json-jwt 0.4.3 → 0.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 7ceb3e0a69a5e8f2438b047292633deeaed004fc
-  data.tar.gz: 4ced84fac0f2abcbae8316681396d155bbb77c94
+  metadata.gz: 7fc22bebad1c3924998f637b07f91089ba1d365f
+  data.tar.gz: 8f969eba9420ffccaeb0053096e039c02fbcfb89
 SHA512:
-  metadata.gz: afa51d9f7ee2598ead577a749cfb68eabf40d2cf8a1b1af57bde198cf86685849a734923e1ee42062709bb8721cf2e3ad24b8c14c5b3d1f6e22f34250d94356e
-  data.tar.gz: e6203a40b7cae834abd3293a377dba377331e15d7fbe69ac87f4a151f96730011b46fbfe5e95986e19cf96f4a7c94b2a484fac647d782fe7f5a1b257d13173fc
+  metadata.gz: a32887bed2783fb91c98776c70e6a471a6640f59b336b56d4a5576019ab79cdbdbb25bcf149bf26d4710006f03a0699c4dae0137ab61d3895ded29dbd38cdfa2
+  data.tar.gz: 44ee98be92413ef444c90d93529566802a0725a182e55517d5ecea8e8b7b66b5d3386e3dccf7d3b67e728c038ca336f42a2bcf3837ffd2c5c20a2f73b5f0bcfc

data/.gitignore

@@ -19,3 +19,4 @@ rdoc
 pkg
 
 ## PROJECT::SPECIFIC
+.class

data/.gitmodules

@@ -0,0 +1,3 @@
+[submodule "spec/helpers/json-jwt-nimbus"]
+	path = spec/helpers/json-jwt-nimbus
+	url = git://github.com/nov/json-jwt-nimbus.git

data/.travis.yml

@@ -1,3 +1,7 @@
 rvm:
   - 1.9.2
   - 1.9.3
+  - 2.0.0
+
+before_install:
+  - git submodule update --init --recursive

data/Gemfile.lock

@@ -0,0 +1,44 @@
+PATH
+  remote: .
+  specs:
+    json-jwt (0.4.3)
+      activesupport (>= 2.3)
+      i18n
+      multi_json (>= 1.3)
+      url_safe_base64
+
+GEM
+  remote: http://rubygems.org/
+  specs:
+    activesupport (3.2.12)
+      i18n (~> 0.6)
+      multi_json (~> 1.0)
+    configatron (2.10.0)
+      yamler (>= 0.1.0)
+    cover_me (1.2.0)
+      configatron
+      hashie
+    diff-lcs (1.2.1)
+    hashie (2.0.2)
+    i18n (0.6.4)
+    multi_json (1.6.1)
+    rake (10.0.3)
+    rspec (2.13.0)
+      rspec-core (~> 2.13.0)
+      rspec-expectations (~> 2.13.0)
+      rspec-mocks (~> 2.13.0)
+    rspec-core (2.13.0)
+    rspec-expectations (2.13.0)
+      diff-lcs (>= 1.1.3, < 2.0)
+    rspec-mocks (2.13.0)
+    url_safe_base64 (0.2.1)
+    yamler (0.1.0)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  cover_me (>= 1.2.0)
+  json-jwt!
+  rake (>= 0.8)
+  rspec (>= 2)

data/README.rdoc

@@ -2,6 +2,8 @@
 
 JSON Web Token and its family (JSON Web Signature, JSON Web Encryption and JSON Web Key) in Ruby
 
+{<img src="https://secure.travis-ci.org/nov/json-jwt.png" />}[http://travis-ci.org/nov/json-jwt]
+
 == Installation
 
   gem install json-jwt
@@ -24,15 +26,19 @@ JSON Web Token and its family (JSON Web Signature, JSON Web Encryption and JSON
   }
 
