json_web_token 0.3.1 → 0.3.2
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/.rspec +0 -1
- data/.travis.yml +5 -5
- data/CHANGELOG.md +17 -10
- data/Gemfile +1 -4
- data/LICENSE.md +9 -0
- data/README.md +26 -10
- data/Rakefile +10 -0
- data/bin/console +10 -0
- data/bin/setup +8 -0
- data/json_web_token.gemspec +30 -15
- data/lib/json_web_token/version.rb +1 -1
- metadata +109 -31
- data/LICENSE +0 -21
- data/spec/fixtures/rsa/private_key.pem +0 -27
- data/spec/fixtures/rsa/private_key_weak.pem +0 -27
- data/spec/fixtures/rsa/public_key.pem +0 -9
- data/spec/fixtures/rsa/public_key_alt.pem +0 -9
- data/spec/json_web_token/algorithm/ecdsa_spec.rb +0 -56
- data/spec/json_web_token/algorithm/hmac_spec.rb +0 -127
- data/spec/json_web_token/algorithm/rsa_spec.rb +0 -126
- data/spec/json_web_token/format/asn1_spec.rb +0 -105
- data/spec/json_web_token/format/base64_url_spec.rb +0 -84
- data/spec/json_web_token/jwa_spec.rb +0 -71
- data/spec/json_web_token/jws_spec.rb +0 -119
- data/spec/json_web_token/jwt_spec.rb +0 -142
- data/spec/json_web_token/util_spec.rb +0 -24
- data/spec/json_web_token_spec.rb +0 -47
- data/spec/spec_helper.rb +0 -85
- data/spec/support/ecdsa_key.rb +0 -30
- data/spec/support/plausible_jwt.rb +0 -15
data/LICENSE
DELETED
@@ -1,21 +0,0 @@
|
|
1
|
-
The MIT License (MIT)
|
2
|
-
|
3
|
-
Copyright (c) 2015 Gary Fleshman
|
4
|
-
|
5
|
-
Permission is hereby granted, free of charge, to any person obtaining a copy
|
6
|
-
of this software and associated documentation files (the "Software"), to deal
|
7
|
-
in the Software without restriction, including without limitation the rights
|
8
|
-
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
9
|
-
copies of the Software, and to permit persons to whom the Software is
|
10
|
-
furnished to do so, subject to the following conditions:
|
11
|
-
|
12
|
-
The above copyright notice and this permission notice shall be included in
|
13
|
-
all copies or substantial portions of the Software.
|
14
|
-
|
15
|
-
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
16
|
-
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
17
|
-
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
18
|
-
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
19
|
-
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
20
|
-
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
|
21
|
-
THE SOFTWARE.
|
@@ -1,27 +0,0 @@
|
|
1
|
-
-----BEGIN RSA PRIVATE KEY-----
|
2
|
-
MIIEpAIBAAKCAQEAruE38DIgPqG4sJeFfXDS80BZdCoQRakRmKfkoOq26BaCerNK
|
3
|
-
IsMV1zMCnFWh/c3ax7iWXMbIrUIixDxAjOe/smzRCaT9rL6Jz235dbYX81mdGPUA
|
4
|
-
/PqzgwbfYnoKf9tDrUWDG0oU9WN/HJDY+1lKFW3sG29ENsLn7ezJOP8d7y1mIocg
|
5
|
-
l94dfKKaPlM3NECPObXGbJWyPsIlYrgCBKwdH6zHfKFeDDawsagtK7MZfzVfh/bI
|
6
|
-
JzL+84oCOUn75pXwl5JKOLaudYuHFNNGe4XCma+l0BEyfIAykIm2V5tL2zUaEPm6
|
7
|
-
Mh8r70nEeLtEDUgbVXk6OoEVfbEksvRfEaxPUQIDAQABAoIBAE2n+R0SRTtKuSbB
|
8
|
-
widX6HTYSGDLJPqp/wRY2a+TSrF4/WvbHbqeAp7TKf+eDxcTSGmT0EFWjFpTmfim
|
9
|
-
AMwRRRDIPXMY7wS8f5m67iGVQMFxM8+XTF8KPJicfqnOI8du6HiS+4sstG3bRuC6
|
10
|
-
eX/zwHAPpd7w48uldTQ0B47lyrcgJ8ZaKdA7BZRzxSojSrCmosajoOoAqRUKj9Bw
