json-jwt 0.1.5 → 0.1.6

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    json-jwt (0.1.4)
+    json-jwt (0.1.5)
       activesupport (>= 2.3)
       i18n
       json (>= 1.4.3)
@@ -24,14 +24,14 @@ GEM
     json (1.7.3)
     multi_json (1.3.6)
     rake (0.9.2.2)
-    rspec (2.10.0)
-      rspec-core (~> 2.10.0)
-      rspec-expectations (~> 2.10.0)
-      rspec-mocks (~> 2.10.0)
-    rspec-core (2.10.1)
-    rspec-expectations (2.10.0)
+    rspec (2.11.0)
+      rspec-core (~> 2.11.0)
+      rspec-expectations (~> 2.11.0)
+      rspec-mocks (~> 2.11.0)
+    rspec-core (2.11.1)
+    rspec-expectations (2.11.1)
       diff-lcs (~> 1.1.3)
-    rspec-mocks (2.10.1)
+    rspec-mocks (2.11.1)
     url_safe_base64 (0.2.1)
     yamler (0.1.0)
 

data/VERSION

@@ -1 +1 @@
-0.1.5
+0.1.6

data/lib/json/jwk.rb

@@ -1,11 +1,41 @@
 module JSON
   class JWK < Hash
+    class UnknownAlgorighm < JWT::Exception; end
+
     def initialize(public_key, options = {})
       replace encode(public_key, options)
     end
 
     private
 
+    def ecdsa_curve_name(ecdsa_key)
+      case ecdsa_key.group.curve_name
+      when 'secp256k1'
+        :'P-256'
+      when 'secp384r1'
+        :'P-384'
+      when 'secp521r1'
+        :'P-521'
+      else
+        raise UnknownAlgorighm.new('Unknown ECDSA Curve')
+      end
+    end
+
+    def ecdsa_coodinates(ecdsa_key)
+      unless @ecdsa_coodinates
+        hex = ecdsa_key.public_key.to_bn.to_s(16)
+        data_len = hex.length - 2
+        type = hex[0,2]
+        hex_x =  hex[2, data_len/2]
+        hex_y = hex[2+data_len/2, data_len/2]
+        @ecdsa_coodinates = {
+          :x => hex_x,
+          :y => hex_y
+        }
+      end
+      @ecdsa_coodinates
+    end
+
     def encode(public_key, options = {})
       hash = case public_key
       when OpenSSL::PKey::RSA
@@ -14,8 +44,15 @@ module JSON
           exp: UrlSafeBase64.encode64(public_key.e.to_s(2)),
           mod: UrlSafeBase64.encode64(public_key.n.to_s(2))
         }
+      when OpenSSL::PKey::EC
+        {
+          alg: :EC,
+          crv: ecdsa_curve_name(public_key),
+          x: UrlSafeBase64.encode64(ecdsa_coodinates(public_key)[:x].to_s),
+          y: UrlSafeBase64.encode64(ecdsa_coodinates(public_key)[:y].to_s)
+        }
       else
-        raise "Only RSA is supported now"
+        raise UnknownAlgorighm.new('Unknown Algorithm')
       end
       hash.merge(options)
     end

data/lib/json/jws.rb

@@ -58,8 +58,9 @@ module JSON
         private_key = private_key_or_secret
         private_key.sign digest, signature_base_string
       when ecdsa?
-        # TODO
-        raise NotImplementedError.new
+        private_key = private_key_or_secret
+        verify_ecdsa_group! private_key
+        private_key.dsa_sign_asn1 digest.digest(signature_base_string)
       else
         raise InvalidFormat.new('Unknown Signature Algorithm')
       end
@@ -74,13 +75,27 @@ module JSON
         public_key = public_key_or_secret
         public_key.verify digest, signature, signature_base_string
       when ecdsa?
-        # TODO
-        raise NotImplementedError.new
+        public_key = public_key_or_secret
+        verify_ecdsa_group! public_key
+        public_key.dsa_verify_asn1 digest.digest(signature_base_string), signature
       else
         raise InvalidFormat.new('Unknown Signature Algorithm')
       end
     end
 
