jwk 0.2.0 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 0075ad292467ceea1135ce68aa74692a5cd4d310
-  data.tar.gz: 60c2de19b4b277f4a5174199d2834c59b30af298
+  metadata.gz: fd3ca2360c804b73c1dd58937b3d8d2a3fad3f37
+  data.tar.gz: 658fd06146fd198e7a90f08242f0f31455c4025a
 SHA512:
-  metadata.gz: 8eeb3928193130b35d4ce069691458584964d66848a9698ce9f8f67a9129afc57c6f2d6a2d63dfd3e7647940862f8057932caa87431217c2f7c2964d569fd02f
-  data.tar.gz: f26a41c3204cb59b4f5fe639d37743bed013eb5a6b0058c5fbad17f91e1a14be5862f4d055ba7d205e907008338ff276a2ca95695b8602aaef9074995843fd87
+  metadata.gz: 3d96770d90c1f246c2d3529e78d3db5de57084d280251a6e0595cc025869bdc41f86170c93606a674dd7a0082d60bf3ca394108530078f608f13326ea8ab3c74
+  data.tar.gz: 5656d037ae9e1bd031aea2082b0806f3ecfe3ff7d43c17b7e95ff73bfe63999489dd81b54aca1fd4d099b53dd423eda31932765cb7191b5be9bf5be259ac53ef

data/lib/jwk/asn1.rb

@@ -11,20 +11,14 @@ module JWK
         sequence(integer(0), *args.map { |n| integer(n) })
       end
 
-      def ec_private_key(crv, d, x, y)
-        _, raw_x = raw_integer_encoding(x)
-        _, raw_y = raw_integer_encoding(y)
-
-        raw_x = pad_coord_for_crv(crv, raw_x)
-        raw_y = pad_coord_for_crv(crv, raw_y)
-
+      def ec_private_key(crv, d, raw_public_key)
         object_id = object_id_for_crv(crv)
 
         sequence(
           integer(1),
           integer_octet_string(d),
           context_specific(true, 0, object_id),
-          context_specific(true, 1, bit_string("\x04#{raw_x}#{raw_y}"))
+          context_specific(true, 1, bit_string(raw_public_key))
         )
       end
 
@@ -41,17 +35,6 @@ module JWK
         end
       end
 
-      def pad_coord_for_crv(crv, coord)
-        case crv
-        when 'P-256'
-          coord.rjust(32, "\x00")
-        when 'P-384'
-          coord.rjust(48, "\x00")
-        when 'P-521'
-          coord.rjust(64, "\x00")
-        end
-      end
-
       def rsa_header
         "\x30\x0D\x06\x09\x2A\x86\x48\x86\xF7\x0D\x01\x01\x01\x05\x00".force_encoding('ASCII-8BIT')
       end

data/lib/jwk/ec_key.rb

@@ -2,6 +2,18 @@ require 'jwk/key'
 
 module JWK
   class ECKey < Key
+    CURVE_NAMES = {
+      'prime256v1' => 'P-256',
+      'secp384r1' => 'P-384',
+      'secp521r1' => 'P-521'
+    }.freeze
+
+    COORD_SIZE = {
+      'P-256' => 32,
+      'P-384' => 48,
+      'P-521' => 64
+    }.freeze
+
     def initialize(key)
       @key = key
       validate
@@ -24,12 +36,17 @@ module JWK
     def to_pem
       raise NotImplementedError, 'Cannot convert an EC public key to PEM.' unless private?
 
-      asn = ASN1.ec_private_key(crv, d, x, y)
+      asn = ASN1.ec_private_key(crv, d, raw_public_key)
       generate_pem('EC PRIVATE', asn)
     end
 
     def to_openssl_key
-      OpenSSL::PKey.read(to_pem)
+      if private?
+        OpenSSL::PKey.read(to_pem)
+      else
+        group = OpenSSL::PKey::EC::Group.new(self.class::CURVE_NAMES.key(crv))
+        OpenSSL::PKey::EC::Point.new(group, OpenSSL::BN.new(raw_public_key.unpack('H*')[0], 16))
+      end
     end
 