|
11
|
-
CcDVmZOrgd0z2spNsP/h1u8tyKNc55QtY7AbhiuJ7Eo99Fob78xH7pKgZk10MqLX
|
12
|
-
xWB0x5yKAptJ5O/cGkHwJ0CNP+/bWN4tRPJLd7q+lTDvBf40ix3UJ8xq2MItJoIo
|
13
|
-
4ysKplkCgYEA22tUs30r8qtQwzkTnwKnnNtHQbCVNx79PbQiSVeg1OFULBJ9Q5JB
|
14
|
-
tScgTeINvjeYvFk5yguy25dUZfpLy8tR2mziGy023LTfnPM7ldsFsoXgW+TimQhd
|
15
|
-
xn4aizgLk4F+jmX+Ga/YJllSUBmzgHtrJxFyFgfprlCWY8Oy6ayQvLMCgYEAzAj4
|
16
|
-
nPjf0tIU+HLVQNxzq+6EaJIdsaF4VNtuc5RUyIpN7ptnm+Qp1sZgMTFuZY/NGUJd
|
17
|
-
JUHF2598P7izf8k1U55CzHt9WR3gXADiDgubWXKJC9aO67RXQPfUX0f8g0MBpRyr
|
18
|
-
aMb1P3vEeEN6Mz2+rpxRQ+VMZHm03WgXfKTeDesCgYBw13nv9OetHT2jqK7Wj97z
|
19
|
-
ZDH5Ln8OoflKymD3pwEnedp37+pL3eO87ipG44J92MnL03dM2UdadzEIYPiqDh5C
|
20
|
-
XszJfS9BwiNd7BkwsDr13LPNjqCaYxsXAbNU9bW+XlJfmURcoXpf/n++gfk2kkJB
|
21
|
-
DU/G1Lrw0rEFDZftZLnq0QKBgQC4vsLF939K+Bgu4mN/6F0AZ+cSfINQjKFVTJ8V
|
22
|
-
HlEqiDiKfcJx4EWWCGefA2Avq+aNIY8Pph+OfjlVxVsasMiNXzaiyoo0QB4fkFkf
|
23
|
-
WJkgg9ndkzgz6kY7OGvenmLhQ7HgnDYEmGoGQn4iWw7yCM14c2gN7zidnaoL9C2Y
|
24
|
-
GfxKYwKBgQCvOp4mlfL176dKrCjOxVFqnpXMCS3WqTWk5e+uR6GKcs6SvEfue0X0
|
25
|
-
B/SVRn6tyKqLp9pvM+0fEaXrspZmgoedmiPY3V7Am5bdMOltW5DMvxAAdnqjok1i
|
26
|
-
q2O8Of/DTt2bn3nu8IZDeHrKebx8z/CG9rQK4x5fT1HcwAgroYG0bQ==
|
27
|
-
-----END RSA PRIVATE KEY-----
|
@@ -1,27 +0,0 @@
|
|
1
|
-
-----BEGIN RSA PRIVATE KEY-----
|
2
|
-
MIIEgQIBAAKB+wDZmyrApkiH+zL7G2Gzwht9N0KbW/iJCeygAKyqHoc75nFLE4We
|
3
|
-
jxGHR4RlIg9kYn1Qbm7Yl5/ASFIE//vMjqyJJ5GqoeVAKZfAp4NFKd99Ja5z1pIW
|
4
|
-
/hh4n2fswF9VYRsuCC0nmDQ9XNUZunXVJPJwOZ3RlWkE1yIbU1Ianr+Y81SkF6bp
|
5
|
-
pT/ucmA52RbVImoDoxztu0OK7CQ/yE3+gvHSwLaRE3/s5NpGhOPj3XoumMZoyAyb
|
6
|
-
rWlBCadAoaaaPAZx460xTP+I6n6CDM6/6uPazaRbOVxChIgiOxpPU39aNKwbB/iN
|
7
|
-
7LOuiSO1mStLXVTVpCsQukJa6GBPAgMBAAECgfo4oBYp95tcN1P24BM2kcZReTXN
|
8
|
-
88ri7kAzCrnjsvoB7l+A592XeydWipe7MXfL6Y0uhu41Uo9xm+AsCOjfPClNr4xK
|
9
|
-
WMKtRaWFrpGMR+8uQ8X3wthVP13i1ahXhV/JefF2sw39BbBiX2vcvBa5llm4NmYJ
|
10
|
-
CdZAOjNX5QCyiC3qDkYrQnY3c8ccWA+SdrZylRRBufzKxbp0HPU7NpQJmKGrORTd
|
11
|
-
lkYgXKI7QPMQ1/LgaVtEbG77MYbmzt0PAw6w5nQlwF8G9hV37Y6xanpg3EobOih2
|
12
|
-
qM/qmWRyg417h1VTMxVQLNf53f9P/nzRnSQK79ZDzPmSyI+ww0kRAn4A9TjM/51r
|
13
|
-
c/1IlFrWpo3NlsepGBmyX0DUNWuZOhA4Z2z7+GyAokF0LacFRyQNxzwFLAuMargm
|
14
|
-
WMgAKNs3LaZxrsWNCbyUCv2vyGSREsFJtXRIs2jBE4TUycOZvtgD32Y0EeKknc9y
|
15
|
-
RCT/kPSkKj/QDB8vsRaUql7829uuVAsCfgDjK6NPv8fTyLITPeCJoOcCa4LDr6nZ
|
16
|
-
vB21FCJom2eumrQ6lHkuLiFh2E+E2ICvKuCBaNi5g01wV6WnjJ1Ou3r33Ig+H6wX
|
17
|
-
La7cr0bq+QlLQy/woBlrgevIseAVKFnBe/rB8RY3vLTV53DLsRIlUjW3r0Hi+ovN
|
18
|
-
6ky/6dnrTQJ9cHBk/ufNd1exyeSE+8WVeQd/rz9JHIf7RatajNcXJcVBG72UldFx
|
19
|
-
VeV5dA9CChKpRHLfJafeXWMHP7SUbmgdREfszYQcVZXQ3g/OvUzHYV46X5kuvqZv
|
20
|
-
czwu6OTfkbWpNnI3jOyrtjdIv8yM4Zp06Ln8AjUaYaxAQQdPvdUCfgC6qdHQptpw
|
21
|
-
6HmCnBaToFYRw/u4BfDAC/YxI7E+WWvxqgcsF3IXgypE9vQoSao7xTSiwV9L2Fta
|
22
|
-
U3q32TAtUJozbs+4lFfY193WUmQokaeUY0nSJAufLitrRtXFLNnLxa7/i7Vg6TuC
|
23
|
-
hGFHzmEFr66aF3VBJ/SWp86W53X8BQJ9R6IhbZpxnGW3TbcgP5R7xVBcas+ypYn6
|
24
|
-
CEV22CzMDSE21Zek/q0N65im9QJgHrtLXSrb6DVOJF6lp8pm3yO+UXsaMTldysvo
|
25
|
-
H7sN9CzhhQNpSwFp4dvYQBi6pIQGsit6lbOj5wkE3PeRsusO6pcIli2w2MzgPjxn
|
26
|
-
OERK2BM=
|
27
|
-
-----END RSA PRIVATE KEY-----
