[:kty] || JOSE::JWK::KTY_oct
+      return JOSE::JWK.new(nil, *kty.from_oct(object))
+    end
+
+    def self.from_oct_file(file, modules = {})
+      return from_oct(File.binread(file), modules)
+    end
+
+    # Encode API
+
+    def self.to_binary(jwk, key = nil, jwe = nil)
+      return from(jwk).to_binary(key, jwe)
+    end
+
+    def to_binary(key = nil, jwe = nil)
+      if not key.nil?
+        jwe ||= kty.key_encryptor(fields, key)
+      end
+      if key and jwe
+        return to_map(key, jwe).compact
+      else
+        return JOSE.encode(to_map)
+      end
+    end
+
+    def self.to_file(jwk, file, key = nil, jwe = nil)
+      return from(jwk).to_file(file, key, jwe)
+    end
+
+    def to_file(file, key = nil, jwe = nil)
+      return File.binwrite(file, to_binary(key, jwe))
+    end
+
+    def self.to_key(jwk)
+      return from(jwk).to_key
+    end
+
+    def to_key
+      return kty.to_key
+    end
+
+    def self.to_map(jwk, key = nil, jwe = nil)
+      return from(jwk).to_map(key, jwe)
+    end
+
+    def to_map(key = nil, jwe = nil)
+      if not key.nil?
+        jwe ||= kty.key_encryptor(fields, key)
+      end
+      if key and jwe
+        return JOSE::JWE.block_encrypt(key, to_binary, jwe)
+      else
+        return kty.to_map(fields)
+      end
+    end
+
+    def self.to_oct(jwk)
+      return from(jwk).to_oct
+    end
+
+    def to_oct
+      return kty.to_oct
+    end
+
+    def self.to_pem(jwk, password = nil)
+      return from(jwk).to_pem(password)
+    end
+
+    def to_pem(password = nil)
+      return kty.to_pem(password)
+    end
+
+    def self.to_public(jwk)
+      return from(jwk).to_public
+    end
+
+    def to_public
+      return JOSE::JWK.from_map(to_public_map)
+    end
+
+    def self.to_public_key(jwk)
+      return from(jwk).to_public_key
+    end
+
+    def to_public_key
+      return to_public.to_key
+    end
+
+    def self.to_public_map(jwk)
+      return from(jwk).to_public_map
+    end
+
+    def to_public_map
+      return kty.to_public_map(fields)
+    end
+
+    def self.to_thumbprint_map(jwk)
+      return from(jwk).to_thumbprint_map
+    end
+
+    def to_thumbprint_map
+      return kty.to_thumbprint_map(fields)
+    end
+
+    # API
+
+    def self.block_decrypt(jwk, encrypted)
+      return from(jwk).block_decrypt(encrypted)
+    end
+
+    def block_decrypt(encrypted)
+      return JOSE::JWE.block_decrypt(self, encrypted)
+    end
+
+    def self.block_encrypt(jwk, plain_text, jwe = nil)
+      return from(jwk).block_encrypt(plain_text, jwe)
+    end
+
+    def block_encrypt(plain_text, jwe = nil)
+      jwe ||= kty.block_encryptor(fields, plain_text)
+      return JOSE::JWE.block_encrypt(self, plain_text, jwe)
+    end
+
+    def self.box_decrypt(jwk, encrypted)
+      return from(jwk).box_decrypt(encrypted)
+    end
+
+    def box_decrypt(encrypted)
+      return JOSE::JWE.block_decrypt(self, encrypted)
+    end
+
+    # Generates an ephemeral private key based on other public key curve.
+    def box_encrypt(plain_text, my_private_jwk = nil, jwe = nil)
+      generated_jwk = nil
+      other_public_jwk = self
+      if my_private_jwk.nil?
+        generated_jwk = my_private_jwk = other_public_jwk.generate_key
+      end
+      if not my_private_jwk.is_a?(JOSE::JWK)
+        my_private_jwk = JOSE::JWK.from(my_private_jwk)
+      end
+      if jwe.nil?
