jwe 1.0.0 → 1.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f9b0c6b1a25f2248646f35e0879debdaa3cf80983b23f5eb485bfc60c7c8c28f
-  data.tar.gz: 62b5d86d4d85130de7c4d38976678f6df8bfd31d9cdbfe00de8cfd4626052e0f
+  metadata.gz: 932d7aac27c18e27353fbe02c694c9aca3c87a4c76ede9d663f462760d6c5ada
+  data.tar.gz: 1d1d72e8b5ba18424afaf70932fd08b6d9cbeb5a6ba55356e15a82f1a94695ef
 SHA512:
-  metadata.gz: 65a4bf04a9400f563735c91582b5d61a361a32971489431e098a35a21a2952a2517ac126cfb1ff806eaffe5444ee935d6f3c273eeebc8690720814fa1ee0f521
-  data.tar.gz: 288e86713b00064cdf1b388f8bea1007bda0c6fc45a34be50514724d706b29618bb1e37ebf892cfafa93e144265bba914839f4ecdad8e804a1971afe077adc74
+  metadata.gz: 261a2c1920567bac989577ca58d498c61bf7d4912c4d66a9232448ef357e997bbc9d8b7ce9fd0828bbf7e3e14f93e49bb7ad4ecb54ea071574247389f27d4992
+  data.tar.gz: 51f82c565e51404d7fced2d27e65f39586e56026cf8fcd77c5fb99c8e08cc8363e2bd3c37dec13b4b5cfefb701edb45f3ad61591307c68b194bd7151f80bb48d

data/CHANGELOG.md

@@ -1,14 +1,30 @@
 # Changelog
 
-## [v1.0.0](https://github.com/jwt/ruby-jwe/tree/v1.0.0) (NEXT)
+## [v1.1.1](https://github.com/jwt/ruby-jwe/tree/v1.1.1) (2025-08-07)
+
+[Full Changelog](https://github.com/jwt/ruby-jwe/compare/v1.1.0...v1.1.1)
+
+**Fixes and enhancements:**
+
+- Fix tag length checking for AES-GCM (CVE-2025-54887)
+
+## [v1.1.0](https://github.com/jwt/ruby-jwe/tree/v1.1.0) (2025-07-22)
+
+[Full Changelog](https://github.com/jwt/ruby-jwe/compare/v1.0.0...v1.1.0)
+
+**Features:**
+
+- Add RsaOaep256 algorithm (https://github.com/jwt/ruby-jwe/pull/31)
+
+## [v1.0.0](https://github.com/jwt/ruby-jwe/tree/v1.0.0) (2025-02-16)
 
 [Full Changelog](https://github.com/jwt/ruby-jwe/compare/v0.4.0...v1.0.0)
 
 **Features:**
 
-- Support Ruby 3.4 (#26)(https://github.com/jwt/ruby-jwe/pull/26)
-- Drop support for Ruby versions prior to 2.5 (#27)(https://github.com/jwt/ruby-jwe/pull/27)
+- Support Ruby 3.4 (https://github.com/jwt/ruby-jwe/pull/26)
+- Drop support for Ruby versions prior to 2.5 (https://github.com/jwt/ruby-jwe/pull/27)
 
 **Fixes and enhancements:**
 
-- Refreshed codebase (CI and linter fixes) (#27)(https://github.com/jwt/ruby-jwe/pull/27), (#28)(https://github.com/jwt/ruby-jwe/pull/28)
+- Refreshed codebase (CI and linter fixes) (https://github.com/jwt/ruby-jwe/pull/27, https://github.com/jwt/ruby-jwe/pull/28)

data/README.md

@@ -1,6 +1,6 @@
 # JWE
 
-[![Build Status](https://github.com/jwt/ruby-jwe/workflows/test/badge.svg?branch=master)](https://github.com/jwt/ruby-jwe/actions)
+[![Build Status](https://github.com/jwt/ruby-jwe/actions/workflows/test.yml/badge.svg)](https://github.com/jwt/ruby-jwe/actions/workflows/test.yml)
 [![Gem Version](https://badge.fury.io/rb/jwe.svg)](https://badge.fury.io/rb/jwe)
 
