json-jwt 1.3.1 → 1.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 05de8b3155d7e83d6f5fa6e4e9f157a775049cd5
-  data.tar.gz: 08e6eea95c7e4b7fcfef3df410c9180bb1687042
+  metadata.gz: 6817c45c39a6ae6f9240df8b7edb8d407ef79744
+  data.tar.gz: 8f97ad80b2d8fda2732b8cbbf8166b9ca8bca404
 SHA512:
-  metadata.gz: d9267cdcd5e667ababeb3924d22ff9f883ecae48152be82201dbf9a4ac7243bc950d737db479904a84936123ac5127847b3089219e8cc57d6e382ab9bb46aec7
-  data.tar.gz: 57299440c5fb636ee600d13112b21a97b512afb5d581e2719fce6cc0bdd6e9449c7a0bb6f0978f26951b20bf91e8a0a77817586eef7ea86259f84c250538ab43
+  metadata.gz: 1cc01ddbca74f1dd13cc054e5b3e2d1d9242191309526a29c1c1e75e5c5f08d70cb79c208dd4afb1b7dc948bed2b85adef25f5c8a9314ec0f5ff256a9cbdd0b2
+  data.tar.gz: 17b0980e989fd63dcf0ee5ee48dd8cc44d38ead751ecf6523e2ea4ed7d820b520be0502d0fb9265d73c330bf0aebd8c7794b610d69373526bfc3d14a4803fe4a

data/VERSION

@@ -1 +1 @@
-1.3.1
+1.4.0

data/lib/json/jwe.rb

@@ -10,16 +10,16 @@ module JSON
     NUM_OF_SEGMENTS = 5
 
     attr_accessor(
-      :public_key_or_secret, :private_key_or_secret, :mode,
-      :input, :plain_text, :cipher_text, :authentication_tag, :iv,
+      :public_key_or_secret, :private_key_or_secret,
+      :plain_text, :cipher_text, :authentication_tag, :iv, :auth_data,
       :content_encryption_key, :jwe_encrypted_key, :encryption_key, :mac_key
     )
 
     register_header_keys :enc, :epk, :zip, :apu, :apv
     alias_method :encryption_method, :enc
 
-    def initialize(input)
-      self.input = input.to_s
+    def initialize(input = nil)
+      self.plain_text = input.to_s
     end
 
     def content_type
@@ -27,8 +27,6 @@ module JSON
     end
 
     def encrypt!(public_key_or_secret)
-      self.mode = :encryption
-      self.plain_text = input
       self.public_key_or_secret = public_key_or_secret
       cipher.encrypt
       generate_cipher_keys!
@@ -37,9 +35,7 @@ module JSON
     end
 
     def decrypt!(private_key_or_secret)
-      self.mode = :decryption
       self.private_key_or_secret = private_key_or_secret
-      decode_segments!
       cipher.decrypt
       restore_cipher_keys!
       self.plain_text = cipher.update(cipher_text) + cipher.final
@@ -48,18 +44,39 @@ module JSON
     end
 
     def to_s
-      if mode == :encryption
-        [
-          header.to_json,
-          jwe_encrypted_key,
-          iv,
-          cipher_text,
-          authentication_tag
-        ].collect do |segment|
-          UrlSafeBase64.encode64 segment.to_s
-        end.join('.')
+      [
+        header.to_json,
+        jwe_encrypted_key,
+        iv,
+        cipher_text,
+        authentication_tag
+      ].collect do |segment|
+        UrlSafeBase64.encode64 segment.to_s
+      end.join('.')
+    end
+
+    def as_json(options = {})
+      case options[:syntax]
+      when :general
+        {
+          protected:  UrlSafeBase64.encode64(header.to_json),
+          recipients: [{
+            encrypted_key: UrlSafeBase64.encode64(jwe_encrypted_key)
+          }],
+          iv:         UrlSafeBase64.encode64(iv),
+          ciphertext: UrlSafeBase64.encode64(cipher_text),
+          tag:        UrlSafeBase64.encode64(authentication_tag)
+        }
+      when :flattened
+        {
+          protected:     UrlSafeBase64.encode64(header.to_json),
+          encrypted_key: UrlSafeBase64.encode64(jwe_encrypted_key),
+          iv:            UrlSafeBase64.encode64(iv),
+          ciphertext:    UrlSafeBase64.encode64(cipher_text),
+          tag:           UrlSafeBase64.encode64(authentication_tag)
+        }
       else
-        plain_text
+        super
       end
     end
 