|
@@ -1,9 +0,0 @@
|
|
1
|
-
-----BEGIN PUBLIC KEY-----
|
2
|
-
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAruE38DIgPqG4sJeFfXDS
|
3
|
-
80BZdCoQRakRmKfkoOq26BaCerNKIsMV1zMCnFWh/c3ax7iWXMbIrUIixDxAjOe/
|
4
|
-
smzRCaT9rL6Jz235dbYX81mdGPUA/PqzgwbfYnoKf9tDrUWDG0oU9WN/HJDY+1lK
|
5
|
-
FW3sG29ENsLn7ezJOP8d7y1mIocgl94dfKKaPlM3NECPObXGbJWyPsIlYrgCBKwd
|
6
|
-
H6zHfKFeDDawsagtK7MZfzVfh/bIJzL+84oCOUn75pXwl5JKOLaudYuHFNNGe4XC
|
7
|
-
ma+l0BEyfIAykIm2V5tL2zUaEPm6Mh8r70nEeLtEDUgbVXk6OoEVfbEksvRfEaxP
|
8
|
-
UQIDAQAB
|
9
|
-
-----END PUBLIC KEY-----
|
@@ -1,9 +0,0 @@
|
|
1
|
-
-----BEGIN PUBLIC KEY-----
|
2
|
-
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEApcDymjKwuWwyq9Zyt7EF
|
3
|
-
epTHzyvO875ioqDoMtCNhADrjLU25vaAaCyyf035VoXl/HYaUj0tBiEvQreso98O
|
4
|
-
eGO6cnfnu/QBvd1veyKtA8EjHFeo7NeA/RdXj6sEWtdM+QVHy6yI8YS/WAu8Ubrb
|
5
|
-
MNeDk4dEmfvvgL9TxNAYuVlWcLuR1fEyNN4NsansHZtoBCf6lRhd6l9uvu1HZJJ/
|
6
|
-
UrOostwH5jgnI3rWS2fB9SU7G5l9+YS7NbNGxa4kE6x72ko5WPg1U+wch94rZhxT
|
7
|
-
XBJDipRIox83wEQEP0qH8IWC905CmnYqfZ7HMdGt7KWvg/svO/q4oRtCb5NDEDGL
|
8
|
-
6QIDAQAB
|
9
|
-
-----END PUBLIC KEY-----
|
@@ -1,56 +0,0 @@
|
|
1
|
-
require 'json_web_token/algorithm/ecdsa'
|
2
|
-
require 'support/ecdsa_key'
|
3
|
-
|
4
|
-
module JsonWebToken
|
5
|
-
module Algorithm
|
6
|
-
describe Ecdsa do
|
7
|
-
let(:signing_input_0) { '{"iss":"joe","exp":1300819380,"http://example.com/is_root":true}' }
|
8
|
-
let(:signing_input_1) { '{"iss":"mike","exp":1300819380,"http://example.com/is_root":false}' }
|
9
|
-
describe 'detect changed signature or data' do
|
10
|
-
shared_examples_for '#sign' do
|
11
|
-
it 'does #verify?' do
|
12
|
-
private_key_0 = EcdsaKey.curve_new(sha_bits)
|
13
|
-
public_key_str_0 = EcdsaKey.public_key_str(private_key_0)
|
14
|
-
public_key_0 = EcdsaKey.public_key_new(sha_bits, public_key_str_0)
|
15
|
-
|
16
|
-
mac_0 = Ecdsa.sign(sha_bits, private_key_0, signing_input_0)
|
17
|
-
expect(mac_0.bytes.count).to eql expected_mac_byte_count
|
18
|
-
expect(Ecdsa.verify? mac_0, sha_bits, public_key_0, signing_input_0).to be true
|
19
|
-
|
20
|
-
private_key_1 = EcdsaKey.curve_new(sha_bits)
|
21
|
-
public_key_str_1 = EcdsaKey.public_key_str(private_key_1)
|
22
|
-
public_key_1 = EcdsaKey.public_key_new(sha_bits, public_key_str_1)
|
23
|
-
|
24
|
-
expect(Ecdsa.verify? mac_0, sha_bits, public_key_0, signing_input_1).to be false
|
25
|
-
expect(Ecdsa.verify? mac_0, sha_bits, public_key_1, signing_input_0).to be false
|
26
|
-
expect(Ecdsa.verify? mac_0, sha_bits, public_key_1, signing_input_1).to be false
|
27
|
-
|
28
|
-
mac_1 = Ecdsa.sign(sha_bits, private_key_1, signing_input_1)
|
29
|
-
expect(Ecdsa.verify? mac_1, sha_bits, public_key_0, signing_input_0).to be false
|
30
|
-
expect(Ecdsa.verify? mac_1, sha_bits, public_key_0, signing_input_1).to be false
|
31
|
-
expect(Ecdsa.verify? mac_1, sha_bits, public_key_1, signing_input_0).to be false
|
32
|
-
expect(Ecdsa.verify? mac_1, sha_bits, public_key_1, signing_input_1).to be true
|
33
|
-
end
|
34
|
-
end
|
35
|
-
|
36
|
-
describe 'ES256' do
|
37
|
-
let(:sha_bits) { '256' }
|
38
|