+    def verify_ecdsa_group!(key)
+      group_name = case digest.digest_length * 8
+      when 256
+        'secp256k1'
+      when 384
+        'secp384r1'
+      when 512
+        'secp521r1'
+      end
+      key.group = OpenSSL::PKey::EC::Group.new group_name
+      key.check_key
+    end
+
     def replace(hash_or_jwt)
       super
       if hash_or_jwt.is_a? JSON::JWT

data/spec/fixtures/ecdsa/256/private_key.pem

@@ -0,0 +1,5 @@
+-----BEGIN EC PRIVATE KEY-----
+MHQCAQEEIAm5+R4izRn6OHBl59IL9ow1txjto6gD21IDdDyhXmOWoAcGBSuBBAAK
+oUQDQgAElSHlYujXQEFMiiuZ1Gb91eXwxTGvTKbBFmzOxTtf0w8CCk1UB6G750Br
+xiIbllGmVmkoiuWKVkxnB9X9nccJtw==
+-----END EC PRIVATE KEY-----

data/spec/fixtures/ecdsa/256/public_key.pem

@@ -0,0 +1,4 @@
+-----BEGIN PUBLIC KEY-----
+MFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAElSHlYujXQEFMiiuZ1Gb91eXwxTGvTKbB
+FmzOxTtf0w8CCk1UB6G750BrxiIbllGmVmkoiuWKVkxnB9X9nccJtw==
+-----END PUBLIC KEY-----

data/spec/fixtures/ecdsa/384/private_key.pem

@@ -0,0 +1,6 @@
+-----BEGIN EC PRIVATE KEY-----
+MIGkAgEBBDB1NRLzYeQa7oRUwWrnQFZOBVqzlyJ9n654/PFjCLJh/A/uGWeECoM2
+1hXEvp80pqGgBwYFK4EEACKhZANiAASmXMCnIWcrurOGDlechlsWPaFmgfZV2Xj5
+EWbsOew0wb23Kqul+rZHKN8oAFtwVG2LEHN9+GTd9xuZ6KkYuS9AE0LN42bpAveE
+5RMfogUHM4vRjsewZOik1NOykuOWK9s=
+-----END EC PRIVATE KEY-----

data/spec/fixtures/ecdsa/384/public_key.pem

@@ -0,0 +1,5 @@
+-----BEGIN PUBLIC KEY-----
+MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEplzApyFnK7qzhg5XnIZbFj2hZoH2Vdl4
++RFm7DnsNMG9tyqrpfq2RyjfKABbcFRtixBzffhk3fcbmeipGLkvQBNCzeNm6QL3
+hOUTH6IFBzOL0Y7HsGTopNTTspLjlivb
+-----END PUBLIC KEY-----

data/spec/fixtures/ecdsa/512/private_key.pem

@@ -0,0 +1,7 @@
+-----BEGIN EC PRIVATE KEY-----
+MIHcAgEBBEIBBpwKqvGEZGpE3wX1fDzJjrrM4uXr16WKsijjqjRP8tHdnvr5p2fO
+zrPVyDVbiQDulOhSh9aouunuwmbudKjWvZagBwYFK4EEACOhgYkDgYYABAHDAg/m
+tGuq5xPU7wtJjqhfwxl0YOWN4k2+HhzcE5tpA+oro8fTP3/HfxRh69DoaasxJ+K2
+D2GaLhrGyDxIC9Kv/wFC2BHfJfm1fwSNvPWns4Ui2dUQxdpbYAzxMvWO2LamGuHC
+XKYss1QzKV1sAaenI4Ok1yDZKFa1V2YTeNOIobuCNg==
+-----END EC PRIVATE KEY-----

data/spec/fixtures/ecdsa/512/public_key.pem

@@ -0,0 +1,6 @@
+-----BEGIN PUBLIC KEY-----
+MIGbMBAGByqGSM49AgEGBSuBBAAjA4GGAAQBwwIP5rRrqucT1O8LSY6oX8MZdGDl
+jeJNvh4c3BObaQPqK6PH0z9/x38UYevQ6GmrMSfitg9hmi4axsg8SAvSr/8BQtgR
+3yX5tX8Ejbz1p7OFItnVEMXaW2AM8TL1jti2phrhwlymLLNUMyldbAGnpyODpNcg
+2ShWtVdmE3jTiKG7gjY=
+-----END PUBLIC KEY-----

data/spec/helpers/sign_key_fixture_helper.rb

@@ -7,23 +7,36 @@ module SignKeyFixtureHelper
     File.new(
       File.join(
         File.dirname(__FILE__),
-        '../fixtures/rsa',
-        "#{file_name}.pem"
+        "../fixtures/#{file_name}.pem"
       )
     )
   end
 