@@ -166,8 +183,9 @@ module JSON
       end
       cipher.key = encryption_key
       self.iv = cipher.random_iv
+      self.auth_data = UrlSafeBase64.encode64 header.to_json
       if gcm?
-        cipher.auth_data = UrlSafeBase64.encode64 header.to_json
+        cipher.auth_data = self.auth_data
       end
       self
     end
@@ -197,7 +215,6 @@ module JSON
       when gcm?
         cipher.auth_tag
       when cbc?
-        auth_data = UrlSafeBase64.encode64 header.to_json
         secured_input = [
           auth_data,
           iv,
@@ -212,16 +229,6 @@ module JSON
 
     # decryption
 
-    def decode_segments!
-      unless input.count('.') + 1 == NUM_OF_SEGMENTS
-        raise InvalidFormat.new("Invalid JWE Format. JWE should include #{NUM_OF_SEGMENTS} segments.")
-      end
-      _header_json_, self.jwe_encrypted_key, self.iv, self.cipher_text, self.authentication_tag = input.split('.').collect do |segment|
-        UrlSafeBase64.decode64 segment
-      end
-      self
-    end
-
     def decrypt_content_encryption_key
       case algorithm.try(:to_sym)
       when :RSA1_5
@@ -257,12 +264,11 @@ module JSON
       cipher.iv = iv # NOTE: 'iv' has to be set after 'key' for GCM
       if gcm?
         cipher.auth_tag = authentication_tag
-        cipher.auth_data = input.split('.').first
+        cipher.auth_data = auth_data
       end
     end
 
     def verify_cbc_authentication_tag!
-      auth_data = input.split('.').first
       secured_input = [
         auth_data,
         iv,
@@ -276,5 +282,38 @@ module JSON
         raise DecryptionFailed.new('Invalid authentication tag')
       end
     end
+
+    class << self
+      def decode_compact_serialized(input, private_key_or_secret)
+        unless input.count('.') + 1 == NUM_OF_SEGMENTS
+          raise InvalidFormat.new("Invalid JWE Format. JWE should include #{NUM_OF_SEGMENTS} segments.")
+        end
+        jwe = new
+        _header_json_, jwe.jwe_encrypted_key, jwe.iv, jwe.cipher_text, jwe.authentication_tag = input.split('.').collect do |segment|
+          UrlSafeBase64.decode64 segment
+        end
+        jwe.auth_data = input.split('.').first
+        jwe.header = MultiJson.load(_header_json_).with_indifferent_access
+        jwe.decrypt! private_key_or_secret unless private_key_or_secret == :skip_decryption
+        jwe
+      end
+
+      def decode_json_serialized(input, private_key_or_secret)
+        input = input.with_indifferent_access
+        jwe_encrypted_key = if input[:recipients].present?
+          input[:recipients].first[:encrypted_key]
+        else
+          input[:encrypted_key]
+        end
+        compact_serialized = [
+          input[:protected],
+          jwe_encrypted_key,
+          input[:iv],
+          input[:ciphertext],
+          input[:tag]
+        ].join('.')
+        decode_compact_serialized compact_serialized, private_key_or_secret
+      end
+    end
   end
 end

data/lib/json/jws.rb

@@ -6,9 +6,10 @@ module JSON
 
     NUM_OF_SEGMENTS = 3
 
+    attr_accessor :signature_base_string
+
     def initialize(jwt)
       update jwt
-      raise InvalidFormat.new('Signature Algorithm Required') unless algorithm
     end
 
     def sign!(private_key_or_secret)
@@ -16,9 +17,14 @@ module JSON
       self
     end
 
