linzer 0.3.0 → 0.3.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 22298d26596b660ac67a7f039ed0d05cc41715a5413c4583a4703ce452e6548c
-  data.tar.gz: 735d31e3752eea02207baa7e093bd18a114281f4c493acf98cd7451d73e03fff
+  metadata.gz: a250923256b7bc421d1d0af152f360709b54a349c3ff9b50d15463e38f3e72e5
+  data.tar.gz: 2b3875de00e05baf2314495f9b889b028f71d334c237f3c183e602ac64a25668
 SHA512:
-  metadata.gz: 81428b963ffaa3f39e86ed28e52927923998aaeeb07f773a852bb01abe9272f812c8b0a593813293908845f57799c849163da00d4ae4ca2ef62d36687055ce81
-  data.tar.gz: 3f91ef995bd53bda69832e774ce383cf55a8ef903ffe615e8dbb1a586cf437b85a3d98f8082f39311a6757a3bd4f2657ac4b5d73c3270b4a4534ea571b9e8427
+  metadata.gz: c56717b6aa31d7f3ba2186e1865e7e1aa927f401df8931514f53de7969eb7a675d402a6519491d5446548cbabe57682d34fe6ace836278a36acf525b511a74c4
+  data.tar.gz: a5e3313e341c479b38f6975a06b430a509211acfc5e7d9d7fe71a802ca16d82ee548b8d19270dfd6c0a4e8c480ea81ae39a6353bd7745f795274c7d529639048

data/CHANGELOG.md

@@ -1,5 +1,9 @@
 ## [Unreleased]
 
+## [0.3.1] - 2024-03-02
+
+- Fix incorrect signing and verifying for ECDSA P-256 and P-384 curves.
+
 ## [0.3.0] - 2024-02-28
 
 - Add support for the following algorithms: Ed25519, HMAC-SHA256 and

data/README.md

@@ -60,7 +60,7 @@ lib/linzer/verifier.rb:34:in `verify_or_fail': Failed to verify message: Invalid
 
 For now, to consult additional details, just take a look at source code and/or the unit tests.
 
-Please note that is still early days and extensive testing is still ongoing. For now only the following algorithms are supported: RSASSA-PSS using SHA-512, HMAC-SHA256, Ed25519 and ECDSA P-256 curve. ECDSA P-384 curve was also added but not tested yet.
+Please note that is still early days and extensive testing is still ongoing. For now only the following algorithms are supported: RSASSA-PSS using SHA-512, HMAC-SHA256, Ed25519 and ECDSA (P-256 and P-384 curves).
 
 I'll be expanding the library to cover more functionality specified in the RFC
 in subsequent releases.

data/lib/linzer/ecdsa.rb

@@ -9,11 +9,48 @@ module Linzer
       end
 
       def sign(data)
-        material.sign(@params[:digest], data)
+        decode_der_signature(material.sign(@params[:digest], data))
       end
 
       def verify(signature, data)
-        material.verify(@params[:digest], signature, data)
+        material.verify(@params[:digest], der_signature(signature), data)
+      end
+
+      private
+
+      def der_signature(sig)
+        digest = @params[:digest]
+        msg = "Cannot verify invalid signature."
+
+        case digest
+        when "SHA256"
+          raise Linzer::Error.new(msg) if sig.length != 64
+          r_bn = OpenSSL::BN.new(sig[0..31].unpack1("H*").to_i(16))
+          s_bn = OpenSSL::BN.new(sig[32..63].unpack1("H*").to_i(16))
+        when "SHA384"
+          raise Linzer::Error.new(msg) if sig.length != 96
+          r_bn = OpenSSL::BN.new(sig[0..47].unpack1("H*").to_i(16))
+          s_bn = OpenSSL::BN.new(sig[48..95].unpack1("H*").to_i(16))
+        else
+          msg = "Cannot verify signature, unsupported digest algorithm: '%s'" % digest
+          raise Linzer::Error.new(msg)
+        end
+
+        r = OpenSSL::ASN1::Integer(r_bn)
+        s = OpenSSL::ASN1::Integer(s_bn)
+
+        seq = OpenSSL::ASN1::Sequence.new([r, s])
+        seq.to_der
+      end
+
+      def decode_der_signature(der_sig)
+        OpenSSL::ASN1
+          .decode(der_sig)
+          .value
+          .map { |n| n.value.to_s(16) }
+          .map { |s| [s].pack("H*")   }
+          .reduce(:<<)
+          .force_encoding(Encoding::ASCII_8BIT)
       end
     end
   end

data/lib/linzer/key/helper.rb

@@ -63,7 +63,7 @@ module Linzer
       # https://www.rfc-editor.org/rfc/rfc4492.html#appendix-A
       # Table 6: Equivalent curves defined by SECG, ANSI, and NIST
       # secp384r1   |               |   NIST P-384
-      def generate_ecdsa_p384_sha256_key(key_id = nil)
+      def generate_ecdsa_p384_sha384_key(key_id = nil)
         material = OpenSSL::PKey::EC.generate("secp384r1")
         Linzer::ECDSA::Key.new(material, id: key_id, digest: "SHA384")
       end

data/lib/linzer/signature.rb

@@ -36,7 +36,9 @@ module Linzer
         signature = parse_field(headers, "signature")
         fail_with_signature_not_found label unless signature.key?(label)
 
-        raw_signature = signature[label].value
+        raw_signature =
+          signature[label].value
+            .force_encoding(Encoding::ASCII_8BIT)
 
         fail_due_invalid_components unless input[label].value.respond_to?(:each)
 

data/lib/linzer/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Linzer
-  VERSION = "0.3.0"
+  VERSION = "0.3.1"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: linzer
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 0.3.1
 platform: ruby
 authors:
 - Miguel Landaeta
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2024-02-29 00:00:00.000000000 Z
+date: 2024-03-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ed25519