   # No signature, no encryption
-  JSON::JWT.new(claim).to_s
+  jwt = JSON::JWT.new(claim).to_s
 
   # With signiture, no encryption
-  JSON::JWT.new(claim).sign(key, algorithm).to_s
+  jws = JSON::JWT.new(claim).sign(key, algorithm) # algorithm is optional. default HS256
+  jws.to_s # => header.payload.signature
 
   # With signature & encryption
-  JSON::JWT.new(claim).sign(key, algorithm).encrypt(key, algorithm).to_s
+  jwe = jws.encrypt(key, algorithm, encryption_method) # algorithm & encryption_method are optional. default RSA1_5 & A128CBC+HS256
+  jws.to_s # => header.master_key.iv.cipher_text.integrity_value
 
-For details about <code>key</code> and <code>algorithm</code>, see {JWS Spec}[https://github.com/nov/json-jwt/blob/master/spec/json/jws_spec.rb] and {Sign Key Fixture Generator}[https://github.com/nov/json-jwt/blob/master/spec/helpers/sign_key_fixture_helper.rb].
+For details about <code>key</code> and <code>algorithm</code>, see
+{JWS Spec}[https://github.com/nov/json-jwt/blob/master/spec/json/jws_spec.rb] and
+{Sign Key Fixture Generator}[https://github.com/nov/json-jwt/blob/master/spec/helpers/sign_key_fixture_helper.rb].
 
 === Decoding
 
@@ -41,7 +47,7 @@ For details about <code>key</code> and <code>algorithm</code>, see {JWS Spec}[ht
   JSON::JWT.decode(jwt_string, key)
 
 == Note on Patches/Pull Requests
- 
+
 * Fork the project.
 * Make your feature addition or bug fix.
 * Add tests for it. This is important so I don't break it in a

data/VERSION

@@ -1 +1 @@
-0.4.3
+0.5.0

data/json-jwt.gemspec

@@ -14,6 +14,7 @@ Gem::Specification.new do |s|
   s.add_runtime_dependency "url_safe_base64"
   s.add_runtime_dependency "activesupport", ">= 2.3"
   s.add_runtime_dependency "i18n"
+  s.add_runtime_dependency "bindata"
   s.add_development_dependency "rake", ">= 0.8"
   s.add_development_dependency "cover_me", ">= 1.2.0"
   s.add_development_dependency "rspec", ">= 2"

