json_web_token 0.3.1 → 0.3.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/.rspec +0 -1
- data/.travis.yml +5 -5
- data/CHANGELOG.md +17 -10
- data/Gemfile +1 -4
- data/LICENSE.md +9 -0
- data/README.md +26 -10
- data/Rakefile +10 -0
- data/bin/console +10 -0
- data/bin/setup +8 -0
- data/json_web_token.gemspec +30 -15
- data/lib/json_web_token/version.rb +1 -1
- metadata +109 -31
- data/LICENSE +0 -21
- data/spec/fixtures/rsa/private_key.pem +0 -27
- data/spec/fixtures/rsa/private_key_weak.pem +0 -27
- data/spec/fixtures/rsa/public_key.pem +0 -9
- data/spec/fixtures/rsa/public_key_alt.pem +0 -9
- data/spec/json_web_token/algorithm/ecdsa_spec.rb +0 -56
- data/spec/json_web_token/algorithm/hmac_spec.rb +0 -127
- data/spec/json_web_token/algorithm/rsa_spec.rb +0 -126
- data/spec/json_web_token/format/asn1_spec.rb +0 -105
- data/spec/json_web_token/format/base64_url_spec.rb +0 -84
- data/spec/json_web_token/jwa_spec.rb +0 -71
- data/spec/json_web_token/jws_spec.rb +0 -119
- data/spec/json_web_token/jwt_spec.rb +0 -142
- data/spec/json_web_token/util_spec.rb +0 -24
- data/spec/json_web_token_spec.rb +0 -47
- data/spec/spec_helper.rb +0 -85
- data/spec/support/ecdsa_key.rb +0 -30
- data/spec/support/plausible_jwt.rb +0 -15
data/LICENSE
DELETED
@@ -1,21 +0,0 @@
|
|
1
|
-
The MIT License (MIT)
|
2
|
-
|
3
|
-
Copyright (c) 2015 Gary Fleshman
|
4
|
-
|
5
|
-
Permission is hereby granted, free of charge, to any person obtaining a copy
|
6
|
-
of this software and associated documentation files (the "Software"), to deal
|
7
|
-
in the Software without restriction, including without limitation the rights
|
8
|
-
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
9
|
-
copies of the Software, and to permit persons to whom the Software is
|
10
|
-
furnished to do so, subject to the following conditions:
|
11
|
-
|
12
|
-
The above copyright notice and this permission notice shall be included in
|
13
|
-
all copies or substantial portions of the Software.
|
14
|
-
|
15
|
-
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
16
|
-
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
17
|
-
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
18
|
-
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
19
|
-
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
20
|
-
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
|
21
|
-
THE SOFTWARE.
|
@@ -1,27 +0,0 @@
|
|
1
|
-
-----BEGIN RSA PRIVATE KEY-----
|
2
|
-
MIIEpAIBAAKCAQEAruE38DIgPqG4sJeFfXDS80BZdCoQRakRmKfkoOq26BaCerNK
|
3
|
-
IsMV1zMCnFWh/c3ax7iWXMbIrUIixDxAjOe/smzRCaT9rL6Jz235dbYX81mdGPUA
|
4
|
-
/PqzgwbfYnoKf9tDrUWDG0oU9WN/HJDY+1lKFW3sG29ENsLn7ezJOP8d7y1mIocg
|
5
|
-
l94dfKKaPlM3NECPObXGbJWyPsIlYrgCBKwdH6zHfKFeDDawsagtK7MZfzVfh/bI
|
6
|
-
JzL+84oCOUn75pXwl5JKOLaudYuHFNNGe4XCma+l0BEyfIAykIm2V5tL2zUaEPm6
|
7
|
-
Mh8r70nEeLtEDUgbVXk6OoEVfbEksvRfEaxPUQIDAQABAoIBAE2n+R0SRTtKuSbB
|
8
|
-
widX6HTYSGDLJPqp/wRY2a+TSrF4/WvbHbqeAp7TKf+eDxcTSGmT0EFWjFpTmfim
|
9
|
-
AMwRRRDIPXMY7wS8f5m67iGVQMFxM8+XTF8KPJicfqnOI8du6HiS+4sstG3bRuC6
|
10
|
-
eX/zwHAPpd7w48uldTQ0B47lyrcgJ8ZaKdA7BZRzxSojSrCmosajoOoAqRUKj9Bw