-
let(:expected_mac_byte_count) { 64 }
|
39
|
-
it_behaves_like '#sign'
|
40
|
-
end
|
41
|
-
|
42
|
-
describe 'ES384' do
|
43
|
-
let(:sha_bits) { '384' }
|
44
|
-
let(:expected_mac_byte_count) { 96 }
|
45
|
-
it_behaves_like '#sign'
|
46
|
-
end
|
47
|
-
|
48
|
-
describe 'ES512' do
|
49
|
-
let(:sha_bits) { '512' }
|
50
|
-
let(:expected_mac_byte_count) { 132 }
|
51
|
-
it_behaves_like '#sign'
|
52
|
-
end
|
53
|
-
end
|
54
|
-
end
|
55
|
-
end
|
56
|
-
end
|
@@ -1,127 +0,0 @@
|
|
1
|
-
require 'json_web_token/algorithm/hmac'
|
2
|
-
|
3
|
-
module JsonWebToken
|
4
|
-
module Algorithm
|
5
|
-
describe Hmac do
|
6
|
-
let(:signing_input_0) { '{"iss":"joe","exp":1300819380,"http://example.com/is_root":true}' }
|
7
|
-
let(:signing_input_1) { '{"iss":"mike","exp":1300819380,"http://example.com/is_root":false}' }
|
8
|
-
context 'detect changed signing_input or MAC' do
|
9
|
-
shared_examples_for '#sign' do
|
10
|
-
it 'does #verify?' do
|
11
|
-
mac = Hmac.sign(sha_bits, shared_key, signing_input_0)
|
12
|
-
expect(Hmac.verify? mac, sha_bits, shared_key, signing_input_0).to be true
|
13
|
-
expect(Hmac.verify? mac, sha_bits, shared_key, signing_input_1).to be false
|
14
|
-
|
15
|
-
changed_mac = Hmac.sign(sha_bits, shared_key, signing_input_1)
|
16
|
-
expect(Hmac.verify? changed_mac, sha_bits, shared_key, signing_input_0).to be false
|
17
|
-
end
|
18
|
-
end
|
19
|
-
|
20
|
-
describe 'HS256' do
|
21
|
-
let(:sha_bits) { '256' }
|
22
|
-
let(:shared_key) { 'gZH75aKtMN3Yj0iPS4hcgUuTwjAzZr9C' }
|
23
|
-
it_behaves_like '#sign'
|
24
|
-
end
|
25
|
-
|
26
|
-
describe 'HS384' do
|
27
|
-
let(:sha_bits) { '384' }
|
28
|
-
let(:shared_key) { 'AyM1SysPpbyDfgZld3umj1qzKObwVMkoqQ-EstJQLr_T-1qS' }
|
29
|
-
it_behaves_like '#sign'
|
30
|
-
end
|
31
|
-
|
32
|
-
describe 'HS512' do
|
33
|
-
let(:sha_bits) { '512' }
|
34
|
-
let(:shared_key) { 'ysPpbyDfgZld3umj1qzKObwVMkoqQ-EstJQLr_T-1qS0gZH75aKtMN3Yj0iPS4hc' }
|
35
|
-
it_behaves_like '#sign'
|
36
|
-
end
|
37
|
-
end
|
38
|
-
|
39
|
-
describe 'changed key' do
|
40
|
-
let(:sha_bits) { '256' }
|
41
|
-
let(:shared_key) { 'gZH75aKtMN3Yj0iPS4hcgUuTwjAzZr9C' }
|
42
|
-
let(:changed_key) { 'gZH75aKtMN3Yj0iPS4hcgUuTwjAzZr9Z' }
|
43
|
-
it 'fails to #verify?' do
|
44
|
-
mac = Hmac.sign(sha_bits, shared_key, signing_input_0)
|
45
|
-
expect(Hmac.verify? mac, sha_bits, shared_key, signing_input_0).to be true
|
46
|
-
expect(Hmac.verify? mac, sha_bits, changed_key, signing_input_0).to be false
|
47
|
-
end
|
48
|
-
end
|
49
|
-
|
50
|
-
context 'param validation' do
|
51
|
-
shared_examples_for 'invalid key' do
|
52
|
-
it 'raises' do
|
53
|
-
expect { Hmac.sign(sha_bits, shared_key, signing_input_0) }
|
54
|
-
.to raise_error(RuntimeError, 'Invalid shared key')
|
55
|
-
end
|
56
|
-
end
|
57
|
-
|
58
|
-
context 'w 256 sha_bits' do
|
59
|
-
let(:sha_bits) { '256' }
|
60
|
-
describe 'shared_key nil' do
|
61
|
-
let(:shared_key) { nil }
|
62
|
-
it_behaves_like 'invalid key'
|
63
|
-
end
|
64
|
-
|
65
|
-
describe "shared_key 'empty string'" do
|
66
|
-
let(:shared_key) { '' }
|
67
|
-
it_behaves_like 'invalid key'