data/lib/json/jwe.rb

@@ -1,5 +1,208 @@
+require 'securerandom'
+require 'bindata'
+
 module JSON
   class JWE < JWT
-    # TODO
+    class InvalidFormat < JWT::InvalidFormat; end
+    class DecryptionFailed < JWT::VerificationFailed; end
+    class UnexpectedAlgorithm < JWT::UnexpectedAlgorithm; end
+
+    attr_accessor :public_key_or_secret, :plain_text, :master_key, :encrypted_master_key, :encryption_key, :integrity_key, :integrity_value, :iv, :cipher_text
+
+    register_header_keys :enc, :epk, :zip, :jku, :jwk, :x5u, :x5t, :x5c, :kid, :typ, :cty, :apu, :apv, :epu, :epv
+    alias_method :encryption_method, :enc
+
+    def initialize(jwt_or_plain_text)
+      self.plain_text = jwt_or_plain_text.to_s
+    end
+
+    def encrypt!(public_key_or_secret)
+      self.public_key_or_secret = public_key_or_secret
+      cipher.encrypt
+      generate_cipher_keys!
+      self.cipher_text = cipher.update(plain_text) + cipher.final
+      self
+    end
+
+    def decrypt!
+      raise NotImplementedError.new('JWE decryption not supported yet')
+    end
+
+    def to_s
+      [
+        header.to_json,
+        encrypted_master_key,
+        iv,
+        cipher_text,
+        integrity_value
+      ].collect do |segment|
+        UrlSafeBase64.encode64 segment.to_s
+      end.join('.')
+    end
+
+    private
+
+    def gcm_supported?
+      RUBY_VERSION >= '2.0.0' && OpenSSL::OPENSSL_VERSION >= 'OpenSSL 1.0.1c'
+    end
+
+    def gcm?
+      [:A128GCM, :A256GCM].collect(&:to_s).include? encryption_method.to_s
+    end
+
+    def cbc?
+      [:'A128CBC+HS256', :'A256CBC+HS512'].collect(&:to_s).include? encryption_method.to_s
+    end
+
+    def dir?
+      :dir.to_s == algorithm.to_s
+    end
+
+    def cipher
+      @cipher ||= if gcm? && !gcm_supported?
+        raise UnexpectedAlgorithm.new('AEC GCM requires Ruby 2.0+ and OpenSSL 1.0.1c+') if gcm? && !gcm_supported?
+      else
+        OpenSSL::Cipher.new cipher_name
+      end
+    end
+
+    def cipher_name
+      case encryption_method.to_s
+      when :A128GCM.to_s
+        'aes-128-gcm'
+      when :A256GCM.to_s
+        'aes-256-gcm'
+      when :'A128CBC+HS256'.to_s
+        'aes-128-cbc'
+      when :'A256CBC+HS512'.to_s
+        'aes-256-cbc'
+      else
+        raise UnexpectedAlgorithm.new('Unknown Encryption Algorithm')
+      end
+    end
+
+    def sha_size
+      case encryption_method.to_s
+      when :'A128CBC+HS256'.to_s
+        256
+      when :'A256CBC+HS512'.to_s
+        512
+      else
+        raise UnexpectedAlgorithm.new('Unknown Hash Size')
+      end
+    end
+
+    def sha_digest
+      OpenSSL::Digest::Digest.new "SHA#{sha_size}"
+    end
+
+    def encrypted_master_key
+      @encrypted_master_key ||= case algorithm.to_s
+      when :RSA1_5.to_s
+        public_key_or_secret.public_encrypt master_key
+      when :'RSA-OAEP'.to_s
+        public_key_or_secret.public_encrypt master_key, OpenSSL::PKey::RSA::PKCS1_OAEP_PADDING
+      when :A128KW .to_s
+        raise NotImplementedError.new('A128KW not supported yet')
+      when :A256KW.to_s
+        raise NotImplementedError.new('A256KW not supported yet')
+      when :dir.to_s
+        ''
+      when :'ECDH-ES'.to_s
+        raise NotImplementedError.new('ECDH-ES not supported yet')
+      when :'ECDH-ES+A128KW'.to_s
+        raise NotImplementedError.new('ECDH-ES+A128KW not supported yet')
+      when :'ECDH-ES+A256KW'.to_s
+        raise NotImplementedError.new('ECDH-ES+A256KW not supported yet')
+      else
+        raise UnexpectedAlgorithm.new('Unknown Encryption Algorithm')
+      end
+    end
+
+    def generate_cipher_keys!
+      case
+      when gcm?
+        generate_gcm_keys!
+      when cbc?
+        generate_cbc_keys!
+      end
+      @cipher.key = encryption_key
+      self.iv = @cipher.random_iv
+      if gcm?
+        cipher.auth_data = [header.to_json, encrypted_master_key, iv].collect do |segment|
+          UrlSafeBase64.encode64 segment.to_s
+        end.join('.')
+      end
+      self
+    end
+
+    def generate_gcm_keys!
+      self.master_key ||= if dir?
+        public_key_or_secret
+      else
+        @cipher.random_key
+      end
+      self.encryption_key = master_key
+      self.integrity_key = :wont_be_used
+      self
+    end
+
+    def generate_cbc_keys!
+      encryption_key_size = sha_size / 2
+      integrity_key_size = master_key_size = sha_size
+      self.master_key ||= if dir?
+        public_key_or_secret
+      else
+        SecureRandom.random_bytes master_key_size / 8
+      end
+      encryption_segments = [
+        1,
+        master_key,
+        encryption_key_size,
+        encryption_method,
+        epu || 0,
+        epv || 0,
+        'Encryption'
+      ]
+      integrity_segments = [
+        1,
+        master_key,
+        integrity_key_size,
+        encryption_method,
+        epu || 0,
+        epv || 0,
+        'Integrity'
+      ]
+      encryption_hash_input, integrity_hash_input = [encryption_segments, integrity_segments].collect do |segments|
+        segments.collect do |segment|
+          case segment
+          when Integer
+            BinData::Int32be.new(segment).to_binary_s
+          else
+            segment.to_s
+          end
+        end.join
+      end
+      self.encryption_key = sha_digest.digest(encryption_hash_input)[0, encryption_key_size / 8]
+      self.integrity_key = sha_digest.digest integrity_hash_input
+      self
+    end
+
+    def integrity_value
+      @integrity_value ||= if gcm?
+        cipher.auth_tag
+      else
+        secured_input = [
+          header.to_json,
+          encrypted_master_key,
+          iv,
+          cipher_text
+        ].collect do |segment|
+          UrlSafeBase64.encode64 segment.to_s
+        end.join('.')
+        OpenSSL::HMAC.digest sha_digest, integrity_key, secured_input
+      end
+      @integrity_value
+    end
   end
-end
+end

