json-jwt 0.6.0 → 0.6.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 9ed6b68461d916fd8be52e755b8bb2c77253149d
-  data.tar.gz: 8f0b99b938171b21ab88d259471ec72622c979bb
+  metadata.gz: cfafaeda298c56aa5cd5f1056f33b31ed7b31bb8
+  data.tar.gz: fe6fd7d8d776f0b197add6a79f2b11a03afc9af7
 SHA512:
-  metadata.gz: 07c51fe7a0b6b66ce4e4504f36baf1698c76537fa8f38513d2cc3fc67dd33208c88b64b8fbe8d0c6feafbf457d10e1ccdf2f3f2adc148035577ed3d5c37cedfb
-  data.tar.gz: 44ae1afcca4d398d46fedacfa69e3403d484f77011af870b7e77f38496a4b1177d3b8fad54a014b49a980dc0f871135b3eed27354cc3035e3cba80b1d36d7d22
+  metadata.gz: f0ead0b472adcf5fab5203765d2b83ea4afeb131510d4765b0f884867de2affeac688d72c8bbc64626498680e0b6c55a1f351d9fcd07fde418342be7ef9ab92c
+  data.tar.gz: adca33ab7ec94e4a92a70585cf3c3e441f2f22c56701071adc79f1d5ecd6a0bc28fbb9cbb13ce74b9869c8dfe274c3da1d65b49621e5fbe1ce944e1c6204caab

data/README.rdoc

@@ -34,7 +34,7 @@ JSON Web Token and its family (JSON Web Signature, JSON Web Encryption and JSON
 
   # With signature & encryption
   jwe = jws.encrypt(key, algorithm, encryption_method) # algorithm & encryption_method are optional. default RSA1_5 & A128CBC-HS256
-  jws.to_s # => header.master_key.iv.cipher_text.integrity_value
+  jws.to_s # => header.encrypted_key.iv.cipher_text.authentication_tag
 
 For details about <code>key</code> and <code>algorithm</code>, see
 {JWS Spec}[https://github.com/nov/json-jwt/blob/master/spec/json/jws_spec.rb] and

data/Rakefile

@@ -4,15 +4,16 @@ Bundler::GemHelper.install_tasks
 require 'rspec/core/rake_task'
 RSpec::Core::RakeTask.new(:spec)
 
-namespace :cover_me do
-  desc "Generates and opens code coverage report."
+namespace :coverage do
+  desc "Open coverage report"
   task :report do
-    require 'cover_me'
-    CoverMe.complete!
+    require 'simplecov'
+    `open "#{File.join SimpleCov.coverage_path, 'index.html'}"`
   end
 end
+
 task :spec do
-  Rake::Task['cover_me:report'].invoke unless ENV['TRAVIS_RUBY_VERSION']
+  Rake::Task[:'coverage:report'].invoke unless ENV['TRAVIS_RUBY_VERSION']
 end
 