|
11
|
-
CcDVmZOrgd0z2spNsP/h1u8tyKNc55QtY7AbhiuJ7Eo99Fob78xH7pKgZk10MqLX
|
12
|
-
xWB0x5yKAptJ5O/cGkHwJ0CNP+/bWN4tRPJLd7q+lTDvBf40ix3UJ8xq2MItJoIo
|
13
|
-
4ysKplkCgYEA22tUs30r8qtQwzkTnwKnnNtHQbCVNx79PbQiSVeg1OFULBJ9Q5JB
|
14
|
-
tScgTeINvjeYvFk5yguy25dUZfpLy8tR2mziGy023LTfnPM7ldsFsoXgW+TimQhd
|
15
|
-
xn4aizgLk4F+jmX+Ga/YJllSUBmzgHtrJxFyFgfprlCWY8Oy6ayQvLMCgYEAzAj4
|
16
|
-
nPjf0tIU+HLVQNxzq+6EaJIdsaF4VNtuc5RUyIpN7ptnm+Qp1sZgMTFuZY/NGUJd
|
17
|
-
JUHF2598P7izf8k1U55CzHt9WR3gXADiDgubWXKJC9aO67RXQPfUX0f8g0MBpRyr
|
18
|
-
aMb1P3vEeEN6Mz2+rpxRQ+VMZHm03WgXfKTeDesCgYBw13nv9OetHT2jqK7Wj97z
|
19
|
-
ZDH5Ln8OoflKymD3pwEnedp37+pL3eO87ipG44J92MnL03dM2UdadzEIYPiqDh5C
|
20
|
-
XszJfS9BwiNd7BkwsDr13LPNjqCaYxsXAbNU9bW+XlJfmURcoXpf/n++gfk2kkJB
|
21
|
-
DU/G1Lrw0rEFDZftZLnq0QKBgQC4vsLF939K+Bgu4mN/6F0AZ+cSfINQjKFVTJ8V
|
22
|
-
HlEqiDiKfcJx4EWWCGefA2Avq+aNIY8Pph+OfjlVxVsasMiNXzaiyoo0QB4fkFkf
|
23
|
-
WJkgg9ndkzgz6kY7OGvenmLhQ7HgnDYEmGoGQn4iWw7yCM14c2gN7zidnaoL9C2Y
|
24
|
-
GfxKYwKBgQCvOp4mlfL176dKrCjOxVFqnpXMCS3WqTWk5e+uR6GKcs6SvEfue0X0
|
25
|
-
B/SVRn6tyKqLp9pvM+0fEaXrspZmgoedmiPY3V7Am5bdMOltW5DMvxAAdnqjok1i
|
26
|
-
q2O8Of/DTt2bn3nu8IZDeHrKebx8z/CG9rQK4x5fT1HcwAgroYG0bQ==
|
27
|
-
-----END RSA PRIVATE KEY-----
|
@@ -1,27 +0,0 @@
|
|
1
|
-
-----BEGIN RSA PRIVATE KEY-----
|
2
|
-
MIIEgQIBAAKB+wDZmyrApkiH+zL7G2Gzwht9N0KbW/iJCeygAKyqHoc75nFLE4We
|
3
|
-
jxGHR4RlIg9kYn1Qbm7Yl5/ASFIE//vMjqyJJ5GqoeVAKZfAp4NFKd99Ja5z1pIW
|
4
|
-
/hh4n2fswF9VYRsuCC0nmDQ9XNUZunXVJPJwOZ3RlWkE1yIbU1Ianr+Y81SkF6bp
|
5
|
-
pT/ucmA52RbVImoDoxztu0OK7CQ/yE3+gvHSwLaRE3/s5NpGhOPj3XoumMZoyAyb
|
6
|
-
rWlBCadAoaaaPAZx460xTP+I6n6CDM6/6uPazaRbOVxChIgiOxpPU39aNKwbB/iN
|
7
|
-
7LOuiSO1mStLXVTVpCsQukJa6GBPAgMBAAECgfo4oBYp95tcN1P24BM2kcZReTXN
|
8
|
-
88ri7kAzCrnjsvoB7l+A592XeydWipe7MXfL6Y0uhu41Uo9xm+AsCOjfPClNr4xK
|
9
|
-
WMKtRaWFrpGMR+8uQ8X3wthVP13i1ahXhV/JefF2sw39BbBiX2vcvBa5llm4NmYJ
|
10
|
-
CdZAOjNX5QCyiC3qDkYrQnY3c8ccWA+SdrZylRRBufzKxbp0HPU7NpQJmKGrORTd
|
11
|
-
lkYgXKI7QPMQ1/LgaVtEbG77MYbmzt0PAw6w5nQlwF8G9hV37Y6xanpg3EobOih2
|
12
|
-
qM/qmWRyg417h1VTMxVQLNf53f9P/nzRnSQK79ZDzPmSyI+ww0kRAn4A9TjM/51r
|
13
|
-
c/1IlFrWpo3NlsepGBmyX0DUNWuZOhA4Z2z7+GyAokF0LacFRyQNxzwFLAuMargm
|
14
|
-
WMgAKNs3LaZxrsWNCbyUCv2vyGSREsFJtXRIs2jBE4TUycOZvtgD32Y0EeKknc9y
|
15
|
-
RCT/kPSkKj/QDB8vsRaUql7829uuVAsCfgDjK6NPv8fTyLITPeCJoOcCa4LDr6nZ
|
16
|
-
vB21FCJom2eumrQ6lHkuLiFh2E+E2ICvKuCBaNi5g01wV6WnjJ1Ou3r33Ig+H6wX
|
17
|
-
La7cr0bq+QlLQy/woBlrgevIseAVKFnBe/rB8RY3vLTV53DLsRIlUjW3r0Hi+ovN
|
18
|
-
6ky/6dnrTQJ9cHBk/ufNd1exyeSE+8WVeQd/rz9JHIf7RatajNcXJcVBG72UldFx
|
19
|
-
VeV5dA9CChKpRHLfJafeXWMHP7SUbmgdREfszYQcVZXQ3g/OvUzHYV46X5kuvqZv
|
20
|
-
czwu6OTfkbWpNnI3jOyrtjdIv8yM4Zp06Ln8AjUaYaxAQQdPvdUCfgC6qdHQptpw
|
21
|
-
6HmCnBaToFYRw/u4BfDAC/YxI7E+WWvxqgcsF3IXgypE9vQoSao7xTSiwV9L2Fta
|
22
|
-
U3q32TAtUJozbs+4lFfY193WUmQokaeUY0nSJAufLitrRtXFLNnLxa7/i7Vg6TuC
|
23
|
-
hGFHzmEFr66aF3VBJ/SWp86W53X8BQJ9R6IhbZpxnGW3TbcgP5R7xVBcas+ypYn6
|
24
|
-
CEV22CzMDSE21Zek/q0N65im9QJgHrtLXSrb6DVOJF6lp8pm3yO+UXsaMTldysvo
|
25
|
-
H7sN9CzhhQNpSwFp4dvYQBi6pIQGsit6lbOj5wkE3PeRsusO6pcIli2w2MzgPjxn
|
26
|
-
OERK2BM=
|
27
|
-
-----END RSA PRIVATE KEY-----