-    def verify(signature_base_string, public_key_or_secret)
-      public_key_or_secret && valid?(signature_base_string, public_key_or_secret) or
-      raise VerificationFailed
+    def verify!(public_key_or_secret)
+      if alg.try(:to_sym) == :none
+        raise UnexpectedAlgorithm if public_key_or_secret
+        signature == '' or raise VerificationFailed
+      else
+        public_key_or_secret && valid?(public_key_or_secret) or
+        raise VerificationFailed
+      end
     end
 
     def update_with_jose_attributes(hash_or_jwt)
@@ -50,7 +56,7 @@ module JSON
     end
 
     def signature_base_string
-      [
+      @signature_base_string ||= [
         header.to_json,
         self.to_json
       ].collect do |segment|
@@ -79,7 +85,7 @@ module JSON
       end
     end
 
-    def valid?(signature_base_string, public_key_or_secret)
+    def valid?(public_key_or_secret)
       public_key_or_secret = with_jwk_support public_key_or_secret
       case
       when hmac?
@@ -107,7 +113,7 @@ module JSON
         key.to_key
       when JSON::JWK::Set
         key.detect do |jwk|
-          jwk[:kid] && jwk[:kid] == header[:kid]
+          jwk[:kid] && jwk[:kid] == kid
         end.try(:to_key) or raise JWK::Set::KidNotFound
       else
         key
@@ -138,5 +144,44 @@ module JSON
       byte_size = (private_key.group.degree + 7) / 8
       OpenSSL::ASN1.decode(signature).value.map { |value| value.value.to_s(2).rjust(byte_size, "\x00") }.join
     end
+
+    class << self
+      def decode_compact_serialized(input, public_key_or_secret)
+        unless input.count('.') + 1 == NUM_OF_SEGMENTS
+          raise InvalidFormat.new("Invalid JWS Format. JWS should include #{NUM_OF_SEGMENTS} segments.")
+        end
+        header, claims, signature = input.split('.', JWS::NUM_OF_SEGMENTS).collect do |segment|
+          UrlSafeBase64.decode64 segment.to_s
+        end
+        header, claims = [header, claims].collect do |json|
+          MultiJson.load(json).with_indifferent_access
+        end
+        jws = new claims
+        jws.header = header
+        jws.signature = signature
+        jws.signature_base_string = input.split('.')[0, JWS::NUM_OF_SEGMENTS - 1].join('.')
+        jws.verify! public_key_or_secret unless public_key_or_secret == :skip_verification
+        jws
+      end
+
+      def decode_json_serialized(input, public_key_or_secret)
+        input = input.with_indifferent_access
+        header, payload, signature = if input[:signatures].present?
+          [
+            input[:signatures].first[:protected],
+            input[:payload],
+            input[:signatures].first[:signature]
+          ].collect do |segment|
+            segment
+          end
+        else
+          [:protected, :payload, :signature].collect do |key|
+            input[key]
+          end
+        end
+        compact_serialized = [header, payload, signature].join('.')
+        decode_compact_serialized compact_serialized, public_key_or_secret
+      end
+    end
   end
 end

data/lib/json/jwt.rb

@@ -51,13 +51,11 @@ module JSON
       jws.sign! private_key_or_secret
     end
 
+    # NOTE: keeping for backward compatibility
     def verify(signature_base_string, public_key_or_secret = nil)
-      if alg.try(:to_sym) == :none
-        raise UnexpectedAlgorithm if public_key_or_secret
-        signature == '' or raise VerificationFailed
-      else
-        JWS.new(self).verify(signature_base_string, public_key_or_secret)
-      end
+      jws = JWS.new self
+      jws.signature_base_string = signature_base_string
+      jws.verify! public_key_or_secret
     end
 
     def encrypt(public_key_or_secret, algorithm = :RSA1_5, encryption_method = :'A128CBC-HS256')
@@ -105,64 +103,30 @@ module JSON
         else
           decode_compact_serialized input, key_or_secret
         end
+      rescue MultiJson::DecodeError
+        raise InvalidFormat.new("Invalid JSON Format")
       end
 