+        jwe = other_public_jwk.kty.block_encryptor(fields, plain_text)
+      end
+      if jwe.is_a?(Hash)
+        jwe = JOSE::Map.new(jwe)
+      end
+      if jwe.is_a?(JOSE::Map)
+        if jwe['apu'].nil?
+          jwe = jwe.put('apu', my_private_jwk.fields['kid'] || my_private_jwk.thumbprint)
+        end
+        if jwe['apv'].nil?
+          jwe = jwe.put('apv', other_public_jwk.fields['kid'] || other_public_jwk.thumbprint)
+        end
+        if jwe['epk'].nil?
+          jwe = jwe.put('epk', my_private_jwk.to_public_map)
+        end
+      end
+      if generated_jwk
+        return JOSE::JWE.block_encrypt([other_public_jwk, my_private_jwk], plain_text, jwe), generated_jwk
+      else
+        return JOSE::JWE.block_encrypt([other_public_jwk, my_private_jwk], plain_text, jwe)
+      end
+    end
+
+    def derive_key(*args)
+      return kty.derive_key(*args)
+    end
+
+    def self.generate_key(params)
+      if params.is_a?(Array) and (params.length == 2 or params.length == 3)
+        case params[0]
+        when :ec
+          return JOSE::JWK.new(nil, *JOSE::JWK::KTY_EC.generate_key(params))
+        when :oct
+          return JOSE::JWK.new(nil, *JOSE::JWK::KTY_oct.generate_key(params))
+        when :rsa
+          return JOSE::JWK.new(nil, *JOSE::JWK::KTY_RSA.generate_key(params))
+        else
+          raise ArgumentError, "invalid key generation params"
+        end
+      elsif params.is_a?(JOSE::JWK)
+        return params.generate_key
+      elsif params.respond_to?(:generate_key)
+        return JOSE::JWK.new(nil, *params.generate_key(JOSE::Map[]))
+      else
+        raise ArgumentError, "invalid key generation params"
+      end
+    end
+
+    def generate_key
+      return JOSE::JWK.new(nil, *kty.generate_key(fields))
+    end
+
+    def self.sign(jwk, plain_text, jws = nil, header = nil)
+      return from(jwk).sign(plain_text, jws, header)
+    end
+
+    def sign(plain_text, jws = nil, header = nil)
+      jws ||= kty.signer(fields, plain_text)
+      return JOSE::JWS.sign(self, plain_text, jws, header)
+    end
+
+    def self.verify(signed, jwk)
+      return from(jwk).verify(signed)
+    end
+
+    def verify(signed)
+      return JOSE::JWS.verify(self, signed)
+    end
+
+    def self.verify_strict(signed, allow, jwk)
+      return from(jwk).verify_strict(signed, allow)
+    end
+
+    def verify_strict(signed, allow)
+      return JOSE::JWS.verify_strict(self, allow, signed)
+    end
+
+    # See https://tools.ietf.org/html/rfc7638
+    def self.thumbprint(digest_type, jwk = nil)
+      if jwk.nil?
+        jwk = digest_type
+        digest_type = nil
+      end
+      return from(jwk).thumbprint(digest_type)
+    end
+
+    def thumbprint(digest_type = nil)
+      digest_type ||= 'SHA256'
+      thumbprint_binary = JOSE.encode(to_thumbprint_map)
+      return JOSE.urlsafe_encode64(OpenSSL::Digest.new(digest_type).digest(thumbprint_binary))
+    end
+
+  private
+
+    def self.from_fields(jwk, modules)
+      if jwk.fields.has_key?('keys')
+        keys = modules[:keys] || JOSE::JWK::Set
+        jwk.keys, jwk.fields = keys.from_map(jwk.fields)
+        return from_fields(jwk, modules)
+      elsif jwk.fields.has_key?('kty')
+        kty = modules[:kty] || case jwk.fields['kty']
+        when 'EC'
+          JOSE::JWK::KTY_EC
+        when 'oct'
+          JOSE::JWK::KTY_oct
+        when 'RSA'
+          JOSE::JWK::KTY_RSA
+        else
+          raise ArgumentError, "unknown 'kty': #{jwk.fields['kty'].inspect}"
+        end
+        jwk.kty, jwk.fields = kty.from_map(jwk.fields)
+        return from_fields(jwk, modules)
+      elsif jwk.keys.nil? and jwk.kty.nil?