|
@@ -1,9 +0,0 @@
|
|
1
|
-
-----BEGIN PUBLIC KEY-----
|
2
|
-
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAruE38DIgPqG4sJeFfXDS
|
3
|
-
80BZdCoQRakRmKfkoOq26BaCerNKIsMV1zMCnFWh/c3ax7iWXMbIrUIixDxAjOe/
|
4
|
-
smzRCaT9rL6Jz235dbYX81mdGPUA/PqzgwbfYnoKf9tDrUWDG0oU9WN/HJDY+1lK
|
5
|
-
FW3sG29ENsLn7ezJOP8d7y1mIocgl94dfKKaPlM3NECPObXGbJWyPsIlYrgCBKwd
|
6
|
-
H6zHfKFeDDawsagtK7MZfzVfh/bIJzL+84oCOUn75pXwl5JKOLaudYuHFNNGe4XC
|
7
|
-
ma+l0BEyfIAykIm2V5tL2zUaEPm6Mh8r70nEeLtEDUgbVXk6OoEVfbEksvRfEaxP
|
8
|
-
UQIDAQAB
|
9
|
-
-----END PUBLIC KEY-----
|
@@ -1,9 +0,0 @@
|
|
1
|
-
-----BEGIN PUBLIC KEY-----
|
2
|
-
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEApcDymjKwuWwyq9Zyt7EF
|
3
|
-
epTHzyvO875ioqDoMtCNhADrjLU25vaAaCyyf035VoXl/HYaUj0tBiEvQreso98O
|
4
|
-
eGO6cnfnu/QBvd1veyKtA8EjHFeo7NeA/RdXj6sEWtdM+QVHy6yI8YS/WAu8Ubrb
|
5
|
-
MNeDk4dEmfvvgL9TxNAYuVlWcLuR1fEyNN4NsansHZtoBCf6lRhd6l9uvu1HZJJ/
|
6
|
-
UrOostwH5jgnI3rWS2fB9SU7G5l9+YS7NbNGxa4kE6x72ko5WPg1U+wch94rZhxT
|
7
|
-
XBJDipRIox83wEQEP0qH8IWC905CmnYqfZ7HMdGt7KWvg/svO/q4oRtCb5NDEDGL
|
8
|
-
6QIDAQAB
|
9
|
-
-----END PUBLIC KEY-----
|
@@ -1,56 +0,0 @@
|
|
1
|
-
require 'json_web_token/algorithm/ecdsa'
|
2
|
-
require 'support/ecdsa_key'
|
3
|
-
|
4
|
-
module JsonWebToken
|
5
|
-
module Algorithm
|
6
|
-
describe Ecdsa do
|
7
|
-
let(:signing_input_0) { '{"iss":"joe","exp":1300819380,"http://example.com/is_root":true}' }
|
8
|
-
let(:signing_input_1) { '{"iss":"mike","exp":1300819380,"http://example.com/is_root":false}' }
|
9
|
-
describe 'detect changed signature or data' do
|
10
|
-
shared_examples_for '#sign' do
|
11
|
-
it 'does #verify?' do
|
12
|
-
private_key_0 = EcdsaKey.curve_new(sha_bits)
|
13
|
-
public_key_str_0 = EcdsaKey.public_key_str(private_key_0)
|
14
|
-
public_key_0 = EcdsaKey.public_key_new(sha_bits, public_key_str_0)
|
15
|
-
|
16
|
-
mac_0 = Ecdsa.sign(sha_bits, private_key_0, signing_input_0)
|
17
|
-
expect(mac_0.bytes.count).to eql expected_mac_byte_count
|
18
|
-
expect(Ecdsa.verify? mac_0, sha_bits, public_key_0, signing_input_0).to be true
|
19
|
-
|
20
|
-
private_key_1 = EcdsaKey.curve_new(sha_bits)
|
21
|
-
public_key_str_1 = EcdsaKey.public_key_str(private_key_1)
|
22
|
-
public_key_1 = EcdsaKey.public_key_new(sha_bits, public_key_str_1)
|
23
|
-
|
24
|
-
expect(Ecdsa.verify? mac_0, sha_bits, public_key_0, signing_input_1).to be false
|
25
|
-
expect(Ecdsa.verify? mac_0, sha_bits, public_key_1, signing_input_0).to be false
|
26
|
-
expect(Ecdsa.verify? mac_0, sha_bits, public_key_1, signing_input_1).to be false
|
27
|
-
|
28
|
-
mac_1 = Ecdsa.sign(sha_bits, private_key_1, signing_input_1)
|
29
|
-
expect(Ecdsa.verify? mac_1, sha_bits, public_key_0, signing_input_0).to be false
|
30
|
-
expect(Ecdsa.verify? mac_1, sha_bits, public_key_0, signing_input_1).to be false
|
31
|
-
expect(Ecdsa.verify? mac_1, sha_bits, public_key_1, signing_input_0).to be false
|
32
|
-
expect(Ecdsa.verify? mac_1, sha_bits, public_key_1, signing_input_1).to be true
|
33
|
-
end
|
34
|
-
end
|
35
|
-
|
36
|
-
describe 'ES256' do
|
37
|
-
let(:sha_bits) { '256' }
|
38
|
-