|
68
|
-
end
|
69
|
-
|
70
|
-
describe 'shared_key length (31) < MAC length (32)' do
|
71
|
-
let(:shared_key) { 'gZH75aKtMN3Yj0iPS4hcgUuTwjAzZr9' }
|
72
|
-
it_behaves_like 'invalid key'
|
73
|
-
end
|
74
|
-
|
75
|
-
describe 'shared_key length (32) == MAC length (32)' do
|
76
|
-
let(:shared_key) { 'gZH75aKtMN3Yj0iPS4hcgUuTwjAzZr9C' }
|
77
|
-
it 'returns a 32-byte MAC string' do
|
78
|
-
mac = Hmac.sign(sha_bits, shared_key, signing_input_0)
|
79
|
-
expect(mac.bytesize).to eql 32
|
80
|
-
end
|
81
|
-
end
|
82
|
-
end
|
83
|
-
|
84
|
-
context 'w 384 sha_bits' do
|
85
|
-
let(:sha_bits) { '384' }
|
86
|
-
describe 'shared_key length (47) < MAC length (48)' do
|
87
|
-
let(:shared_key) { 'AyM1SysPpbyDfgZld3umj1qzKObwVMkoqQ-EstJQLr_T-1q' }
|
88
|
-
it_behaves_like 'invalid key'
|
89
|
-
end
|
90
|
-
|
91
|
-
describe 'shared_key length (48) == MAC length (48)' do
|
92
|
-
let(:shared_key) { 'AyM1SysPpbyDfgZld3umj1qzKObwVMkoqQ-EstJQLr_T-1qS' }
|
93
|
-
it 'returns a 48-byte MAC string' do
|
94
|
-
mac = Hmac.sign(sha_bits, shared_key, signing_input_0)
|
95
|
-
expect(mac.bytesize).to eql 48
|
96
|
-
end
|
97
|
-
end
|
98
|
-
end
|
99
|
-
|
100
|
-
context 'w 512 sha_bits' do
|
101
|
-
let(:sha_bits) { '512' }
|
102
|
-
describe 'shared_key length (63) < MAC length (64)' do
|
103
|
-
let(:shared_key) { 'ysPpbyDfgZld3umj1qzKObwVMkoqQ-EstJQLr_T-1qS0gZH75aKtMN3Yj0iPS4h' }
|
104
|
-
it_behaves_like 'invalid key'
|
105
|
-
end
|
106
|
-
|
107
|
-
describe 'shared_key length (64) == MAC length (64)' do
|
108
|
-
let(:shared_key) { 'ysPpbyDfgZld3umj1qzKObwVMkoqQ-EstJQLr_T-1qS0gZH75aKtMN3Yj0iPS4hc' }
|
109
|
-
it 'returns a 64-byte MAC string' do
|
110
|
-
mac = Hmac.sign(sha_bits, shared_key, signing_input_0)
|
111
|
-
expect(mac.bytesize).to eql 64
|
112
|
-
end
|
113
|
-
end
|
114
|
-
end
|
115
|
-
|
116
|
-
describe 'w unrecognized sha_bits' do
|
117
|
-
let(:sha_bits) { '257' }
|
118
|
-
let(:shared_key) { 'ysPpbyDfgZld3umj1qzKObwVMkoqQ-EstJQLr_T-1qS0gZH75aKtMN3Yj0iPS4hc' }
|
119
|
-
it 'raises' do
|
120
|
-
expect { Hmac.sign(sha_bits, shared_key, signing_input_0) }
|
121
|
-
.to raise_error(RuntimeError, 'Invalid sha_bits')
|
122
|
-
end
|
123
|
-
end
|
124
|
-
end
|
125
|
-
end
|
126
|
-
end
|
127
|
-
end
|
@@ -1,126 +0,0 @@
|
|
1
|
-
require 'json_web_token/algorithm/rsa'
|
2
|
-
require 'json_web_token/algorithm/rsa_util'
|
3
|
-
|
4
|
-
module JsonWebToken
|
5
|
-
module Algorithm
|
6
|
-
describe Rsa do
|
7
|
-
let(:signing_input_0) { '{"iss":"joe","exp":1300819380,"http://example.com/is_root":true}' }
|
8
|
-
let(:signing_input_1) { '{"iss":"mike","exp":1300819380,"http://example.com/is_root":false}' }
|
9
|
-
let(:path_to_keys) { 'spec/fixtures/rsa' }
|
10
|
-
context 'detect changed signing_input or MAC' do
|
11
|
-
let(:private_key) { RsaUtil.private_key(path_to_keys) }
|
12
|
-
let(:public_key) { RsaUtil.public_key(path_to_keys) }
|
13
|
-
shared_examples_for '#sign' do
|
14
|
-
it 'does #verify?' do
|
15
|
-
mac = Rsa.sign(sha_bits, private_key, signing_input_0)
|
16
|
-
expect(Rsa.verify? mac, sha_bits, public_key, signing_input_0).to be true