data/lib/json/jwk.rb

@@ -40,13 +40,13 @@ module JSON
       hash = case public_key
       when OpenSSL::PKey::RSA
         {
-          :alg => :RSA,
+          :kty => :RSA,
           :e   => UrlSafeBase64.encode64(public_key.e.to_s(2)),
           :n   => UrlSafeBase64.encode64(public_key.n.to_s(2)),
         }
       when OpenSSL::PKey::EC
         {
-          :alg => :EC,
+          :kty => :EC,
           :crv => ecdsa_curve_name(public_key),
           :x   => UrlSafeBase64.encode64(ecdsa_coodinates(public_key)[:x].to_s),
           :y   => UrlSafeBase64.encode64(ecdsa_coodinates(public_key)[:y].to_s),
@@ -59,7 +59,7 @@ module JSON
 
     class << self
       def decode(jwk)
-        case jwk[:alg].to_s
+        case jwk[:kty].to_s
         when 'RSA'
           e = OpenSSL::BN.new UrlSafeBase64.decode64(jwk[:e]), 2
           n = OpenSSL::BN.new UrlSafeBase64.decode64(jwk[:n]), 2

data/lib/json/jws.rb

@@ -2,6 +2,9 @@ module JSON
   class JWS < JWT
     class InvalidFormat < JWT::InvalidFormat; end
     class VerificationFailed < JWT::VerificationFailed; end
+    class UnexpectedAlgorithm < JWT::UnexpectedAlgorithm; end
+
+    register_header_keys :jku, :kid, :x5u, :x5t
 
     def initialize(jwt)
       replace jwt
@@ -20,10 +23,6 @@ module JSON
 
     private
 
-    def algorithm
-      header[:alg]
-    end
-
     def digest
       OpenSSL::Digest::Digest.new "SHA#{algorithm.to_s[2, 3]}"
     end
@@ -62,7 +61,7 @@ module JSON
         verify_ecdsa_group! private_key
         private_key.dsa_sign_asn1 digest.digest(signature_base_string)
       else
-        raise InvalidFormat.new('Unknown Signature Algorithm')
+        raise UnexpectedAlgorithm.new('Unknown Signature Algorithm')
       end
     end
 
@@ -79,20 +78,20 @@ module JSON
         verify_ecdsa_group! public_key
         public_key.dsa_verify_asn1 digest.digest(signature_base_string), signature
       else
-        raise InvalidFormat.new('Unknown Signature Algorithm')
+        raise UnexpectedAlgorithm.new('Unknown Signature Algorithm')
       end
     end
 
     def verify_ecdsa_group!(key)
       group_name = case digest.digest_length * 8
       when 256
-        'secp256k1'
+        :secp256k1
       when 384
-        'secp384r1'
+        :secp384r1
       when 512
-        'secp521r1'
+        :secp521r1
       end
-      key.group = OpenSSL::PKey::EC::Group.new group_name
+      key.group = OpenSSL::PKey::EC::Group.new group_name.to_s
       key.check_key
     end
 

data/lib/json/jwt.rb

@@ -12,11 +12,28 @@ module JSON
     class VerificationFailed < Exception; end
     class UnexpectedAlgorithm < VerificationFailed; end
 