-  def private_key
-    OpenSSL::PKey::RSA.new(
-      pem_file('private_key'),
-      'pass-phrase'
-    )
+  def private_key(algorithm = :rsa, options = {})
+    case algorithm
+    when :rsa
+      OpenSSL::PKey::RSA.new(
+        pem_file("#{algorithm}/private_key"),
+        'pass-phrase'
+      )
+    when :ecdsa
+      OpenSSL::PKey::EC.new(
+        pem_file("#{algorithm}/#{options[:digest_length]}/private_key")
+      )
+    end
   end
 
-  def public_key
-    OpenSSL::PKey::RSA.new(
-      pem_file('public_key')
-    )
+  def public_key(algorithm = :rsa, options = {})
+    case algorithm
+    when :rsa
+      OpenSSL::PKey::RSA.new(
+        pem_file("#{algorithm}/public_key")
+      )
+    when :ecdsa
+      OpenSSL::PKey::EC.new(
+        pem_file("#{algorithm}/#{options[:digest_length]}/public_key")
+      )
+    end
   end
 end
 

data/spec/json/jwk_spec.rb

@@ -1,20 +1,64 @@
 require 'spec_helper'
 
 describe JSON::JWK do
-  let(:rsa_public_key) { public_key }
-
   context 'when RSA public key given' do
-    let(:jwk) { JSON::JWK.new rsa_public_key }
+    let(:jwk) { JSON::JWK.new public_key }
     it { jwk.should include :alg, :exp, :mod }
     its(:alg) { jwk[:alg].should == :RSA }
-    its(:exp) { jwk[:exp].should == UrlSafeBase64.encode64(rsa_public_key.e.to_s(2)) }
-    its(:mod) { jwk[:mod].should == UrlSafeBase64.encode64(rsa_public_key.n.to_s(2)) }
+    its(:exp) { jwk[:exp].should == UrlSafeBase64.encode64(public_key.e.to_s(2)) }
+    its(:mod) { jwk[:mod].should == UrlSafeBase64.encode64(public_key.n.to_s(2)) }
 
     context 'when kid/use options given' do
-      let(:jwk) { JSON::JWK.new rsa_public_key, :kid => '12345', :use => :sig }
+      let(:jwk) { JSON::JWK.new public_key, :kid => '12345', :use => :sig }
       it { jwk.should include :kid, :use }
       its(:kid) { jwk[:kid].should == '12345' }
       its(:use) { jwk[:use].should == :sig }
     end
   end
+
+  context 'when ECDSA public key given' do
+    let(:expected_coodinates) do
+      {
+        256 => {
+          :x => 'OTUyMUU1NjJFOEQ3NDA0MTRDOEEyQjk5RDQ2NkZERDVFNUYwQzUzMUFGNENBNkMxMTY2Q0NFQzUzQjVGRDMwRg',
+          :y => 'MDIwQTRENTQwN0ExQkJFNzQwNkJDNjIyMUI5NjUxQTY1NjY5Mjg4QUU1OEE1NjRDNjcwN0Q1RkQ5REM3MDlCNw'
+        },
+        384 => {
+          :x => 'QTY1Q0MwQTcyMTY3MkJCQUIzODYwRTU3OUM4NjVCMTYzREExNjY4MUY2NTVEOTc4RjkxMTY2RUMzOUVDMzRDMUJEQjcyQUFCQTVGQUI2NDcyOERGMjgwMDVCNzA1NDZE',
+          :y => 'OEIxMDczN0RGODY0RERGNzFCOTlFOEE5MThCOTJGNDAxMzQyQ0RFMzY2RTkwMkY3ODRFNTEzMUZBMjA1MDczMzhCRDE4RUM3QjA2NEU4QTRENEQzQjI5MkUzOTYyQkRC'
+        },
+        512 => {
+          :x => 'MDFDMzAyMEZFNkI0NkJBQUU3MTNENEVGMEI0OThFQTg1RkMzMTk3NDYwRTU4REUyNERCRTFFMUNEQzEzOUI2OTAzRUEyQkEzQzdEMzNGN0ZDNzdGMTQ2MUVCRDBFODY5QUIzMTI3RTJCNjBGNjE5QTJFMUFDNkM4M0M0ODBCRDJBRkZG',
+          :y => 'MDE0MkQ4MTFERjI1RjlCNTdGMDQ4REJDRjVBN0IzODUyMkQ5RDUxMEM1REE1QjYwMENGMTMyRjU4RUQ4QjZBNjFBRTFDMjVDQTYyQ0IzNTQzMzI5NUQ2QzAxQTdBNzIzODNBNEQ3MjBEOTI4NTZCNTU3NjYxMzc4RDM4OEExQkI4MjM2'
+        }
+      }
+    end
+    [256, 384, 512].each do |digest_length|
+      describe "EC#{digest_length}" do
+        let(:jwk) { JSON::JWK.new public_key(:ecdsa, :digest_length => digest_length) }
+        it { jwk.should include :alg, :crv, :x, :y }
+        its(:alg) { jwk[:alg].should == :EC }
+        its(:x) { jwk[:x].should == expected_coodinates[digest_length][:x] }
+        its(:y) { jwk[:y].should == expected_coodinates[digest_length][:y] }
+      end
+    end
+
+    describe 'unknown curve' do
+      it do
+        key = OpenSSL::PKey::EC.new('secp112r2').generate_key
+        expect do
+          JSON::JWK.new key
+        end.to raise_error JSON::JWK::UnknownAlgorighm, 'Unknown ECDSA Curve'
+      end
+    end
+  end
+
+  describe 'unknown algorithm' do
+    it do
+      key = OpenSSL::PKey::DSA.generate 256
+      expect do
+        JSON::JWK.new key
+      end.to raise_error JSON::JWK::UnknownAlgorighm, 'Unknown Algorithm'
+    end
+  end
 end