     def to_s
@@ -46,12 +63,31 @@ module JWK
       end
     end
 
+    def raw_public_key
+      raw_x = Utils.int_to_binary(x)
+      raw_y = Utils.int_to_binary(y)
+
+      raw_x = pad_coord_for_crv(crv, raw_x)
+      raw_y = pad_coord_for_crv(crv, raw_y)
+
+      "\x04#{raw_x}#{raw_y}"
+    end
+
     class << self
       def from_openssl(k)
-        x, y = coords_from_key(k)
+        if k.is_a? OpenSSL::PKey::EC::Point
+          from_openssl_public(k)
+        else
+          from_openssl_private(k)
+        end
+      end
+
+      private
 
-        names = { 'secp256r1' => 'P-256', 'secp384r1' => 'P-384', 'secp521r1' => 'P-521' }
-        crv = names[k.group.curve_name]
+      def from_openssl_private(k)
+        x, y = coords_from_point(k.public_key)
+
+        crv = CURVE_NAMES[k.group.curve_name]
 
         raise NotImplementedError, "Unsupported EC curve type #{k.group.curve_name}" unless crv
 
@@ -60,10 +96,20 @@ module JWK
             'd' => Utils.encode_ub64_int(k.private_key.to_i), 'x' => x, 'y' => y)
       end
 
-      private
+      def from_openssl_public(k)
+        x, y = coords_from_point(k)
 
-      def coords_from_key(key)
-        pb = key.public_key.to_bn.to_s(16)
+        crv = CURVE_NAMES[k.group.curve_name]
+
+        raise NotImplementedError, "Unsupported EC curve type #{k.group.curve_name}" unless crv
+
+        new('kty' => 'EC',
+            'crv' => crv,
+            'x' => x, 'y' => y)
+      end
+
+      def coords_from_point(point)
+        pb = point.to_bn.to_s(16)
 
         raise NotImplementedError, 'Cannot convert EC compressed public key' unless pb[0..1] == '04'
 
@@ -75,5 +121,11 @@ module JWK
         coords.map { |c| Base64.urlsafe_encode64(Utils.hex_string_to_binary(c)) }
       end
     end
+
+    private
+
+    def pad_coord_for_crv(crv, coord)
+      coord.rjust(self.class::COORD_SIZE[crv], "\x00")
+    end
   end
 end

data/lib/jwk/key.rb

@@ -3,13 +3,16 @@ module JWK
     class << self
       def from_pem(pem)
         key = OpenSSL::PKey.read(pem)
+        if defined?(OpenSSL::PKey::EC) && key.is_a?(OpenSSL::PKey::EC)
+          $stderr.puts('WARNING: EC Keys have bugs on jRuby') if defined?(JRUBY_VERSION)
+        end
         from_openssl(key)
       end
 
       def from_openssl(key)
         if key.is_a?(OpenSSL::PKey::RSA)
           RSAKey.from_openssl(key)
-        elsif key.is_a?(OpenSSL::PKey::EC)
+        elsif key.is_a?(OpenSSL::PKey::EC) || key.is_a?(OpenSSL::PKey::EC::Point)
           ECKey.from_openssl(key)
         end
       end

data/lib/jwk/version.rb

@@ -1,3 +1,3 @@
 module JWK
-  VERSION = '0.2.0'.freeze
+  VERSION = '0.3.0'.freeze
 end

data/spec/jwk/asn1_spec.rb

@@ -41,36 +41,50 @@ describe JWK::ASN1 do
 
   describe '.ec_private_key' do
     let(:known_p256_asn) do
-      Base64.decode64('MFgCAQEEAaCgCgYIKoZIzj0DAQehRANCAAQAAAAAAAAAAAAAAAAAAAAA' +
-                      'AAAAAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA' +
+      Base64.decode64('MFgCAQEEAaCgCgYIKoZIzj0DAQehRANCAAQAAAAAAAAAAAAAAAAAAAAA' \
+                      'AAAAAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA' \
                       'AAAAAAAD')
     end
 