|
17
|
-
expect(Rsa.verify? mac, sha_bits, public_key, signing_input_1).to be false
|
18
|
-
|
19
|
-
changed_mac = Rsa.sign(sha_bits, private_key, signing_input_1)
|
20
|
-
expect(Rsa.verify? changed_mac, sha_bits, public_key, signing_input_0).to be false
|
21
|
-
end
|
22
|
-
end
|
23
|
-
|
24
|
-
context 'RS256' do
|
25
|
-
let(:sha_bits) { '256' }
|
26
|
-
it_behaves_like '#sign'
|
27
|
-
|
28
|
-
describe 'changed key' do
|
29
|
-
let(:changed_public_key) { RsaUtil.public_key(path_to_keys, 'public_key_alt.pem') }
|
30
|
-
it 'fails to #verify?' do
|
31
|
-
mac = Rsa.sign(sha_bits, private_key, signing_input_0)
|
32
|
-
expect(Rsa.verify? mac, sha_bits, public_key, signing_input_0).to be true
|
33
|
-
expect(Rsa.verify? mac, sha_bits, changed_public_key, signing_input_0).to be false
|
34
|
-
end
|
35
|
-
end
|
36
|
-
end
|
37
|
-
|
38
|
-
describe 'RS384' do
|
39
|
-
let(:sha_bits) { '384' }
|
40
|
-
it_behaves_like '#sign'
|
41
|
-
end
|
42
|
-
|
43
|
-
describe 'RS512' do
|
44
|
-
let(:sha_bits) { '512' }
|
45
|
-
it_behaves_like '#sign'
|
46
|
-
end
|
47
|
-
end
|
48
|
-
|
49
|
-
context 'param validation' do
|
50
|
-
shared_examples_for 'invalid private_key' do
|
51
|
-
it 'raises' do
|
52
|
-
expect { Rsa.sign(sha_bits, private_key, signing_input_0) }
|
53
|
-
.to raise_error(RuntimeError, 'Invalid key: RSA modulus too small')
|
54
|
-
end
|
55
|
-
end
|
56
|
-
|
57
|
-
context 'private_key bit size < KEY_BITS_MIN (2048)' do
|
58
|
-
let(:private_key) { RsaUtil.private_key(path_to_keys, 'private_key_weak.pem') }
|
59
|
-
describe 'w 256 sha_bits' do
|
60
|
-
let(:sha_bits) { '256' }
|
61
|
-
it_behaves_like 'invalid private_key'
|
62
|
-
end
|
63
|
-
|
64
|
-
describe 'w 384 sha_bits' do
|
65
|
-
let(:sha_bits) { '384' }
|
66
|
-
it_behaves_like 'invalid private_key'
|
67
|
-
end
|
68
|
-
|
69
|
-
describe 'w 512 sha_bits' do
|
70
|
-
let(:sha_bits) { '512' }
|
71
|
-
it_behaves_like 'invalid private_key'
|
72
|
-
end
|
73
|
-
end
|
74
|
-
|
75
|
-
shared_examples_for '2048 bit private_key' do
|
76
|
-
it 'returns a 256-byte MAC string' do
|
77
|
-
mac = Rsa.sign(sha_bits, private_key, signing_input_0)
|
78
|
-
expect(mac.bytesize).to eql 256
|
79
|
-
end
|
80
|
-
end
|
81
|
-
|
82
|
-
context 'private_key bits (2048) == KEY_BITS_MIN (2048)' do
|
83
|
-
let(:private_key) { RsaUtil.private_key(path_to_keys) }
|
84
|
-
describe 'w 256 sha_bits' do
|
85
|
-
let(:sha_bits) { '256' }
|
86
|
-
it_behaves_like '2048 bit private_key'
|
87
|
-
end
|
88
|
-
|
89
|
-
describe 'w 384 sha_bits' do
|
90
|
-
let(:sha_bits) { '384' }
|
91
|
-
it_behaves_like '2048 bit private_key'
|
92
|
-
end
|
93
|
-
|
94
|
-
describe 'w 512 sha_bits' do
|
95
|
-
let(:sha_bits) { '512' }
|
96
|
-
it_behaves_like '2048 bit private_key'
|
97
|
-
end
|
98
|
-
end
|
99
|
-
|
100
|
-
context 'blank private_key' do
|
101
|
-
let(:sha_bits) { '256' }
|
102
|
-
describe 'nil' do
|
103
|
-
let(:private_key) { nil }
|
104
|
-
it_behaves_like 'invalid private_key'
|
105
|
-
end
|
106
|
-
|
107
|
-
describe 'empty string' do
|
108
|
-
let(:private_key) { '' }