+    def header
+      @header ||= {}
+    end
+
+    class << self
+      def register_header_keys(*keys)
+        keys.each do |header_key|
+          define_method header_key do
+            self.header[header_key]
+          end
+          define_method "#{header_key}=" do |value|
+            self.header[header_key] = value
+          end
+        end
+      end
+    end
+    register_header_keys :typ, :cty, :alg
+    alias_method :algorithm, :alg
+
     def initialize(claims)
-      @header = {
-        :typ => :JWT,
-        :alg => :none
-      }
+      self.typ = :JWT
+      self.alg = :none
       [:exp, :nbf, :iat].each do |key|
         claims[key] = claims[key].to_i if claims[key]
       end
@@ -24,12 +41,13 @@ module JSON
     end
 
     def sign(private_key_or_secret, algorithm = :HS256)
-      header[:alg] = algorithm
-      JWS.new(self).sign!(private_key_or_secret)
+      jws = JWS.new(self)
+      jws.alg = algorithm
+      jws.sign! private_key_or_secret
     end
 
     def verify(signature_base_string, public_key_or_secret = nil)
-      if header[:alg].to_s == 'none'
+      if alg.to_s == 'none'
         raise UnexpectedAlgorithm if public_key_or_secret
         signature == '' or raise VerificationFailed
       else
@@ -37,6 +55,13 @@ module JSON
       end
     end
 
+    def encrypt(public_key_or_secret, algorithm = :RSA1_5, encryption_method = :'A128CBC+HS256')
+      jwe = JWE.new(self)
+      jwe.alg = algorithm
+      jwe.enc = encryption_method
+      jwe.encrypt! public_key_or_secret
+    end
+
     def to_s
       [
         header.to_json,
@@ -67,10 +92,12 @@ module JSON
           #  So we need to use raw base64 strings for signature verification.
           jwt.verify signature_base_string, key_or_secret unless key_or_secret == :skip_verification
           jwt
-        when 3 # JWE
-          # TODO: Concept code first.
-          #  jwt = JWE.decrypt ...
-          #  jwt.verify ...
+        when 4 # JWE
+          jwe = JWE.new jwt_string
+          jwe.header = MultiJson.load(
+            jwt_string.split('.').first
+          ).with_indifferent_access
+          jwe.decrypt! key_or_secret
         else
           raise InvalidFormat.new('Invalid JWT Format. JWT should include 2 or 3 dots.')
         end

data/spec/helpers/nimbus_spec_helper.rb

@@ -0,0 +1,21 @@
+module NimbusSpecHelper
+  module_function
+
+  def setup
+    nimbus_path = File.expand_path(
+      File.join(
+        File.dirname(__FILE__),
+        'json-jwt-nimbus'
+      )
+    )
+    if File.exist? nimbus_path
+      require File.join(nimbus_path, 'nimbus_jwe')
+    end
+  end
+
+  def nimbus_available?
+    defined? NimbusJWE
+  end
+end
+
+NimbusSpecHelper.setup

data/spec/helpers/sign_key_fixture_helper.rb

@@ -4,11 +4,20 @@ module SignKeyFixtureHelper
   end
 
   def pem_file(file_name)
-    File.new(
-      File.join(
-        File.dirname(__FILE__),
-        "../fixtures/#{file_name}.pem"
-      )
+    File.new pem_file_path(file_name)
+  end
+
+  def pem_file_path(file_name)
+    File.join(
+      File.dirname(__FILE__),
+      "../fixtures/#{file_name}.pem"
+    )
+  end
+
+  def der_file_path(file_name)
+    File.join(
+      File.dirname(__FILE__),
+      "../fixtures/#{file_name}.der"
     )
   end
 