let(:expected_mac_byte_count) { 64 }
|
39
|
-
it_behaves_like '#sign'
|
40
|
-
end
|
41
|
-
|
42
|
-
describe 'ES384' do
|
43
|
-
let(:sha_bits) { '384' }
|
44
|
-
let(:expected_mac_byte_count) { 96 }
|
45
|
-
it_behaves_like '#sign'
|
46
|
-
end
|
47
|
-
|
48
|
-
describe 'ES512' do
|
49
|
-
let(:sha_bits) { '512' }
|
50
|
-
let(:expected_mac_byte_count) { 132 }
|
51
|
-
it_behaves_like '#sign'
|
52
|
-
end
|
53
|
-
end
|
54
|
-
end
|
55
|
-
end
|
56
|
-
end
|
@@ -1,127 +0,0 @@
|
|
1
|
-
require 'json_web_token/algorithm/hmac'
|
2
|
-
|
3
|
-
module JsonWebToken
|
4
|
-
module Algorithm
|
5
|
-
describe Hmac do
|
6
|
-
let(:signing_input_0) { '{"iss":"joe","exp":1300819380,"http://example.com/is_root":true}' }
|
7
|
-
let(:signing_input_1) { '{"iss":"mike","exp":1300819380,"http://example.com/is_root":false}' }
|
8
|
-
context 'detect changed signing_input or MAC' do
|
9
|
-
shared_examples_for '#sign' do
|
10
|
-
it 'does #verify?' do
|
11
|
-
mac = Hmac.sign(sha_bits, shared_key, signing_input_0)
|
12
|
-
expect(Hmac.verify? mac, sha_bits, shared_key, signing_input_0).to be true
|
13
|
-
expect(Hmac.verify? mac, sha_bits, shared_key, signing_input_1).to be false
|
14
|
-
|
15
|
-
changed_mac = Hmac.sign(sha_bits, shared_key, signing_input_1)
|
16
|
-
expect(Hmac.verify? changed_mac, sha_bits, shared_key, signing_input_0).to be false
|
17
|
-
end
|
18
|
-
end
|
19
|
-
|
20
|
-
describe 'HS256' do
|
21
|
-
let(:sha_bits) { '256' }
|
22
|
-
let(:shared_key) { 'gZH75aKtMN3Yj0iPS4hcgUuTwjAzZr9C' }
|
23
|
-
it_behaves_like '#sign'
|
24
|
-
end
|
25
|
-
|
26
|
-
describe 'HS384' do
|
27
|
-
let(:sha_bits) { '384' }
|
28
|
-
let(:shared_key) { 'AyM1SysPpbyDfgZld3umj1qzKObwVMkoqQ-EstJQLr_T-1qS' }
|
29
|
-
it_behaves_like '#sign'
|
30
|
-
end
|
31
|
-
|
32
|
-
describe 'HS512' do
|
33
|
-
let(:sha_bits) { '512' }
|
34
|
-
let(:shared_key) { 'ysPpbyDfgZld3umj1qzKObwVMkoqQ-EstJQLr_T-1qS0gZH75aKtMN3Yj0iPS4hc' }
|
35
|
-
it_behaves_like '#sign'
|
36
|
-
end
|
37
|
-
end
|
38
|
-
|
39
|
-
describe 'changed key' do
|
40
|
-
let(:sha_bits) { '256' }
|
41
|
-
let(:shared_key) { 'gZH75aKtMN3Yj0iPS4hcgUuTwjAzZr9C' }
|
42
|
-
let(:changed_key) { 'gZH75aKtMN3Yj0iPS4hcgUuTwjAzZr9Z' }
|
43
|
-
it 'fails to #verify?' do
|
44
|
-
mac = Hmac.sign(sha_bits, shared_key, signing_input_0)
|
45
|
-
expect(Hmac.verify? mac, sha_bits, shared_key, signing_input_0).to be true
|
46
|
-
expect(Hmac.verify? mac, sha_bits, changed_key, signing_input_0).to be false
|
47
|
-
end
|
48
|
-
end
|
49
|
-
|
50
|
-
context 'param validation' do
|
51
|
-
shared_examples_for 'invalid key' do
|
52
|
-
it 'raises' do
|
53
|
-
expect { Hmac.sign(sha_bits, shared_key, signing_input_0) }
|
54
|
-
.to raise_error(RuntimeError, 'Invalid shared key')
|
55
|
-
end
|
56
|
-
end
|
57
|
-
|
58
|
-
context 'w 256 sha_bits' do
|
59
|
-
let(:sha_bits) { '256' }
|
60
|
-
describe 'shared_key nil' do
|
61
|
-
let(:shared_key) { nil }
|
62
|
-
it_behaves_like 'invalid key'
|
63
|
-
end
|
64
|
-
|
65
|
-
describe "shared_key 'empty string'" do
|
66
|
-
let(:shared_key) { '' }
|
67
|
-
it_behaves_like 'invalid key'