+        raise ArgumentError, "missing required keys: 'keys' or 'kty'"
+      else
+        return jwk
+      end
+    end
+
+  end
+end
+
+require 'jose/jwk/pem'
+require 'jose/jwk/set'
+require 'jose/jwk/kty'

data/lib/jose/jwk/kty.rb

@@ -0,0 +1,34 @@
+module JOSE::JWK::KTY
+
+  extend self
+
+  def from_key(object)
+    case object
+    when OpenSSL::PKey::EC
+      return JOSE::JWK::KTY_EC.from_key(object)
+    when OpenSSL::PKey::RSA
+      return JOSE::JWK::KTY_RSA.from_key(object)
+    else
+      raise ArgumentError, "'object' is not a recognized key type"
+    end
+  end
+
+  def key_encryptor(kty, fields, key)
+    if key.is_a?(String)
+      return JOSE::Map[
+        'alg' => 'PBES2-HS256+A128KW',
+        'cty' => 'jwk+json',
+        'enc' => 'A128GCM',
+        'p2c' => 4096,
+        'p2s' => JOSE.urlsafe_encode64(SecureRandom.random_bytes(16))
+      ]
+    else
+      raise ArgumentError, "unhandled key type for key_encryptor"
+    end
+  end
+
+end
+
+require 'jose/jwk/kty_ec'
+require 'jose/jwk/kty_oct'
+require 'jose/jwk/kty_rsa'

data/lib/jose/jwk/kty_ec.rb

@@ -0,0 +1,179 @@
+class JOSE::JWK::KTY_EC < Struct.new(:key)
+
+  # JOSE::JWK callbacks
+
+  def self.from_map(fields)
+    if fields['kty'] == 'EC' and fields['crv'].is_a?(String) and fields['x'].is_a?(String) and fields['y'].is_a?(String)
+      crv = case fields['crv']
+      when 'P-256'
+        'prime256v1'
+      when 'P-384'
+        'secp384r1'
+      when 'P-521'
+        'secp521r1'
+      else
+        raise ArgumentError, "invalid 'EC' JWK"
+      end
+      ec = OpenSSL::PKey::EC.new(crv)
+      x = JOSE.urlsafe_decode64(fields['x'])
+      y = JOSE.urlsafe_decode64(fields['y'])
+      ec.public_key = OpenSSL::PKey::EC::Point.new(
+        OpenSSL::PKey::EC::Group.new(crv),
+        OpenSSL::BN.new([0x04, x, y].pack('CA*A*'), 2)
+      )
+      if fields['d'].is_a?(String)
+        ec.private_key = OpenSSL::BN.new(JOSE.urlsafe_decode64(fields['d']), 2)
+      end
+      return JOSE::JWK::KTY_EC.new(ec), fields.except('kty', 'crv', 'd', 'x', 'y')
+    else
+      raise ArgumentError, "invalid 'EC' JWK"
+    end
+  end
+
+  def to_key
+    return key
+  end
+
+  def to_map(fields)
+    ec_point = key.public_key.to_bn.to_s(2)
+    ec_point_x, ec_point_y = case ec_point.bytesize
+    when 65
+      ec_point.unpack('xA32A32')
+    when 97
+      ec_point.unpack('xA48A48')
+    when 133
+      ec_point.unpack('xA66A66')
+    else
+      raise ArgumentError, "unhandled EC point size: #{ec_point.bytesize.inspect}"
+    end
+    crv = case key.group.curve_name
+    when 'prime256v1', 'secp256r1'
+      'P-256'
+    when 'secp384r1'
+      'P-384'
+    when 'secp521r1'
+      'P-521'
+    else
+      raise ArgumentError, "unhandled EC curve name: #{key.group.curve_name.inspect}"
+    end
+    if key.private_key?
+      return fields.
+        put('crv', crv).