 A ruby implementation of the [RFC 7516 JSON Web Encryption (JWE)](https://tools.ietf.org/html/rfc7516) standard.
@@ -96,7 +96,7 @@ Only a subset of these algorithms is implemented in this gem. Striked elements a
 Key management:
 * RSA1_5
 * RSA-OAEP (default)
-* ~~RSA-OAEP-256~~
+* RSA-OAEP-256 (if OpenSSL::VERSION >= '3.0')
 * A128KW
 * A192KW
 * A256KW

data/lib/jwe/alg/rsa_oaep_256.rb

@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+module JWE
+  module Alg
+    # RSA-OAEP-256 key encryption algorithm.
+    class RsaOaep256
+      attr_accessor :key
+
+      def initialize(key)
+        self.key = key
+      end
+
+      def encrypt(cek)
+        key.encrypt(cek, { rsa_padding_mode: 'oaep', rsa_oaep_md: 'sha256' })
+      end
+
+      def decrypt(encrypted_cek)
+        key.decrypt(encrypted_cek, { rsa_padding_mode: 'oaep', rsa_oaep_md: 'sha256' })
+      end
+    end
+  end
+end

data/lib/jwe/alg.rb

@@ -5,6 +5,7 @@ require 'jwe/alg/a192_kw'
 require 'jwe/alg/a256_kw'
 require 'jwe/alg/dir'
 require 'jwe/alg/rsa_oaep'
+require 'jwe/alg/rsa_oaep_256' if OpenSSL::VERSION >= '3.0'
 require 'jwe/alg/rsa15'
 
 module JWE

data/lib/jwe/enc/aes_cbc_hs.rb

@@ -64,11 +64,11 @@ module JWE
       end
 
       def mac_key
-        cek[0...key_length / 2]
+        cek[0...(key_length / 2)]
       end
 
       def enc_key
-        cek[key_length / 2..-1]
+        cek[(key_length / 2)..-1]
       end
 
       def cipher

data/lib/jwe/enc/aes_gcm.rb

@@ -38,7 +38,11 @@ module JWE
         cipher.send(direction)
         cipher.key = cek
         cipher.iv = iv
-        cipher.auth_tag = tag if direction == :decrypt
+        if direction == :decrypt
+          raise JWE::InvalidData, 'Invalid ciphertext or authentication tag' unless tag.bytesize == 16
+
+          cipher.auth_tag = tag
+        end
         cipher.auth_data = auth_data
       end
 

data/lib/jwe/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module JWE
-  VERSION = '1.0.0'
+  VERSION = '1.1.1'
 end

data/spec/jwe/alg_spec.rb

@@ -55,6 +55,29 @@ describe JWE::Alg::RsaOaep do
   end
 end
 
+if OpenSSL::VERSION >= '3.0'
+  describe JWE::Alg::RsaOaep256 do
+    let(:alg) { JWE::Alg::RsaOaep256.new(key) }
+
+    describe '#encrypt' do
+      it 'returns an encrypted string' do
+        expect(alg.encrypt('random key')).to_not eq 'random key'
+      end
+    end
+
+    it 'decrypts the encrypted key to the original key' do
+      ciphertext = alg.encrypt('random key')
+      expect(alg.decrypt(ciphertext)).to eq 'random key'
+    end
+  end
+else
+  describe JWE::Alg do
+    it 'raises an error for rsa-oaep-256 if openssl < 3.0' do
+      expect { JWE::Alg.for('rsa-oaep-256') }.to raise_error(JWE::NotImplementedError)
+    end
+  end
+end
+
 describe JWE::Alg::Rsa15 do
   let(:alg) { JWE::Alg::Rsa15.new(key) }
 

data/spec/jwe/enc_spec.rb

@@ -130,6 +130,14 @@ gcm.each do |group|
           end
         end
 
+        context 'when the tag is not 16 bytes' do
+          it 'raises an error' do
+            enc = klass.new(key, group[:iv])
+            enc.tag = group[:tag][0...-1]
+            expect { enc.decrypt(group[:helloworld], '') }.to raise_error(JWE::InvalidData)
+          end
+        end
+
         context 'when the ciphertext is not valid' do
           it 'raises an error' do
             enc = klass.new(key, group[:iv])

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: jwe
 version: !ruby/object:Gem::Version
-  version: 1.0.0
+  version: 1.1.1
 platform: ruby
 authors:
 - Francesco Boffa
-autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-02-16 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: base64
@@ -50,6 +49,7 @@ files:
 - lib/jwe/alg/dir.rb
 - lib/jwe/alg/rsa15.rb
 - lib/jwe/alg/rsa_oaep.rb
+- lib/jwe/alg/rsa_oaep_256.rb
 - lib/jwe/base64.rb
 - lib/jwe/enc.rb
 - lib/jwe/enc/a128cbc_hs256.rb
@@ -78,9 +78,8 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/jwt/ruby-jwe/issues
-  changelog_uri: https://github.com/jwt/ruby-jwe/blob/v1.0.0/CHANGELOG.md
+  changelog_uri: https://github.com/jwt/ruby-jwe/blob/v1.1.1/CHANGELOG.md
   rubygems_mfa_required: 'true'
-post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -95,8 +94,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.5.11
-signing_key:
+rubygems_version: 3.6.7
 specification_version: 4
 summary: JSON Web Encryption implementation in Ruby
 test_files: []