|
68
|
-
end
|
69
|
-
|
70
|
-
describe 'shared_key length (31) < MAC length (32)' do
|
71
|
-
let(:shared_key) { 'gZH75aKtMN3Yj0iPS4hcgUuTwjAzZr9' }
|
72
|
-
it_behaves_like 'invalid key'
|
73
|
-
end
|
74
|
-
|
75
|
-
describe 'shared_key length (32) == MAC length (32)' do
|
76
|
-
let(:shared_key) { 'gZH75aKtMN3Yj0iPS4hcgUuTwjAzZr9C' }
|
77
|
-
it 'returns a 32-byte MAC string' do
|
78
|
-
mac = Hmac.sign(sha_bits, shared_key, signing_input_0)
|
79
|
-
expect(mac.bytesize).to eql 32
|
80
|
-
end
|
81
|
-
end
|
82
|
-
end
|
83
|
-
|
84
|
-
context 'w 384 sha_bits' do
|
85
|
-
let(:sha_bits) { '384' }
|
86
|
-
describe 'shared_key length (47) < MAC length (48)' do
|
87
|
-
let(:shared_key) { 'AyM1SysPpbyDfgZld3umj1qzKObwVMkoqQ-EstJQLr_T-1q' }
|
88
|
-
it_behaves_like 'invalid key'
|
89
|
-
end
|
90
|
-
|
91
|
-
describe 'shared_key length (48) == MAC length (48)' do
|
92
|
-
let(:shared_key) { 'AyM1SysPpbyDfgZld3umj1qzKObwVMkoqQ-EstJQLr_T-1qS' }
|
93
|
-
it 'returns a 48-byte MAC string' do
|
94
|
-
mac = Hmac.sign(sha_bits, shared_key, signing_input_0)
|
95
|
-
expect(mac.bytesize).to eql 48
|
96
|
-
end
|
97
|
-
end
|
98
|
-
end
|
99
|
-
|
100
|
-
context 'w 512 sha_bits' do
|
101
|
-
let(:sha_bits) { '512' }
|
102
|
-
describe 'shared_key length (63) < MAC length (64)' do
|
103
|
-
let(:shared_key) { 'ysPpbyDfgZld3umj1qzKObwVMkoqQ-EstJQLr_T-1qS0gZH75aKtMN3Yj0iPS4h' }
|
104
|
-
it_behaves_like 'invalid key'
|
105
|
-
end
|
106
|
-
|
107
|
-
describe 'shared_key length (64) == MAC length (64)' do
|
108
|
-
let(:shared_key) { 'ysPpbyDfgZld3umj1qzKObwVMkoqQ-EstJQLr_T-1qS0gZH75aKtMN3Yj0iPS4hc' }
|
109
|
-
it 'returns a 64-byte MAC string' do
|
110
|
-
mac = Hmac.sign(sha_bits, shared_key, signing_input_0)
|
111
|
-
expect(mac.bytesize).to eql 64
|
112
|
-
end
|
113
|
-
end
|
114
|
-
end
|
115
|
-
|
116
|
-
describe 'w unrecognized sha_bits' do
|
117
|
-
let(:sha_bits) { '257' }
|
118
|
-
let(:shared_key) { 'ysPpbyDfgZld3umj1qzKObwVMkoqQ-EstJQLr_T-1qS0gZH75aKtMN3Yj0iPS4hc' }
|
119
|
-
it 'raises' do
|
120
|
-
expect { Hmac.sign(sha_bits, shared_key, signing_input_0) }
|
121
|
-
.to raise_error(RuntimeError, 'Invalid sha_bits')
|
122
|
-
end
|
123
|
-
end
|
124
|
-
end
|
125
|
-
end
|
126
|
-
end
|
127
|
-
end
|
@@ -1,126 +0,0 @@
|
|
1
|
-
require 'json_web_token/algorithm/rsa'
|
2
|
-
require 'json_web_token/algorithm/rsa_util'
|
3
|
-
|
4
|
-
module JsonWebToken
|
5
|
-
module Algorithm
|
6
|
-
describe Rsa do
|
7
|
-
let(:signing_input_0) { '{"iss":"joe","exp":1300819380,"http://example.com/is_root":true}' }
|
8
|
-
let(:signing_input_1) { '{"iss":"mike","exp":1300819380,"http://example.com/is_root":false}' }
|
9
|
-
let(:path_to_keys) { 'spec/fixtures/rsa' }
|
10
|
-
context 'detect changed signing_input or MAC' do
|
11
|
-
let(:private_key) { RsaUtil.private_key(path_to_keys) }
|
12
|
-
let(:public_key) { RsaUtil.public_key(path_to_keys) }
|
13
|
-
shared_examples_for '#sign' do
|
14
|
-
it 'does #verify?' do
|
15
|
-
mac = Rsa.sign(sha_bits, private_key, signing_input_0)
|
16
|
-
expect(Rsa.verify? mac, sha_bits, public_key, signing_input_0).to be true