|
109
|
-
it 'raises' do
|
110
|
-
expect { Rsa.sign(sha_bits, private_key, signing_input_0) }.to raise_error(NoMethodError)
|
111
|
-
end
|
112
|
-
end
|
113
|
-
end
|
114
|
-
|
115
|
-
describe 'w unrecognized sha_bits' do
|
116
|
-
let(:sha_bits) { '257' }
|
117
|
-
let(:private_key) { 'private_key' }
|
118
|
-
it 'raises' do
|
119
|
-
expect { Rsa.sign(sha_bits, private_key, signing_input_0) }
|
120
|
-
.to raise_error(RuntimeError, 'Invalid sha_bits')
|
121
|
-
end
|
122
|
-
end
|
123
|
-
end
|
124
|
-
end
|
125
|
-
end
|
126
|
-
end
|
@@ -1,105 +0,0 @@
|
|
1
|
-
require 'json_web_token/format/asn1'
|
2
|
-
|
3
|
-
module JsonWebToken
|
4
|
-
module Format
|
5
|
-
describe Asn1 do
|
6
|
-
context 'w bytes' do
|
7
|
-
let(:der) { der_bytes.map(&:chr).join }
|
8
|
-
let(:signature) { signature_bytes.map(&:chr).join }
|
9
|
-
shared_examples_for '#der_to_signature' do
|
10
|
-
it 'converts' do
|
11
|
-
expect(signature.bytes.length).to eql signature_byte_count
|
12
|
-
expect(Asn1.der_to_signature(der, sha_bits).bytes).to eql signature_bytes
|
13
|
-
end
|
14
|
-
end
|
15
|
-
|
16
|
-
shared_examples_for '#signature_to_der' do
|
17
|
-
it 'converts' do
|
18
|
-
expect(Asn1.signature_to_der(signature, sha_bits).bytes).to eql der_bytes
|
19
|
-
end
|
20
|
-
end
|
21
|
-
|
22
|
-
shared_examples_for 'w/o valid signature' do
|
23
|
-
let(:signature_invalid) { (signature_bytes + [123]).map(&:chr).join }
|
24
|
-
it '#signature_to_der raises' do
|
25
|
-
expect { Asn1.signature_to_der(signature_invalid, sha_bits) }
|
26
|
-
.to raise_error(RuntimeError, 'Invalid signature length')
|
27
|
-
end
|
28
|
-
end
|
29
|
-
|
30
|
-
context 'for ES256' do
|
31
|
-
let(:sha_bits) { '256' }
|
32
|
-
let(:der_bytes) { [48, 69, 2, 32, 39, 115, 251, 5, 254, 60, 42, 53, 128, 68, 123, 82,
|
33
|
-
222, 136, 26, 167, 246, 163, 233, 216, 206, 122, 106, 141, 43, 143, 137, 3, 88, 196,
|
34
|
-
235, 161, 2, 33, 0, 143, 213, 54, 244, 194, 216, 188, 161, 77, 28, 87, 205, 16, 160,
|
35
|
-
11, 125, 21, 62, 206, 233, 242, 201, 149, 152, 53, 25, 103, 6, 4, 56, 193, 161] }
|
36
|
-
let(:signature_bytes) { [39, 115, 251, 5, 254, 60, 42, 53, 128, 68, 123, 82, 222, 136,
|
37
|
-
26, 167, 246, 163, 233, 216, 206, 122, 106, 141, 43, 143, 137, 3, 88, 196, 235, 161,
|
38
|
-
143, 213, 54, 244, 194, 216, 188, 161, 77, 28, 87, 205, 16, 160, 11, 125, 21, 62,
|
39
|
-
206, 233, 242, 201, 149, 152, 53, 25, 103, 6, 4, 56, 193, 161] }
|
40
|
-
let(:signature_byte_count) { 64 }
|
41
|
-
it_behaves_like '#der_to_signature'
|
42
|
-
it_behaves_like '#signature_to_der'
|
43
|
-
it_behaves_like 'w/o valid signature'
|
44
|
-
|
45
|
-
describe 'invalid sha_bits' do
|
46
|
-
let(:invalid_sha_bits) { '257' }
|
47
|
-
it '#der_to_signature raises' do
|
48
|
-
expect { Asn1.der_to_signature(der, invalid_sha_bits) }
|
49
|
-
.to raise_error(RuntimeError, 'Invalid sha_bits')
|
50
|
-
end
|
51
|
-
|
52
|
-
it '#signature_to_der raises' do
|
53
|
-
expect { Asn1.signature_to_der(signature, invalid_sha_bits) }
|
54
|
-
.to raise_error(RuntimeError, 'Invalid sha_bits')
|
55
|
-
end
|
56
|
-
end
|