data/spec/json/jwe_spec.rb

@@ -0,0 +1,157 @@
+require 'spec_helper'
+
+def gcm_supported?
+  RUBY_VERSION >= '2.0.0' && OpenSSL::OPENSSL_VERSION >= 'OpenSSL 1.0.1c'
+end
+
+describe JSON::JWE do
+  let(:shared_key) { SecureRandom.hex 16 } # default shared key is too short
+  let(:private_key_path) { der_file_path 'rsa/private_key' }
+
+  describe 'encrypt!' do
+    shared_examples_for :gcm_encryption do
+      context 'when enc=A128GCM' do
+        before { jwe.enc = :A128GCM }
+
+        it 'should decryptable by Nimbus JOSE JWT' do
+          jwe.encrypt! key
+          NimbusJWE.decrypt(jwe, private_key_path).should == plain_text
+        end
+      end
+
+      context 'when enc=A256GCM' do
+        before { jwe.enc = :A256GCM }
+
+        it 'should decryptable by Nimbus JOSE JWT' do
+          jwe.encrypt! key
+          NimbusJWE.decrypt(jwe, private_key_path).should == plain_text
+        end
+      end
+    end
+
+    shared_examples_for :gcm_encryption_unsupported do
+      context 'when enc=A128GCM' do
+        before { jwe.enc = :A128GCM }
+
+        it do
+          expect do
+            jwe.encrypt! key
+          end.to raise_error JSON::JWE::UnexpectedAlgorithm
+        end
+      end
+
+      context 'when enc=A256GCM' do
+        before { jwe.enc = :A256GCM }
+
+        it do
+          expect do
+            jwe.encrypt! key
+          end.to raise_error JSON::JWE::UnexpectedAlgorithm
+        end
+      end
+    end
+
+    shared_examples_for :cbc_encryption do
+      context 'when enc=A128CBC+HS256' do
+        before { jwe.enc = :'A128CBC+HS256' }
+
+        it 'should decryptable by Nimbus JOSE JWT' do
+          jwe.encrypt! key
+          NimbusJWE.decrypt(jwe, private_key_path).should == plain_text
+        end
+      end
+
+      context 'when enc=A256CBC+HS512' do
+        before { jwe.enc = :'A256CBC+HS512' }
+
+        it 'should decryptable by Nimbus JOSE JWT' do
+          jwe.encrypt! key
+          NimbusJWE.decrypt(jwe, private_key_path).should == plain_text
+        end
+      end
+    end
+
+    context 'when plaintext given' do
+      let(:plain_text) { 'Hello World' }
+      let(:jwe) { JSON::JWE.new plain_text }
+
+      context 'when alg=RSA1_5' do
+        if NimbusSpecHelper.nimbus_available?
+          let(:key) { public_key }
+          before { jwe.alg = :'RSA1_5' }
+
+          if gcm_supported?
+            it_behaves_like :gcm_encryption
+          else
+            it_behaves_like :gcm_encryption_unsupported
+          end
+          it_behaves_like :cbc_encryption
+        else
+          it :TODO
+        end
+      end
+
+      context 'when alg=RSA-OAEP' do
+        if NimbusSpecHelper.nimbus_available?
+          let(:key) { public_key }
+          before { jwe.alg = :'RSA-OAEP' }
+
+          if gcm_supported?
+            it_behaves_like :gcm_encryption
+          else
+            it_behaves_like :gcm_encryption_unsupported
+          end
+          it_behaves_like :cbc_encryption
+        else
+          it :TODO
+        end
+      end
+
+      context 'when alg=dir' do
+        it :TODO
+      end
+    end
+
+    context 'when jwt given' do
+      let(:plain_text) { jwt.to_s }
+      let(:jwt) { JSON::JWT.new(foo: :bar) }
+      let(:jwe) { JSON::JWE.new jwt }
+
+      context 'when alg=RSA-OAEP' do
+        if NimbusSpecHelper.nimbus_available?
+          let(:key) { public_key }
+          before { jwe.alg = :'RSA1_5' }
+
+          if gcm_supported?
+            it_behaves_like :gcm_encryption
+          else
+            it_behaves_like :gcm_encryption_unsupported
+          end
+          it_behaves_like :cbc_encryption
+        else
+          it :TODO
+        end
+      end
+
+      context 'when alg=RSA-OAEP' do
+        if NimbusSpecHelper.nimbus_available?
+          let(:key) { public_key }
+          before { jwe.alg = :'RSA-OAEP' }
+
+          if gcm_supported?
+            it_behaves_like :gcm_encryption
+          else
+            it_behaves_like :gcm_encryption_unsupported
+          end
+          it_behaves_like :cbc_encryption
+        else
+          it :TODO
+        end
+      end
+
+      context 'when alg=dir' do
+        it :TODO
+      end
+    end
+  end
+end