data/spec/json/jws_spec.rb

@@ -24,10 +24,7 @@ describe JSON::JWS do
       :HS512 => 'ce-GlHDaNwaHfmAFRGp3QPPKvrpruTug2hC1bf6yNlbuvkMwJw2jFZgq_4wmIPetRdiBy7XFq7rrtmw1Im7tmQ',
       :RS256 => 'E5VELqAdla2Bx1axc9KFxO0EiCr0Mw6HPYX070qGQ8zA_XmyxGPUZLyyWU_6Cn399W-oYBWO2ynLlr8pqqjP3jXevyCeYeGRVN0HzLYiBebEugNnc3hevr7WV2UzfksWRA-Ux2bDv2sz9p_LGbL33wWNxGDvIlpDyZUul_a48nCipS0riBjkTLTSE8dfBxQTXEF5GEUUu99ot6aBLzUhc25nHXSXogXF6MHK-hAcE7f4v-vJ0lbPbHLVGUopIoxoqe4XjoBpzE5UvhrVl5LYbdjbyJhu5ZIA8GLsgwtUFh3dfdIechORoR3k5NSFSv8157bAEa8t4iwgWD2MSNSQnw',
       :RS384 => 'lT5JbytGKgG9QrwkJuxgw7UjmN9tjkEQW9pVGR2XnKEdC0_wLNIzAmT-jTwyMDGBLUkWO7opDOP6Xy6_DOTg58k9PwVkyQzrLnmxJMEng2Q-aMqcitRSIvUk3DPy8kemp8yUPls9NzWmByM2GoUVHbDsR0r-tZN-g_9QYev32mvMhjMr30JI5S2xiRjc9m2GAaXMOQmNTovJgV4bgCp4UjruCrA0BD1JJwDqKYoR_YYr_ALcVjD_LUgy80udJvbi8MAYJVUf0QYtQDrX2wnT_-eiiWjD5XafLuXEQVDRh-v2MKAwdvtXMq5cZ08Zjl2SyHxJ3OqhEeWPvYGltxZh_A',
-      :RS512 => 'EHeGM2Mo3ghhUfSB99AlREehrbC6OPE-nYL_rwf88ysTnJ8L1QQ0UuCrXq4SpRutGLK_bYTK3ZALvFRPoOgK_g0QWmqv6qjQRU_QTxoq8y8APP-IgKKDuIiGH6daBV2rAPLDReqYNKsKjmTvZJo2c0a0e_WZkkj_ZwpgjTG3v0gW9lbDAzLJDz18eqtR4ZO7JTu_fyNrUrNk-w2_wpxSsn9sygIMp0lKE0_pt0b01fz3gjTDjlltU0cKSalUp4geaBDH7QRcexrolIctdQFbNKTXQxoigxD3NLNkKGH7f6A8KZdcOm8AnEjullcZs8_OWGnW43p1qrxoBRSivb9pqQ',
-      :ES256 => :TODO,
-      :ES384 => :TODO,
-      :ES512 => :TODO
+      :RS512 => 'EHeGM2Mo3ghhUfSB99AlREehrbC6OPE-nYL_rwf88ysTnJ8L1QQ0UuCrXq4SpRutGLK_bYTK3ZALvFRPoOgK_g0QWmqv6qjQRU_QTxoq8y8APP-IgKKDuIiGH6daBV2rAPLDReqYNKsKjmTvZJo2c0a0e_WZkkj_ZwpgjTG3v0gW9lbDAzLJDz18eqtR4ZO7JTu_fyNrUrNk-w2_wpxSsn9sygIMp0lKE0_pt0b01fz3gjTDjlltU0cKSalUp4geaBDH7QRcexrolIctdQFbNKTXQxoigxD3NLNkKGH7f6A8KZdcOm8AnEjullcZs8_OWGnW43p1qrxoBRSivb9pqQ'
     }
   }
 