-      private
-
       def decode_compact_serialized(jwt_string, key_or_secret)
         case jwt_string.count('.') + 1
-        when JWS::NUM_OF_SEGMENTS # JWT / JWS
-          header, claims, signature = jwt_string.split('.', JWS::NUM_OF_SEGMENTS).collect do |segment|
-            UrlSafeBase64.decode64 segment.to_s
-          end
-          header, claims = [header, claims].collect do |json|
-            MultiJson.load(json).with_indifferent_access
-          end
-          signature_base_string = jwt_string.split('.')[0, JWS::NUM_OF_SEGMENTS - 1].join('.')
-          jwt = new claims
-          jwt.header = header
-          jwt.signature = signature
-
-          # NOTE:
-          #  Some JSON libraries generates wrong format of JSON (spaces between keys and values etc.)
-          #  So we need to use raw base64 strings for signature verification.
-          jwt.verify signature_base_string, key_or_secret unless key_or_secret == :skip_verification
-          jwt
+        when JWS::NUM_OF_SEGMENTS
+          JWS.decode_compact_serialized jwt_string, key_or_secret
         when JWE::NUM_OF_SEGMENTS
-          jwe = JWE.new jwt_string
-          jwe.header = MultiJson.load(
-            UrlSafeBase64.decode64 jwt_string.split('.').first
-          ).with_indifferent_access
-          if key_or_secret == :skip_decryption
-            jwe
-          else
-            jwe.decrypt! key_or_secret
-            JSON::JWT.decode jwe.plain_text, :skip_verification
-          end
+          JWE.decode_compact_serialized jwt_string, key_or_secret
         else
           raise InvalidFormat.new("Invalid JWT Format. JWT should include #{JWS::NUM_OF_SEGMENTS} or #{JWE::NUM_OF_SEGMENTS} segments.")
         end
-      rescue MultiJson::DecodeError
-        raise InvalidFormat.new("Invalid JSON Format")
       end
 
       def decode_json_serialized(input, key_or_secret)
         input = input.with_indifferent_access
-        header, payload, signature = if input[:signatures].present?
-          [
-            input[:signatures].first[:protected],
-            input[:payload],
-            input[:signatures].first[:signature]
-          ].collect do |segment|
-            segment
-          end
+        if (input[:signatures] || input[:signature]).present?
+          JWS.decode_json_serialized input, key_or_secret
+        elsif input[:ciphertext].present?
+          JWE.decode_json_serialized input, key_or_secret
         else
-          [:protected, :payload, :signature].collect do |key|
-            input[key]
-          end
+          raise InvalidFormat.new("Unexpected JOSE JSON Serialization Format.")
         end
-        jwt_string = [header, payload, signature].join('.')
-        decode_compact_serialized jwt_string, key_or_secret
       end
     end
   end

data/spec/json/jwe_spec.rb

@@ -120,14 +120,14 @@ describe JSON::JWE do
 
   describe 'decrypt!' do
     let(:plain_text) { 'Hello World' }
-    let(:input) do
+    let(:jwe_string) do
       _jwe_ = JSON::JWE.new plain_text
       _jwe_.alg, _jwe_.enc = alg, enc
       _jwe_.encrypt! key
       _jwe_.to_s
     end
     let(:jwe) do
-      _jwe_ = JSON::JWE.new input
+      _jwe_ = JSON::JWE.decode jwe_string, :skip_decryption
       _jwe_.alg, _jwe_.enc = alg, enc
       _jwe_
     end
@@ -135,7 +135,7 @@ describe JSON::JWE do
     shared_examples_for :decryptable do
       it do
         jwe.decrypt! key
-        jwe.to_s.should == plain_text
+        jwe.plain_text.should == plain_text
       end
     end
 