57
|
-
end
|
58
|
-
|
59
|
-
context 'for ES384' do
|
60
|
-
let(:sha_bits) { '384' }
|
61
|
-
let(:der_bytes) { [48, 101, 2, 48, 22, 221, 123, 224, 5, 100, 163, 31, 98, 78, 240,
|
62
|
-
249, 85, 126, 120, 130, 228, 123, 69, 2, 21, 65, 249, 229, 151, 208, 186, 162, 31,
|
63
|
-
149, 42, 165, 134, 214, 197, 176, 120, 10, 205, 247, 176, 19, 2, 156, 112, 89, 58,
|
64
|
-
234, 2, 49, 0, 255, 43, 120, 92, 206, 84, 88, 29, 109, 225, 254, 162, 37, 255, 127,
|
65
|
-
231, 37, 178, 36, 173, 225, 201, 121, 154, 43, 122, 229, 114, 50, 83, 69, 243, 143,
|
66
|
-
248, 89, 109, 136, 233, 223, 148, 137, 226, 96, 78, 166, 141, 222, 236] }
|
67
|
-
let(:signature_bytes) { [22, 221, 123, 224, 5, 100, 163, 31, 98, 78, 240, 249, 85,
|
68
|
-
126, 120, 130, 228, 123, 69, 2, 21, 65, 249, 229, 151, 208, 186, 162, 31, 149, 42,
|
69
|
-
165, 134, 214, 197, 176, 120, 10, 205, 247, 176, 19, 2, 156, 112, 89, 58, 234, 255,
|
70
|
-
43, 120, 92, 206, 84, 88, 29, 109, 225, 254, 162, 37, 255, 127, 231, 37, 178, 36,
|
71
|
-
173, 225, 201, 121, 154, 43, 122, 229, 114, 50, 83, 69, 243, 143, 248, 89, 109, 136,
|
72
|
-
233, 223, 148, 137, 226, 96, 78, 166, 141, 222, 236] }
|
73
|
-
let(:signature_byte_count) { 96 }
|
74
|
-
it_behaves_like '#der_to_signature'
|
75
|
-
it_behaves_like '#signature_to_der'
|
76
|
-
it_behaves_like 'w/o valid signature'
|
77
|
-
end
|
78
|
-
|
79
|
-
context 'for ES512' do
|
80
|
-
let(:sha_bits) { '512' }
|
81
|
-
let(:der_bytes) { [48, 129, 135, 2, 66, 0, 173, 236, 131, 242, 12, 189, 123, 8, 129,
|
82
|
-
2, 239, 202, 73, 168, 134, 216, 173, 241, 30, 1, 216, 177, 69, 61, 2, 196, 126, 145,
|
83
|
-
132, 172, 174, 210, 133, 191, 50, 57, 239, 229, 201, 118, 197, 62, 197, 62, 128,
|
84
|
-
143, 82, 84, 251, 80, 18, 196, 194, 198, 62, 144, 16, 149, 26, 67, 3, 215, 235, 179,
|
85
|
-
146, 2, 65, 40, 137, 198, 254, 15, 50, 214, 252, 43, 65, 203, 163, 140, 204, 66,
|
86
|
-
159, 53, 125, 184, 29, 24, 189, 249, 21, 64, 109, 87, 100, 165, 139, 83, 129, 190,
|
87
|
-
121, 180, 86, 241, 83, 238, 39, 63, 25, 247, 253, 130, 153, 47, 27, 138, 164, 221,
|
88
|
-
25, 151, 135, 144, 84, 240, 46, 59, 94, 99, 147, 138, 103, 67] }
|
89
|
-
let(:signature_bytes) { [0, 173, 236, 131, 242, 12, 189, 123, 8, 129, 2, 239, 202, 73,
|
90
|
-
168, 134, 216, 173, 241, 30, 1, 216, 177, 69, 61, 2, 196, 126, 145, 132, 172, 174,
|
91
|
-
210, 133, 191, 50, 57, 239, 229, 201, 118, 197, 62, 197, 62, 128, 143, 82, 84, 251,
|
92
|
-
80, 18, 196, 194, 198, 62, 144, 16, 149, 26, 67, 3, 215, 235, 179, 146, 0, 40, 137,
|
93
|
-
198, 254, 15, 50, 214, 252, 43, 65, 203, 163, 140, 204, 66, 159, 53, 125, 184, 29,
|
94
|
-
24, 189, 249, 21, 64, 109, 87, 100, 165, 139, 83, 129, 190, 121, 180, 86, 241, 83,
|
95
|
-
238, 39, 63, 25, 247, 253, 130, 153, 47, 27, 138, 164, 221, 25, 151, 135, 144, 84,
|
96
|
-
240, 46, 59, 94, 99, 147, 138, 103, 67] }
|
97
|
-
let(:signature_byte_count) { 132 }
|
98
|
-
it_behaves_like '#der_to_signature'
|
99
|
-
it_behaves_like '#signature_to_der'
|
100
|
-
it_behaves_like 'w/o valid signature'
|
101
|
-
end
|
102
|
-
end
|
103
|
-
end
|
104
|
-
end
|
105
|
-
end
|