|
17
|
-
expect(Rsa.verify? mac, sha_bits, public_key, signing_input_1).to be false
|
18
|
-
|
19
|
-
changed_mac = Rsa.sign(sha_bits, private_key, signing_input_1)
|
20
|
-
expect(Rsa.verify? changed_mac, sha_bits, public_key, signing_input_0).to be false
|
21
|
-
end
|
22
|
-
end
|
23
|
-
|
24
|
-
context 'RS256' do
|
25
|
-
let(:sha_bits) { '256' }
|
26
|
-
it_behaves_like '#sign'
|
27
|
-
|
28
|
-
describe 'changed key' do
|
29
|
-
let(:changed_public_key) { RsaUtil.public_key(path_to_keys, 'public_key_alt.pem') }
|
30
|
-
it 'fails to #verify?' do
|
31
|
-
mac = Rsa.sign(sha_bits, private_key, signing_input_0)
|
32
|
-
expect(Rsa.verify? mac, sha_bits, public_key, signing_input_0).to be true
|
33
|
-
expect(Rsa.verify? mac, sha_bits, changed_public_key, signing_input_0).to be false
|
34
|
-
end
|
35
|
-
end
|
36
|
-
end
|
37
|
-
|
38
|
-
describe 'RS384' do
|
39
|
-
let(:sha_bits) { '384' }
|
40
|
-
it_behaves_like '#sign'
|
41
|
-
end
|
42
|
-
|
43
|
-
describe 'RS512' do
|
44
|
-
let(:sha_bits) { '512' }
|
45
|
-
it_behaves_like '#sign'
|
46
|
-
end
|
47
|
-
end
|
48
|
-
|
49
|
-
context 'param validation' do
|
50
|
-
shared_examples_for 'invalid private_key' do
|
51
|
-
it 'raises' do
|
52
|
-
expect { Rsa.sign(sha_bits, private_key, signing_input_0) }
|
53
|
-
.to raise_error(RuntimeError, 'Invalid key: RSA modulus too small')
|
54
|
-
end
|
55
|
-
end
|
56
|
-
|
57
|
-
context 'private_key bit size < KEY_BITS_MIN (2048)' do
|
58
|
-
let(:private_key) { RsaUtil.private_key(path_to_keys, 'private_key_weak.pem') }
|
59
|
-
describe 'w 256 sha_bits' do
|
60
|
-
let(:sha_bits) { '256' }
|
61
|
-
it_behaves_like 'invalid private_key'
|
62
|
-
end
|
63
|
-
|
64
|
-
describe 'w 384 sha_bits' do
|
65
|
-
let(:sha_bits) { '384' }
|
66
|
-
it_behaves_like 'invalid private_key'
|
67
|
-
end
|
68
|
-
|
69
|
-
describe 'w 512 sha_bits' do
|
70
|
-
let(:sha_bits) { '512' }
|
71
|
-
it_behaves_like 'invalid private_key'
|
72
|
-
end
|
73
|
-
end
|
74
|
-
|
75
|
-
shared_examples_for '2048 bit private_key' do
|
76
|
-
it 'returns a 256-byte MAC string' do
|
77
|
-
mac = Rsa.sign(sha_bits, private_key, signing_input_0)
|
78
|
-
expect(mac.bytesize).to eql 256
|
79
|
-
end
|
80
|
-
end
|
81
|
-
|
82
|
-
context 'private_key bits (2048) == KEY_BITS_MIN (2048)' do
|
83
|
-
let(:private_key) { RsaUtil.private_key(path_to_keys) }
|
84
|
-
describe 'w 256 sha_bits' do
|
85
|
-
let(:sha_bits) { '256' }
|
86
|
-
it_behaves_like '2048 bit private_key'
|
87
|
-
end
|
88
|
-
|
89
|
-
describe 'w 384 sha_bits' do
|
90
|
-
let(:sha_bits) { '384' }
|
91
|
-
it_behaves_like '2048 bit private_key'
|
92
|
-
end
|
93
|
-
|
94
|
-
describe 'w 512 sha_bits' do
|
95
|
-
let(:sha_bits) { '512' }
|
96
|
-
it_behaves_like '2048 bit private_key'
|
97
|
-
end
|
98
|
-
end
|
99
|
-
|
100
|
-
context 'blank private_key' do
|
101
|
-
let(:sha_bits) { '256' }
|
102
|
-
describe 'nil' do
|
103
|
-
let(:private_key) { nil }
|
104
|
-
it_behaves_like 'invalid private_key'
|
105
|
-
end
|
106
|
-
|
107
|
-
describe 'empty string' do
|
108
|
-
let(:private_key) { '' }