@@ -148,7 +148,7 @@ describe JSON::JWE do
     end
 
     shared_examples_for :verify_cbc_authentication_tag do
-      let(:input) do
+      let(:jwe_string) do
         _jwe_ = JSON::JWE.new plain_text
         _jwe_.alg, _jwe_.enc = alg, enc
         _jwe_.encrypt! key
@@ -275,16 +275,5 @@ describe JSON::JWE do
         end
       end
     end
-
-    context 'when invalid format of input given' do
-      let(:input) { 'header.payload.signature' }
-      let(:alg) { :RSA1_5 }
-      let(:enc) { :'A128CBC-HS256' }
-      it do
-        expect do
-          jwe.decrypt! public_key
-        end.to raise_error JSON::JWE::InvalidFormat
-      end
-    end
   end
 end

data/spec/json/jwk/set_spec.rb

@@ -45,6 +45,20 @@ describe JSON::JWK::Set do
     end
   end
 
+  context 'when pure Hash with :keys key given' do
+    subject do
+      JSON::JWK::Set.new(
+        keys: jwk.as_json
+      )
+    end
+
+    it 'should convert into JSON::JWK' do
+      subject.each do |jwk|
+        jwk.should be_instance_of JSON::JWK
+      end
+    end
+  end
+
   describe '#as_json' do
     it 'should become proper JWK set format' do
       json = set.as_json

data/spec/json/jws_spec.rb

@@ -131,7 +131,7 @@ describe JSON::JWS do
       let(:signed) { jws.sign!(jwks) }
 
       context 'when jwk is found by given kid' do
-        before { jws.header[:kid] = kid }
+        before { jws.kid = kid }
         it { should == jws.sign!('secret') }
       end
 
@@ -242,7 +242,7 @@ describe JSON::JWS do
       let(:signed) { jws.sign!(jwks) }
 
       context 'when jwk is found by given kid' do
-        before { jws.header[:kid] = kid }
+        before { jws.kid = kid }
         it { should == signed }
       end
 

data/spec/json/jwt_spec.rb

@@ -92,7 +92,7 @@ describe JSON::JWT do
 
     context 'when signed' do
       it 'should delegate verification to JWS' do
-        expect(jws).to receive(:verify)
+        expect(jws).to receive(:verify!)
         expect(JSON::JWS).to receive(:new).and_return(jws)
         jwt.verify 'shared_secret'
       end
@@ -148,16 +148,19 @@ describe JSON::JWT do
       context 'when alg header malformed' do
         context 'from alg=HS256' do
           context 'to alg=none' do
-            let(:malformed_jwt) do
-              jwt = JSON::JWT.decode jws.to_s, :skip_verification
-              jwt.header[:alg] = :none
-              jwt.signature = ''
-              jwt
+            let(:malformed_jwt_string) do
+              header, payload, signature = jws.to_s.split('.')
+              malformed_header = {alg: :none}.to_json
+              [
+                UrlSafeBase64.encode64(malformed_header),
+                payload,
+                ''
+              ].join('.')
             end
 
             it 'should do verification' do
               expect do
-                JSON::JWT.decode malformed_jwt.to_s, 'secret'
+                JSON::JWT.decode malformed_jwt_string, 'secret'
               end.to raise_error JSON::JWT::VerificationFailed
             end
           end
@@ -169,29 +172,42 @@ describe JSON::JWT do
           end
 