@@ -68,16 +65,18 @@ describe JSON::JWS do
       end
     end
 
-    [:ES256, :ES384, :ES512].each do |algorithm|
-      describe algorithm do
-        let(:alg) { algorithm }
-        it :TODO
+    describe 'unknown algorithm' do
+      let(:alg) { :unknown }
+      it do
+        expect do
+          jws.sign! 'key'
+        end.to raise_error JSON::JWS::InvalidFormat
       end
     end
   end
 
   describe '#verify' do
-    shared_examples_for :succes_signature_verification do
+    shared_examples_for :success_signature_verification do
       it do
         expect { decoded }.not_to raise_error
         decoded.should be_a JSON::JWT
@@ -106,7 +105,7 @@ describe JSON::JWS do
         let(:private_key_or_secret) { shared_secret }
         let(:public_key_or_secret) { shared_secret }
         let(:alg) { algorithm }
-        it_behaves_like :succes_signature_verification
+        it_behaves_like :success_signature_verification
       end
     end
 
@@ -115,14 +114,25 @@ describe JSON::JWS do
         let(:private_key_or_secret) { private_key }
         let(:public_key_or_secret) { public_key }
         let(:alg) { algorithm }
-        it_behaves_like :succes_signature_verification
+        it_behaves_like :success_signature_verification
       end
     end
 
     [:ES256, :ES384, :ES512].each do |algorithm|
       describe algorithm do
+        let(:private_key_or_secret) { private_key(:ecdsa, :digest_length => algorithm.to_s[2,3].to_i) }
+        let(:public_key_or_secret) { public_key(:ecdsa, :digest_length => algorithm.to_s[2,3].to_i) }
         let(:alg) { algorithm }
-        it :TODO
+        it_behaves_like :success_signature_verification
+      end
+    end
+
+    describe 'unknown algorithm' do
+      let(:alg) { :unknown }
+      it do
+        expect do
+          jws.verify 'signature_base_string', 'signature', 'key'
+        end.to raise_error JSON::JWS::InvalidFormat
       end
     end
   end

data/spec/json/jwt_spec.rb

@@ -81,5 +81,13 @@ describe JSON::JWT do
         end
       end
     end
+
+    context 'when JSON parse failed' do
+      it do
+        expect do
+          JSON::JWT.decode('header.payload.signature')
+        end.to raise_error JSON::JWT::InvalidFormat
+      end
+    end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: json-jwt
 version: !ruby/object:Gem::Version
-  version: 0.1.5
+  version: 0.1.6
   prerelease: 
 platform: ruby
 authors:
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2012-07-20 00:00:00.000000000 Z
+date: 2012-07-25 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: json
@@ -146,6 +146,12 @@ files:
 - lib/json/jwk/set.rb
 - lib/json/jws.rb
 - lib/json/jwt.rb
+- spec/fixtures/ecdsa/256/private_key.pem
+- spec/fixtures/ecdsa/256/public_key.pem
+- spec/fixtures/ecdsa/384/private_key.pem
+- spec/fixtures/ecdsa/384/public_key.pem
+- spec/fixtures/ecdsa/512/private_key.pem
+- spec/fixtures/ecdsa/512/public_key.pem
 - spec/fixtures/rsa/private_key.pem
 - spec/fixtures/rsa/public_key.pem
 - spec/helpers/sign_key_fixture_helper.rb
@@ -180,6 +186,12 @@ specification_version: 3
 summary: JSON Web Token and its family (JSON Web Signature, JSON Web Encryption and
   JSON Web Key) in Ruby
 test_files:
+- spec/fixtures/ecdsa/256/private_key.pem
+- spec/fixtures/ecdsa/256/public_key.pem
+- spec/fixtures/ecdsa/384/private_key.pem
+- spec/fixtures/ecdsa/384/public_key.pem
+- spec/fixtures/ecdsa/512/private_key.pem
+- spec/fixtures/ecdsa/512/public_key.pem
 - spec/fixtures/rsa/private_key.pem
 - spec/fixtures/rsa/public_key.pem
 - spec/helpers/sign_key_fixture_helper.rb