|
109
|
-
it 'raises' do
|
110
|
-
expect { Rsa.sign(sha_bits, private_key, signing_input_0) }.to raise_error(NoMethodError)
|
111
|
-
end
|
112
|
-
end
|
113
|
-
end
|
114
|
-
|
115
|
-
describe 'w unrecognized sha_bits' do
|
116
|
-
let(:sha_bits) { '257' }
|
117
|
-
let(:private_key) { 'private_key' }
|
118
|
-
it 'raises' do
|
119
|
-
expect { Rsa.sign(sha_bits, private_key, signing_input_0) }
|
120
|
-
.to raise_error(RuntimeError, 'Invalid sha_bits')
|
121
|
-
end
|
122
|
-
end
|
123
|
-
end
|
124
|
-
end
|
125
|
-
end
|
126
|
-
end
|
@@ -1,105 +0,0 @@
|
|
1
|
-
require 'json_web_token/format/asn1'
|
2
|
-
|
3
|
-
module JsonWebToken
|
4
|
-
module Format
|
5
|
-
describe Asn1 do
|
6
|
-
context 'w bytes' do
|
7
|
-
let(:der) { der_bytes.map(&:chr).join }
|
8
|
-
let(:signature) { signature_bytes.map(&:chr).join }
|
9
|
-
shared_examples_for '#der_to_signature' do
|
10
|
-
it 'converts' do
|
11
|
-
expect(signature.bytes.length).to eql signature_byte_count
|
12
|
-
expect(Asn1.der_to_signature(der, sha_bits).bytes).to eql signature_bytes
|
13
|
-
end
|
14
|
-
end
|
15
|
-
|
16
|
-
shared_examples_for '#signature_to_der' do
|
17
|
-
it 'converts' do
|
18
|
-
expect(Asn1.signature_to_der(signature, sha_bits).bytes).to eql der_bytes
|
19
|
-
end
|
20
|
-
end
|
21
|
-
|
22
|
-
shared_examples_for 'w/o valid signature' do
|
23
|
-
let(:signature_invalid) { (signature_bytes + [123]).map(&:chr).join }
|
24
|
-
it '#signature_to_der raises' do
|
25
|
-
expect { Asn1.signature_to_der(signature_invalid, sha_bits) }
|
26
|
-
.to raise_error(RuntimeError, 'Invalid signature length')
|
27
|
-
end
|
28
|
-
end
|
29
|
-
|
30
|
-
context 'for ES256' do
|
31
|
-
let(:sha_bits) { '256' }
|
32
|
-
let(:der_bytes) { [48, 69, 2, 32, 39, 115, 251, 5, 254, 60, 42, 53, 128, 68, 123, 82,
|
33
|
-
222, 136, 26, 167, 246, 163, 233, 216, 206, 122, 106, 141, 43, 143, 137, 3, 88, 196,
|
34
|
-
235, 161, 2, 33, 0, 143, 213, 54, 244, 194, 216, 188, 161, 77, 28, 87, 205, 16, 160,
|
35
|
-
11, 125, 21, 62, 206, 233, 242, 201, 149, 152, 53, 25, 103, 6, 4, 56, 193, 161] }
|
36
|
-
let(:signature_bytes) { [39, 115, 251, 5, 254, 60, 42, 53, 128, 68, 123, 82, 222, 136,
|
37
|
-
26, 167, 246, 163, 233, 216, 206, 122, 106, 141, 43, 143, 137, 3, 88, 196, 235, 161,
|
38
|
-
143, 213, 54, 244, 194, 216, 188, 161, 77, 28, 87, 205, 16, 160, 11, 125, 21, 62,
|
39
|
-
206, 233, 242, 201, 149, 152, 53, 25, 103, 6, 4, 56, 193, 161] }
|
40
|
-
let(:signature_byte_count) { 64 }
|
41
|
-
it_behaves_like '#der_to_signature'
|
42
|
-
it_behaves_like '#signature_to_der'
|
43
|
-
it_behaves_like 'w/o valid signature'
|
44
|
-
|
45
|
-
describe 'invalid sha_bits' do
|
46
|
-
let(:invalid_sha_bits) { '257' }
|
47
|
-
it '#der_to_signature raises' do
|
48
|
-
expect { Asn1.der_to_signature(der, invalid_sha_bits) }
|
49
|
-
.to raise_error(RuntimeError, 'Invalid sha_bits')
|
50
|
-
end
|
51
|
-
|
52
|
-
it '#signature_to_der raises' do
|
53
|
-
expect { Asn1.signature_to_der(signature, invalid_sha_bits) }
|
54
|
-
.to raise_error(RuntimeError, 'Invalid sha_bits')
|
55
|
-
end
|
56
|
-
end
|