data/spec/json/jwk_spec.rb

@@ -3,8 +3,8 @@ require 'spec_helper'
 describe JSON::JWK do
   context 'when RSA public key given' do
     let(:jwk) { JSON::JWK.new public_key }
-    it { jwk.keys.should include :alg, :e, :n }
-    its(:alg) { jwk[:alg].should == :RSA }
+    it { jwk.keys.should include :kty, :e, :n }
+    its(:kty) { jwk[:kty].should == :RSA }
     its(:e) { jwk[:e].should == UrlSafeBase64.encode64(public_key.e.to_s(2)) }
     its(:n) { jwk[:n].should == UrlSafeBase64.encode64(public_key.n.to_s(2)) }
 
@@ -36,8 +36,8 @@ describe JSON::JWK do
     [256, 384, 512].each do |digest_length|
       describe "EC#{digest_length}" do
         let(:jwk) { JSON::JWK.new public_key(:ecdsa, digest_length: digest_length) }
-        it { jwk.keys.should include :alg, :crv, :x, :y }
-        its(:alg) { jwk[:alg].should == :EC }
+        it { jwk.keys.should include :kty, :crv, :x, :y }
+        its(:kty) { jwk[:kty].should == :EC }
         its(:x) { jwk[:x].should == expected_coodinates[digest_length][:x] }
         its(:y) { jwk[:y].should == expected_coodinates[digest_length][:y] }
       end
@@ -66,7 +66,7 @@ describe JSON::JWK do
     context 'when RSA' do
       subject do
         JSON::JWK.decode(
-          alg: :RSA,
+          kty: :RSA,
           n: n,
           e: e
         )
@@ -108,7 +108,7 @@ NrqoxoakrPo1NI1u+ET8oWGmnjB/nJFAPwIDAQAB
       it do
         expect do
           JSON::JWK.decode(
-            alg: :EC,
+            kty: :EC,
             crv: 'crv',
             x: 'x',
             y: 'y'
@@ -121,7 +121,7 @@ NrqoxoakrPo1NI1u+ET8oWGmnjB/nJFAPwIDAQAB
       it do
         expect do
           JSON::JWK.decode(
-            alg: :XXX
+            kty: :XXX
           )
         end.to raise_error JSON::JWK::UnknownAlgorithm
       end

data/spec/json/jws_spec.rb

@@ -4,7 +4,7 @@ describe JSON::JWS do
   let(:alg) { :none }
   let(:jwt) do
     _jwt_ = JSON::JWT.new claims
-    _jwt_.header[:alg] = alg
+    _jwt_.alg = alg
     _jwt_
   end
   let(:jws) { JSON::JWS.new jwt }
@@ -70,7 +70,7 @@ describe JSON::JWS do
       it do
         expect do
           jws.sign! 'key'
-        end.to raise_error JSON::JWS::InvalidFormat
+        end.to raise_error JSON::JWS::UnexpectedAlgorithm
       end
     end
   end
@@ -132,7 +132,7 @@ describe JSON::JWS do
       it do
         expect do
           jws.verify jws.send(:signature_base_string), 'key'
-        end.to raise_error JSON::JWS::InvalidFormat
+        end.to raise_error JSON::JWS::UnexpectedAlgorithm
       end
     end
   end