+        put('d',   JOSE.urlsafe_encode64(key.private_key.to_s(2))).
+        put('kty', 'EC').
+        put('x',   JOSE.urlsafe_encode64(ec_point_x)).
+        put('y',   JOSE.urlsafe_encode64(ec_point_y))
+    else
+      return fields.
+        put('crv', crv).
+        put('kty', 'EC').
+        put('x',   JOSE.urlsafe_encode64(ec_point_x)).
+        put('y',   JOSE.urlsafe_encode64(ec_point_y))
+    end
+  end
+
+  def to_public_map(fields)
+    return to_map(fields).except('d')
+  end
+
+  def to_thumbprint_map(fields)
+    return to_public_map(fields).slice('crv', 'kty', 'x', 'y')
+  end
+
+  # JOSE::JWK::KTY callbacks
+
+  def block_encryptor(fields, plain_text)
+    return JOSE::Map[
+      'alg' => 'ECDH-ES',
+      'enc' => 'A128GCM'
+    ]
+  end
+
+  def derive_key(my_private_key)
+    if my_private_key.is_a?(JOSE::JWK)
+      my_private_key = my_private_key.to_key
+    end
+    if my_private_key.private_key?
+      return my_private_key.dh_compute_key(key.public_key)
+    else
+      raise ArgumentError, "derive_key requires a private key as an argument"
+    end
+  end
+
+  def self.generate_key(curve_name)
+    if curve_name.is_a?(Array) and curve_name.length == 2 and curve_name[0] == :ec
+      curve_name = curve_name[1]
+    end
+    if curve_name.is_a?(String)
+      return from_key(OpenSSL::PKey::EC.new(curve_name).generate_key)
+    else
+      raise ArgumentError, "'curve_name' must be a String"
+    end
+  end
+
+  def generate_key(fields)
+    kty, other_fields = JOSE::JWK::KTY_EC.generate_key([:ec, key.group.curve_name])
+    return kty, fields.delete('kid').merge(other_fields)
+  end
+
+  def key_encryptor(fields, key)
+    return JOSE::JWK::KTY.key_encryptor(self, fields, key)
+  end
+
+  def sign(message, digest_type)
+    asn1_signature = key.dsa_sign_asn1(digest_type.digest(message))
+    asn1_sequence = OpenSSL::ASN1.decode(asn1_signature)
+    rbin = asn1_sequence.value[0].value.to_s(2)
+    sbin = asn1_sequence.value[1].value.to_s(2)
+    size = [rbin.bytesize, sbin.bytesize].max
+    rpad = pad(rbin, size)
+    spad = pad(sbin, size)
+    return rpad.concat(spad)
+  end
+
+  def signer(fields = nil, plain_text = nil)
+    if key.private_key?
+      return JOSE::Map['alg' => 'ES256']
+    else
+      raise ArgumentError, "signing not supported for public keys"
+    end
+  end
+
+  def verify(message, digest_type, signature)
+    n = signature.bytesize.div(2)
+    r = OpenSSL::BN.new(signature[0..(n-1)], 2)
+    s = OpenSSL::BN.new(signature[n..-1], 2)
+    asn1_sequence = OpenSSL::ASN1::Sequence.new([
+      OpenSSL::ASN1::Integer.new(r),
+      OpenSSL::ASN1::Integer.new(s)
+    ])
+    asn1_signature = asn1_sequence.to_der
+    return key.dsa_verify_asn1(digest_type.digest(message), asn1_signature)
+  end
+
+  # API functions
+
+  def self.from_key(key)
+    case key
+    when OpenSSL::PKey::EC
+      return JOSE::JWK::KTY_EC.new(key), JOSE::Map[]
+    else
+      raise ArgumentError, "'key' must be a OpenSSL::PKey::EC"
+    end
+  end
+
+  def to_pem(password = nil)
+    return JOSE::JWK::PEM.to_binary(key, password)
+  end
+
+private
+
+  def pad(bin, size)
+    if bin.bytesize == size
+      return bin
+    else
+      return pad([0x00].pack('C').concat(bin), size)
+    end
+  end
+
+end