     let(:known_p384_asn) do
-      Base64.decode64('MHUCAQEEAaCgBwYFK4EEACKhZANiAAQAAAAAAAAAAAAAAAAAAAAAAAAA' +
-                      'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAA' +
+      Base64.decode64('MHUCAQEEAaCgBwYFK4EEACKhZANiAAQAAAAAAAAAAAAAAAAAAAAAAAAA' \
+                      'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAA' \
                       'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAM=')
     end
 
     let(:known_p521_asn) do
-      Base64.decode64('MIGXAgEBBAGgoAcGBSuBBAAjoYGFA4GCAAQAAAAAAAAAAAAAAAAAAAAA' +
-                      'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA' +
-                      'AAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA' +
+      Base64.decode64('MIGXAgEBBAGgoAcGBSuBBAAjoYGFA4GCAAQAAAAAAAAAAAAAAAAAAAAA' \
+                      'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA' \
+                      'AAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA' \
                       'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAw==')
     end
 
+    def pad_coord_for_crv(crv, coord)
+      coord.rjust(JWK::ECKey::COORD_SIZE[crv], "\x00")
+    end
+
+    def raw_public_key(crv, x, y)
+      raw_x = JWK::Utils.int_to_binary(x)
+      raw_y = JWK::Utils.int_to_binary(y)
+
+      raw_x = pad_coord_for_crv(crv, raw_x)
+      raw_y = pad_coord_for_crv(crv, raw_y)
+
+      "\x04#{raw_x}#{raw_y}"
+    end
+
     it 'generates valid ASN1 for a P-256 EC Private Key' do
-      result = JWK::ASN1.ec_private_key('P-256', 0xA0, 2, 3)
+      result = JWK::ASN1.ec_private_key('P-256', 0xA0, raw_public_key('P-256', 2, 3))
       expect(result).to eq(known_p256_asn)
     end
 
     it 'generates valid ASN1 for a P-384 EC Private Key' do
-      result = JWK::ASN1.ec_private_key('P-384', 0xA0, 2, 3)
+      result = JWK::ASN1.ec_private_key('P-384', 0xA0, raw_public_key('P-384', 2, 3))
       expect(result).to eq(known_p384_asn)
     end
 
     it 'generates valid ASN1 for a P-521 EC Private Key' do
-      result = JWK::ASN1.ec_private_key('P-521', 0xA0, 2, 3)
+      result = JWK::ASN1.ec_private_key('P-521', 0xA0, raw_public_key('P-521', 2, 3))
       expect(result).to eq(known_p521_asn)
     end
   end

data/spec/jwk/ec_key_spec.rb

@@ -47,6 +47,45 @@ describe JWK::ECKey do
         raise e unless defined?(JRUBY_VERSION)
       end
     end
+
+    it 'converts the public keys to an openssl point' do
+      key = JWK::Key.from_json(public_jwk)
+
+      begin
+        expect(key.to_openssl_key).to be_a OpenSSL::PKey::EC::Point
+      rescue Exception => e
+        # This is expected to fail on old jRuby versions
+        raise e unless defined?(JRUBY_VERSION)
+      end
+    end
+
+    # See: http://blogs.adobe.com/security/2017/03/critical-vulnerability-uncovered-in-json-encryption.html
+    # See: https://github.com/asanso/jwe-sender/blob/master/jwe-sender.js
+    it 'is protected against Invalid Curve Attack' do
+      k1 = {
+        'kty' => 'EC',
+        'x' => 'WJiccv00-OX6udOeWKfiRhZzzkoAnfG9JOIDprQYpH8', 'y' => 'tAjB2i8hs-7i6GLRcgMTtCoPbybmoPRWhS9qUBf2ldc',
+        'crv' => 'P-256'
+      }.to_json
+
+      k2 = {
+        'kty' => 'EC',
+        'x' => 'XOXGQ9_6QCvBg3u8vCI-UdBvICAEcNNBrfqd7tG7oQ4', 'y' => 'hQoWNotnNzKlwiCneJkLIqDnTNw7IsdBC53VUqVjVJc',
+        'crv' => 'P-256'
+      }.to_json
+
+      jwk1 = JWK::Key.from_json(k1)
+      jwk2 = JWK::Key.from_json(k2)
+
+      begin
+        expect { jwk1.to_openssl_key }.to raise_error(OpenSSL::PKey::EC::Point::Error)
+        expect { jwk2.to_openssl_key }.to raise_error(OpenSSL::PKey::EC::Point::Error)
+      rescue NameError => e
+        # This is expected to fail on old jRuby versions
+        # Not because it's unsafe, but because EC were not implemented.
+        raise e unless defined?(JRUBY_VERSION)
+      end
+    end
   end
 