57
|
-
end
|
58
|
-
|
59
|
-
context 'for ES384' do
|
60
|
-
let(:sha_bits) { '384' }
|
61
|
-
let(:der_bytes) { [48, 101, 2, 48, 22, 221, 123, 224, 5, 100, 163, 31, 98, 78, 240,
|
62
|
-
249, 85, 126, 120, 130, 228, 123, 69, 2, 21, 65, 249, 229, 151, 208, 186, 162, 31,
|
63
|
-
149, 42, 165, 134, 214, 197, 176, 120, 10, 205, 247, 176, 19, 2, 156, 112, 89, 58,
|
64
|
-
234, 2, 49, 0, 255, 43, 120, 92, 206, 84, 88, 29, 109, 225, 254, 162, 37, 255, 127,
|
65
|
-
231, 37, 178, 36, 173, 225, 201, 121, 154, 43, 122, 229, 114, 50, 83, 69, 243, 143,
|
66
|
-
248, 89, 109, 136, 233, 223, 148, 137, 226, 96, 78, 166, 141, 222, 236] }
|
67
|
-
let(:signature_bytes) { [22, 221, 123, 224, 5, 100, 163, 31, 98, 78, 240, 249, 85,
|
68
|
-
126, 120, 130, 228, 123, 69, 2, 21, 65, 249, 229, 151, 208, 186, 162, 31, 149, 42,
|
69
|
-
165, 134, 214, 197, 176, 120, 10, 205, 247, 176, 19, 2, 156, 112, 89, 58, 234, 255,
|
70
|
-
43, 120, 92, 206, 84, 88, 29, 109, 225, 254, 162, 37, 255, 127, 231, 37, 178, 36,
|
71
|
-
173, 225, 201, 121, 154, 43, 122, 229, 114, 50, 83, 69, 243, 143, 248, 89, 109, 136,
|
72
|
-
233, 223, 148, 137, 226, 96, 78, 166, 141, 222, 236] }
|
73
|
-
let(:signature_byte_count) { 96 }
|
74
|
-
it_behaves_like '#der_to_signature'
|
75
|
-
it_behaves_like '#signature_to_der'
|
76
|
-
it_behaves_like 'w/o valid signature'
|
77
|
-
end
|
78
|
-
|
79
|
-
context 'for ES512' do
|
80
|
-
let(:sha_bits) { '512' }
|
81
|
-
let(:der_bytes) { [48, 129, 135, 2, 66, 0, 173, 236, 131, 242, 12, 189, 123, 8, 129,
|
82
|
-
2, 239, 202, 73, 168, 134, 216, 173, 241, 30, 1, 216, 177, 69, 61, 2, 196, 126, 145,
|
83
|
-
132, 172, 174, 210, 133, 191, 50, 57, 239, 229, 201, 118, 197, 62, 197, 62, 128,
|
84
|
-
143, 82, 84, 251, 80, 18, 196, 194, 198, 62, 144, 16, 149, 26, 67, 3, 215, 235, 179,
|
85
|
-
146, 2, 65, 40, 137, 198, 254, 15, 50, 214, 252, 43, 65, 203, 163, 140, 204, 66,
|
86
|
-
159, 53, 125, 184, 29, 24, 189, 249, 21, 64, 109, 87, 100, 165, 139, 83, 129, 190,
|
87
|
-
121, 180, 86, 241, 83, 238, 39, 63, 25, 247, 253, 130, 153, 47, 27, 138, 164, 221,
|
88
|
-
25, 151, 135, 144, 84, 240, 46, 59, 94, 99, 147, 138, 103, 67] }
|
89
|
-
let(:signature_bytes) { [0, 173, 236, 131, 242, 12, 189, 123, 8, 129, 2, 239, 202, 73,
|
90
|
-
168, 134, 216, 173, 241, 30, 1, 216, 177, 69, 61, 2, 196, 126, 145, 132, 172, 174,
|
91
|
-
210, 133, 191, 50, 57, 239, 229, 201, 118, 197, 62, 197, 62, 128, 143, 82, 84, 251,
|
92
|
-
80, 18, 196, 194, 198, 62, 144, 16, 149, 26, 67, 3, 215, 235, 179, 146, 0, 40, 137,
|
93
|
-
198, 254, 15, 50, 214, 252, 43, 65, 203, 163, 140, 204, 66, 159, 53, 125, 184, 29,
|
94
|
-
24, 189, 249, 21, 64, 109, 87, 100, 165, 139, 83, 129, 190, 121, 180, 86, 241, 83,
|
95
|
-
238, 39, 63, 25, 247, 253, 130, 153, 47, 27, 138, 164, 221, 25, 151, 135, 144, 84,
|
96
|
-
240, 46, 59, 94, 99, 147, 138, 103, 67] }
|
97
|
-
let(:signature_byte_count) { 132 }
|
98
|
-
it_behaves_like '#der_to_signature'
|
99
|
-
it_behaves_like '#signature_to_der'
|
100
|
-
it_behaves_like 'w/o valid signature'
|
101
|
-
end
|
102
|
-
end
|
103
|
-
end
|
104
|
-
end
|
105
|
-
end
|