           context 'to alg=none' do
-            let(:malformed_jwt) do
-              jwt = JSON::JWT.decode jws.to_s, :skip_verification
-              jwt.header[:alg] = :none
-              jwt.signature = ''
-              jwt
+            let(:malformed_jwt_string) do
+              header, payload, signature = jws.to_s.split('.')
+              malformed_header = {alg: :none}.to_json
+              [
+                UrlSafeBase64.encode64(malformed_header),
+                payload,
+                ''
+              ].join('.')
             end
 
             it 'should fail verification' do
               expect do
-                JSON::JWT.decode malformed_jwt.to_s, public_key
+                JSON::JWT.decode malformed_jwt_string, public_key
               end.to raise_error JSON::JWT::UnexpectedAlgorithm
             end
           end
 
           context 'to alg=HS256' do
-            let(:malformed_jwt) do
-              jwt = JSON::JWT.decode jws.to_s, :skip_verification
-              jwt.sign public_key.to_s, :HS256
+            let(:malformed_jwt_string) do
+              header, payload, signature = jws.to_s.split('.')
+              malformed_header = {alg: :HS256}.to_json
+              malformed_signature = OpenSSL::HMAC.digest(
+                OpenSSL::Digest.new('SHA256'),
+                public_key.to_s,
+                [malformed_header, payload].join('.')
+              )
+              [
+                UrlSafeBase64.encode64(malformed_header),
+                payload,
+                UrlSafeBase64.encode64(malformed_signature)
+              ].join('.')
             end
 
             it 'should fail verification' do
               expect do
-                JSON::JWT.decode malformed_jwt.to_s, public_key
+                JSON::JWT.decode malformed_jwt_string, public_key
               end.to raise_error JSON::JWS::UnexpectedAlgorithm
             end
           end
@@ -206,6 +222,52 @@ describe JSON::JWT do
           end.not_to raise_error
         end
       end
+
+      context 'when JSON Serialization given' do
+        let(:signed) { JSON::JWT.new(claims).sign('secret') }
+
+        shared_examples_for :json_serialization_parser do
+          context 'when proper secret given' do
+            it { JSON::JWT.decode(serialized, 'secret').should == signed }
+          end
+
+          context 'when verification skipped' do
+            it { JSON::JWT.decode(serialized, :skip_verification).should == signed }
+          end
+
+          context 'when wrong secret given' do
+            it do
+              expect do
+                JSON::JWT.decode serialized, 'wrong'
+              end.to raise_error JSON::JWT::VerificationFailed
+            end
+          end
+        end
+
+        context 'when general' do
+          let(:serialized) do
+            {
+              payload: UrlSafeBase64.encode64(claims.to_json),
+              signatures: [{
+                protected: UrlSafeBase64.encode64(signed.header.to_json),
+                signature: UrlSafeBase64.encode64(signed.signature)
+              }]
+            }
+          end
+          it_behaves_like :json_serialization_parser
+        end
+
+        context 'when flattened' do
+          let(:serialized) do
+            {
+              protected: UrlSafeBase64.encode64(signed.header.to_json),
+              payload: UrlSafeBase64.encode64(claims.to_json),
+              signature: UrlSafeBase64.encode64(signed.signature)
+            }
+          end
+          it_behaves_like :json_serialization_parser
+        end
+      end
     end
 
     context 'when encrypted' do
@@ -213,7 +275,7 @@ describe JSON::JWT do
       let(:shared_key) { SecureRandom.hex 16 } # default shared key is too short
 
       it 'should decryptable' do
-        JSON::JWT.decode(input, private_key).should be_instance_of JSON::JWT
+        JSON::JWT.decode(input, private_key).should be_instance_of JSON::JWE
       end
 
       context 'when :skip_decryption given as secret/key' do

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: json-jwt
 version: !ruby/object:Gem::Version
-  version: 1.3.1
+  version: 1.4.0
 platform: ruby
 authors:
 - nov matake
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-08-14 00:00:00.000000000 Z
+date: 2015-09-08 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: multi_json