   describe '#to_json' do

data/spec/jwk/key_spec.rb

@@ -27,7 +27,7 @@ describe JWK::Key do
       expect(jwk.to_pem).to eq key.to_pem
     end
 
-    it 'creates an ECKey for EC keys' do
+    it 'creates an ECKey for EC private keys' do
       begin
         key = OpenSSL::PKey::EC.new('secp384r1')
         key.generate_key
@@ -42,7 +42,7 @@ describe JWK::Key do
     # jRuby 9k OpenSSL generates a bad PEM file with private key only, skipping
     # the public part. This is in contrast with all other OpenSSL implementations.
     # And it makes this test fail.
-    it 'creates an ECKey for EC keys that resolves to the same parameters' do
+    it 'creates an ECKey for EC private keys that resolves to the same parameters' do
       begin
         key = OpenSSL::PKey::EC.new('secp384r1')
         key.generate_key
@@ -53,6 +53,30 @@ describe JWK::Key do
         raise e unless defined?(JRUBY_VERSION)
       end
     end
+
+    it 'creates an ECKey for EC public keys' do
+      begin
+        key = OpenSSL::PKey::EC.new('secp384r1')
+        key.generate_key
+        jwk = JWK::Key.from_openssl(key.public_key)
+
+        expect(jwk).to be_a JWK::ECKey
+      rescue NameError => e
+        raise e unless defined?(JRUBY_VERSION)
+      end
+    end
+
+    it 'creates an ECKey for EC public keys that resolves to the same parameters' do
+      begin
+        key = OpenSSL::PKey::EC.new('secp384r1')
+        key.generate_key
+        jwk = JWK::Key.from_openssl(key.public_key)
+
+        expect(jwk.to_openssl_key).to eq key.public_key
+      rescue NameError => e
+        raise e unless defined?(JRUBY_VERSION)
+      end
+    end
   end
 
   describe '.from_pem' do
@@ -62,5 +86,16 @@ describe JWK::Key do
 
       expect(jwk).to be_a JWK::RSAKey
     end
+
+    it 'generates an ECKey for EC Keys' do
+      begin
+        pem = OpenSSL::PKey::EC.new('prime256v1').generate_key.to_pem
+        jwk = JWK::Key.from_pem(pem)
+
+        expect(jwk).to be_a JWK::ECKey
+      rescue ArgumentError, NameError => e
+        raise e unless defined?(JRUBY_VERSION)
+      end
+    end
   end
 end

metadata

@@ -1,66 +1,66 @@
 --- !ruby/object:Gem::Specification
 name: jwk
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.3.0
 platform: ruby
 authors:
 - Francesco Boffa
-autorequire: 
+autorequire:
 bindir: bin
 cert_chain: []
-date: 2017-11-11 00:00:00.000000000 Z
+date: 2017-11-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
-  name: rspec
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-  type: :development
+  name: rspec
   prerelease: false
+  type: :development
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
-  name: rake
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-  type: :development
+  name: rake
   prerelease: false
+  type: :development
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
-  name: simplecov
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-  type: :development
+  name: simplecov
   prerelease: false
+  type: :development
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
-  name: codeclimate-test-reporter
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-  type: :development
+  name: codeclimate-test-reporter
   prerelease: false
+  type: :development
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
@@ -114,7 +114,7 @@ homepage: https://github.com/aomega08/jwk
 licenses:
 - MIT
 metadata: {}
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -129,9 +129,9 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubyforge_project: 
-rubygems_version: 2.6.11
-signing_key: 
+rubyforge_project:
+rubygems_version: 2.4.8
+signing_key:
 specification_version: 4
 summary: JSON Web Keys implementation in Ruby
 test_files: []