-task default: :spec
+task :default => :spec

data/VERSION

@@ -1 +1 @@
-0.6.0
+0.6.1

data/json-jwt.gemspec

@@ -1,20 +1,22 @@
-Gem::Specification.new do |s|
-  s.name        = "json-jwt"
-  s.version     = File.read("VERSION")
-  s.authors     = ["nov matake"]
-  s.email       = ["nov@matake.jp"]
-  s.homepage    = "https://github.com/nov/json-jwt"
-  s.summary     = %q{JSON Web Token and its family (JSON Web Signature, JSON Web Encryption and JSON Web Key) in Ruby}
-  s.description = %q{JSON Web Token and its family (JSON Web Signature, JSON Web Encryption and JSON Web Key) in Ruby}
-  s.files         = `git ls-files`.split("\n")
-  s.test_files    = `git ls-files -- {test,spec,features}/*`.split("\n")
-  s.executables   = `git ls-files -- bin/*`.split("\n").map{ |f| File.basename(f) }
-  s.require_paths = ["lib"]
-  s.add_runtime_dependency "multi_json", ">= 1.3"
-  s.add_runtime_dependency "url_safe_base64"
-  s.add_runtime_dependency "activesupport"
-  s.add_runtime_dependency "bindata"
-  s.add_development_dependency "rake", ">= 0.8"
-  s.add_development_dependency "cover_me", ">= 1.2.0"
-  s.add_development_dependency "rspec", ">= 2"
+Gem::Specification.new do |gem|
+  gem.name        = "json-jwt"
+  gem.version     = File.read("VERSION")
+  gem.authors     = ["nov matake"]
+  gem.email       = ["nov@matake.jp"]
+  gem.homepage    = "https://github.com/nov/json-jwt"
+  gem.summary     = %q{JSON Web Token and its family (JSON Web Signature, JSON Web Encryption and JSON Web Key) in Ruby}
+  gem.description = %q{JSON Web Token and its family (JSON Web Signature, JSON Web Encryption and JSON Web Key) in Ruby}
+  gem.license     = 'MIT'
+  gem.files         = `git ls-files`.split("\n")
+  gem.test_files    = `git ls-files -- {test,spec,features}/*`.split("\n")
+  gem.executables   = `git ls-files -- bin/*`.split("\n").map{ |f| File.basename(f) }
+  gem.require_paths = ["lib"]
+  gem.add_runtime_dependency "multi_json", ">= 1.3"
+  gem.add_runtime_dependency "url_safe_base64"
+  gem.add_runtime_dependency "activesupport"
+  gem.add_runtime_dependency "bindata"
+  gem.add_runtime_dependency "securecompare"
+  gem.add_development_dependency "rake", ">= 0.8"
+  gem.add_development_dependency "simplecov"
+  gem.add_development_dependency "rspec", ">= 2"
 end

data/lib/json/jose.rb

@@ -1,5 +1,9 @@
+require 'securecompare'
+
 module JSON
   class JOSE < JWT
+    include SecureCompare
+
     def content_type
       'application/jose'
     end

data/lib/json/jwe.rb

@@ -7,6 +7,8 @@ module JSON
     class DecryptionFailed < JWT::VerificationFailed; end
     class UnexpectedAlgorithm < JWT::UnexpectedAlgorithm; end
 
+    NUM_OF_SEGMENTS = 5
+
     attr_accessor(
       :public_key_or_secret, :private_key_or_secret, :mode,
       :input, :plain_text, :cipher_text, :authentication_tag, :iv,
@@ -41,7 +43,7 @@ module JSON
       cipher.decrypt
       restore_cipher_keys!
       self.plain_text = cipher.update(cipher_text) + cipher.final
-      verify_cbc_integirity_value! if cbc?
+      verify_cbc_authentication_tag! if cbc?
       self
     end
 
@@ -119,6 +121,17 @@ module JSON
       OpenSSL::Digest::Digest.new "SHA#{sha_size}"
     end
 
+    def derive_encryption_and_mac_keys_cbc!
+      self.mac_key, self.encryption_key = content_encryption_key.unpack("a#{content_encryption_key.length / 2}" * 2)
+      self
+    end
+
+    def derive_encryption_and_mac_keys_gcm!
+      self.encryption_key = content_encryption_key
+      self.mac_key = :wont_be_used
+      self
+    end
+
     # encyption
 
     def jwe_encrypted_key
@@ -165,7 +178,7 @@ module JSON
       else
         cipher.random_key
       end
-      self.encryption_key = content_encryption_key
+      derive_encryption_and_mac_keys_gcm!
       self
     end
 
@@ -175,7 +188,7 @@ module JSON
       else
         SecureRandom.random_bytes sha_size / 8
       end
-      self.mac_key, self.encryption_key = content_encryption_key.unpack("a#{content_encryption_key.length / 2}" * 2)
+      derive_encryption_and_mac_keys_cbc!
       self
     end
 
@@ -200,6 +213,9 @@ module JSON
     # decryption
 
     def decode_segments!
+      unless input.count('.') + 1 == NUM_OF_SEGMENTS
+        raise InvalidFormat.new("Invalid JWE Format. JWE should include #{NUM_OF_SEGMENTS} segments.")
+      end
       _header_json_, self.jwe_encrypted_key, self.iv, self.cipher_text, self.authentication_tag = input.split('.').collect do |segment|
         UrlSafeBase64.decode64 segment
       end
@@ -233,9 +249,9 @@ module JSON
       self.content_encryption_key = decrypt_content_encryption_key
       case
       when gcm?
-        self.encryption_key = content_encryption_key
+        derive_encryption_and_mac_keys_gcm!
       when cbc?
-        self.mac_key, self.encryption_key = content_encryption_key.unpack("a#{content_encryption_key.length / 2}" * 2)
+        derive_encryption_and_mac_keys_cbc!
       end
       cipher.key = encryption_key
       cipher.iv = iv # NOTE: 'iv' has to be set after 'key' for GCM
@@ -245,7 +261,7 @@ module JSON
       end
     end
 
-    def verify_cbc_integirity_value!
+    def verify_cbc_authentication_tag!
       auth_data = input.split('.').first
       secured_input = [
         auth_data,
@@ -256,8 +272,8 @@ module JSON
       expected_authentication_tag = OpenSSL::HMAC.digest(
         sha_digest, mac_key, secured_input
       )[0, sha_size / 2 / 8]
-      unless authentication_tag == expected_authentication_tag
-        raise DecryptionFailed.new('Invalid integrity value')
+      unless secure_compare(authentication_tag, expected_authentication_tag)
+        raise DecryptionFailed.new('Invalid authentication tag')
       end
     end
   end

data/lib/json/jws.rb

@@ -4,6 +4,8 @@ module JSON
     class VerificationFailed < JWT::VerificationFailed; end
     class UnexpectedAlgorithm < JWT::UnexpectedAlgorithm; end
 
+    NUM_OF_SEGMENTS = 3
+
     def initialize(jwt)
       replace jwt
       raise InvalidFormat.new('Signature Algorithm Required') unless algorithm
@@ -66,8 +68,7 @@ module JSON
     def valid?(signature_base_string, public_key_or_secret)
       case
       when hmac?
-        secret = public_key_or_secret
-        sign(signature_base_string, secret) == signature
+        secure_compare sign(signature_base_string, public_key_or_secret), signature
       when rsa?
         public_key = public_key_or_secret
         public_key.verify digest, signature, signature_base_string

data/lib/json/jwt.rb

@@ -78,15 +78,15 @@ module JSON
 
     class << self
       def decode(jwt_string, key_or_secret = nil)
-        case jwt_string.count('.')
-        when 2 # JWT / JWS
-          header, claims, signature = jwt_string.split('.', 3).collect do |segment|
+        case jwt_string.count('.') + 1
+        when JWS::NUM_OF_SEGMENTS # JWT / JWS
+          header, claims, signature = jwt_string.split('.', JWS::NUM_OF_SEGMENTS).collect do |segment|
             UrlSafeBase64.decode64 segment.to_s
           end
           header, claims = [header, claims].collect do |json|
             MultiJson.load(json).with_indifferent_access
           end
-          signature_base_string = jwt_string.split('.')[0, 2].join('.')
+          signature_base_string = jwt_string.split('.')[0, JWS::NUM_OF_SEGMENTS - 1].join('.')
           jwt = new claims
           jwt.header = header
           jwt.signature = signature
@@ -96,7 +96,7 @@ module JSON
           #  So we need to use raw base64 strings for signature verification.
           jwt.verify signature_base_string, key_or_secret unless key_or_secret == :skip_verification
           jwt
-        when 4 # JWE
+        when JWE::NUM_OF_SEGMENTS
           jwe = JWE.new jwt_string
           jwe.header = MultiJson.load(
             UrlSafeBase64.decode64 jwt_string.split('.').first
@@ -104,7 +104,7 @@ module JSON
           jwe.decrypt! key_or_secret unless key_or_secret == :skip_decryption
           jwe
         else
-          raise InvalidFormat.new('Invalid JWT Format. JWT should include 2 or 3 dots.')
+          raise InvalidFormat.new("Invalid JWT Format. JWT should include #{JWS::NUM_OF_SEGMENTS} or #{JWE::NUM_OF_SEGMENTS} segments.")
         end
       rescue MultiJson::DecodeError
         raise InvalidFormat.new("Invalid JSON Format")

data/spec/json/jwe_spec.rb

@@ -227,7 +227,7 @@ describe JSON::JWE do
       end
     end
 
-    shared_examples_for :verify_cbc_integrity_value do
+    shared_examples_for :verify_cbc_authentication_tag do
       let(:input) do
         _jwe_ = JSON::JWE.new plain_text
         _jwe_.alg, _jwe_.enc = alg, enc
@@ -316,13 +316,13 @@ describe JSON::JWE do
       context 'when enc=A128CBC-HS256' do
         let(:enc) { :'A128CBC-HS256' }
         it_behaves_like :decryptable
-        it_behaves_like :verify_cbc_integrity_value
+        it_behaves_like :verify_cbc_authentication_tag
       end
 
       context 'when enc=A256CBC-HS512' do
         let(:enc) { :'A256CBC-HS512' }
         it_behaves_like :decryptable
-        it_behaves_like :verify_cbc_integrity_value
+        it_behaves_like :verify_cbc_authentication_tag
       end
     end
 
@@ -333,7 +333,7 @@ describe JSON::JWE do
     end
 
     context 'when unknonw/unsupported algorithm given' do
-      let(:input) { 'whatever' }
+      let(:input) { 'header.key.iv.cipher_text.auth_tag' }
       let(:key) { public_key }
       let(:alg) { :RSA1_5 }
       let(:enc) { :'A128CBC-HS256' }
@@ -355,5 +355,16 @@ describe JSON::JWE do
         end
       end
     end
+
+    context 'when invalid format of input given' do
+      let(:input) { 'header.payload.signature' }
+      let(:alg) { :RSA1_5 }
+      let(:enc) { :'A128CBC-HS256' }
+      it do
+        expect do
+          jwe.decrypt! public_key
+        end.to raise_error JSON::JWE::InvalidFormat
+      end
+    end
   end
 end

data/spec/spec_helper.rb

@@ -1,4 +1,9 @@
-require 'cover_me'
+require 'simplecov'
+
+SimpleCov.start do
+  add_filter 'spec'
+end
+
 require 'rspec'
 require 'json/jwt'
 

metadata

@@ -1,111 +1,125 @@
 --- !ruby/object:Gem::Specification
 name: json-jwt
 version: !ruby/object:Gem::Version
-  version: 0.6.0
+  version: 0.6.1
 platform: ruby
 authors:
 - nov matake
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2013-10-24 00:00:00.000000000 Z
+date: 2014-02-20 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: multi_json
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '1.3'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '1.3'
 - !ruby/object:Gem::Dependency
   name: url_safe_base64
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
   name: activesupport
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
   name: bindata
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: securecompare
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0.8'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0.8'
 - !ruby/object:Gem::Dependency
-  name: cover_me
+  name: simplecov
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
-        version: 1.2.0
+        version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
-        version: 1.2.0
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: rspec
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '2'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '2'
 description: JSON Web Token and its family (JSON Web Signature, JSON Web Encryption
@@ -116,10 +130,10 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
-- .gitignore
-- .gitmodules
-- .rspec
-- .travis.yml
+- ".gitignore"
+- ".gitmodules"
+- ".rspec"
+- ".travis.yml"
 - Gemfile
 - LICENSE
 - README.rdoc
@@ -150,7 +164,8 @@ files:
 - spec/json/jwt_spec.rb
 - spec/spec_helper.rb
 homepage: https://github.com/nov/json-jwt
-licenses: []
+licenses:
+- MIT
 metadata: {}
 post_install_message: 
 rdoc_options: []
@@ -158,17 +173,17 @@ require_paths:
 - lib
 required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
-  - - '>='
+  - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
-  - - '>='
+  - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.0.3
+rubygems_version: 2.2.1
 signing_key: 
 specification_version: 4
 summary: JSON Web Token and its family (JSON Web Signature, JSON Web Encryption and