data/spec/json/jwt_spec.rb

@@ -3,7 +3,7 @@ require 'spec_helper'
 describe JSON::JWT do
   let(:jwt) { JSON::JWT.new claims }
   let(:jws) do
-    jwt.header[:alg] = :HS256
+    jwt.alg = :HS256
     jws = JSON::JWS.new jwt
     jws.signature = 'signature'
     jws
@@ -93,6 +93,26 @@ describe JSON::JWT do
     end
   end
 
+  describe '#encrypt' do
+    let(:shared_key) { SecureRandom.hex 16 } # default shared key is too short
+
+    it 'should encryptable without signing' do
+      jwt.encrypt(public_key).should be_a JSON::JWE
+    end
+
+    it 'should encryptable after signed' do
+      jwt.sign(shared_key).encrypt(public_key).should be_a JSON::JWE
+    end
+
+    it 'should accept optional algorithm' do
+      jwt.encrypt(shared_key, :dir).should be_a JSON::JWE
+    end
+
+    it 'should accept optional algorithm and encryption method' do
+      jwt.encrypt(shared_key, :dir, :'A256CBC+HS512').should be_a JSON::JWE
+    end
+  end
+
   describe '.decode' do
     context 'when not signed nor encrypted' do
       context 'no signature given' do

data/spec/spec_helper.rb

@@ -2,4 +2,5 @@ require 'cover_me'
 require 'rspec'
 require 'json/jwt'
 
-require 'helpers/sign_key_fixture_helper'
+require 'helpers/sign_key_fixture_helper'
+require 'helpers/nimbus_spec_helper'

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: json-jwt
 version: !ruby/object:Gem::Version
-  version: 0.4.3
+  version: 0.5.0
 platform: ruby
 authors:
 - nov matake
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2013-03-03 00:00:00.000000000 Z
+date: 2013-04-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: multi_json
@@ -66,6 +66,20 @@ dependencies:
     - - '>='
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: bindata
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - '>='
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
@@ -117,9 +131,11 @@ extensions: []
 extra_rdoc_files: []
 files:
 - .gitignore
+- .gitmodules
 - .rspec
 - .travis.yml
 - Gemfile
+- Gemfile.lock
 - LICENSE
 - README.rdoc
 - Rakefile
@@ -136,9 +152,12 @@ files:
 - spec/fixtures/ecdsa/384/public_key.pem
 - spec/fixtures/ecdsa/512/private_key.pem
 - spec/fixtures/ecdsa/512/public_key.pem
+- spec/fixtures/rsa/private_key.der
 - spec/fixtures/rsa/private_key.pem
 - spec/fixtures/rsa/public_key.pem
+- spec/helpers/nimbus_spec_helper.rb
 - spec/helpers/sign_key_fixture_helper.rb
+- spec/json/jwe_spec.rb
 - spec/json/jwk/set_spec.rb
 - spec/json/jwk_spec.rb
 - spec/json/jws_spec.rb
@@ -175,11 +194,15 @@ test_files:
 - spec/fixtures/ecdsa/384/public_key.pem
 - spec/fixtures/ecdsa/512/private_key.pem
 - spec/fixtures/ecdsa/512/public_key.pem
+- spec/fixtures/rsa/private_key.der
 - spec/fixtures/rsa/private_key.pem
 - spec/fixtures/rsa/public_key.pem
+- spec/helpers/nimbus_spec_helper.rb
 - spec/helpers/sign_key_fixture_helper.rb
+- spec/json/jwe_spec.rb
 - spec/json/jwk/set_spec.rb
 - spec/json/jwk_spec.rb
 - spec/json/jws_spec.rb
 - spec/json/jwt_spec.rb
 - spec/spec_helper.rb
+has_rdoc: