moxml 0.1.25 → 0.1.26

data/lib/moxml/signature/algorithms/rsa_pkcs1_sha.rb

@@ -0,0 +1,56 @@
+# frozen_string_literal: true
+
+require "openssl"
+
+module Moxml
+  module Signature
+    module Algorithms
+      # RSASSA-PKCS1-v1_5 per RFC 3447 §8.2, bound to a digest.
+      #
+      # One Ruby class registered under five URIs (sha1 / sha224 / sha256 /
+      # sha384 / sha512). When instantiated, the class is told which URI was
+      # resolved so it can pick the right digest.
+      class RsaPkcs1Sha < SignatureMethodBase
+        PAIRINGS = {
+          "http://www.w3.org/2000/09/xmldsig#rsa-sha1" => "SHA1",
+          "http://www.w3.org/2001/04/xmldsig-more#rsa-sha224" => "SHA224",
+          "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" => "SHA256",
+          "http://www.w3.org/2001/04/xmldsig-more#rsa-sha384" => "SHA384",
+          "http://www.w3.org/2001/04/xmldsig-more#rsa-sha512" => "SHA512",
+        }.freeze
+
+        PAIRINGS.each_key { |uri| identifier uri }
+
+        def initialize(identifier_uri:, parameters: nil)
+          super(nil)
+          @identifier_uri = identifier_uri
+          @parameters = parameters
+        end
+
+        def compute_signature(data, key)
+          rsa_key = coerce_key(key)
+          rsa_key.sign(digest_name, data)
+        end
+
+        def verify_signature(data, key, signature)
+          rsa_key = coerce_key(key)
+          rsa_key.verify(digest_name, signature, data)
+        end
+
+        private
+
+        def digest_name
+          PAIRINGS.fetch(@identifier_uri)
+        end
+
+        def coerce_key(key)
+          return key if key.is_a?(OpenSSL::PKey::RSA)
+
+          raise SignatureKeyError,
+                "RSA signature method requires OpenSSL::PKey::RSA, " \
+                "got #{key.class}"
+        end
+      end
+    end
+  end
+end

data/lib/moxml/signature/algorithms/sha1.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+module Moxml
+  module Signature
+    module Algorithms
+      class SHA1 < DigestBase
+        identifier "http://www.w3.org/2000/09/xmldsig#sha1"
+        digest_bits 160
+        openssl_digest_name "SHA1"
+      end
+    end
+  end
+end

data/lib/moxml/signature/algorithms/sha224.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+module Moxml
+  module Signature
+    module Algorithms
+      class SHA224 < DigestBase
+        identifier "http://www.w3.org/2001/04/xmldsig-more#sha224"
+        digest_bits 224
+        openssl_digest_name "SHA224"
+      end
+    end
+  end
+end

data/lib/moxml/signature/algorithms/sha256.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+module Moxml
+  module Signature
+    module Algorithms
+      class SHA256 < DigestBase
+        identifier "http://www.w3.org/2001/04/xmlenc#sha256"
+        digest_bits 256
+        openssl_digest_name "SHA256"
+      end
+    end
+  end
+end

data/lib/moxml/signature/algorithms/sha384.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+module Moxml
+  module Signature
+    module Algorithms
+      class SHA384 < DigestBase
+        identifier "http://www.w3.org/2001/04/xmldsig-more#sha384"
+        digest_bits 384
+        openssl_digest_name "SHA384"
+      end
+    end
+  end
+end

data/lib/moxml/signature/algorithms/sha512.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+module Moxml
+  module Signature
+    module Algorithms
+      class SHA512 < DigestBase
+        identifier "http://www.w3.org/2001/04/xmlenc#sha512"
+        digest_bits 512
+        openssl_digest_name "SHA512"
+      end
+    end
+  end
+end

data/lib/moxml/signature/algorithms/signature_method_base.rb

@@ -0,0 +1,58 @@
+# frozen_string_literal: true
+
+module Moxml
+  module Signature
+    module Algorithms
+      # Base class for signature methods and MACs.
+      #
+      # Subclasses declare an identifier URI per W3C spec §6.4 / §6.3 and
+      # implement #compute_signature and #verify_signature.
+      #
+      # `key` is whatever OpenSSL expects (OpenSSL::PKey::RSA for RSA, a
+      # String secret for HMAC, etc.).
+      class SignatureMethodBase
+        class << self
+          attr_reader :identifier_uri, :digest_uri
+
+          def identifier(uri, digest_uri: nil)
+            @identifier_uri = uri
+            @digest_uri = digest_uri
+            Algorithms.register(:signature_method, uri, self)
+          end
+        end
+
+        # Optional constructor for parameterized methods (e.g. HMACOutputLength).
+        def initialize(parameters = nil)
+          @parameters = parameters
+        end
+
+        def sign(data, key)
+          compute_signature(data, key)
+        rescue OpenSSL::PKey::PKeyError => e
+          raise SigningError.new(
+            "signing failed: #{e.class}",
+            algorithm: self.class.identifier_uri,
+          )
+        end
+
+        def verify(data, key, signature)
+          verify_signature(data, key, signature)
+        rescue OpenSSL::PKey::PKeyError => e
+          raise VerificationError.new(
+            "verification raised: #{e.class}",
+          )
+        end
+
+        def compute_signature(_data, _key)
+          raise NotImplementedError,
+                "#{self.class} must implement #compute_signature"
+        end
+
+        def verify_signature(_data, _key, _signature)
+          raise NotImplementedError,
+                "#{self.class} must implement #verify_signature"
+        end
+      end
+    end
+  end
+end

data/lib/moxml/signature/algorithms/transform_base.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+module Moxml
+  module Signature
+    module Algorithms
+      # Base class for XML Signature transforms.
+      #
+      # Each transform declares input and output types (:octets or :nodeset)
+      # plus an identifier URI. The reference resolver chains them with
+      # default type conversion when types mismatch (octets → nodeset via
+      # XML parse; nodeset → octets via inclusive C14N 1.0).
+      class TransformBase
+        class << self
+          attr_reader :identifier_uri
+
+          def identifier(uri)
+            @identifier_uri = uri
+            Algorithms.register(:transform, uri, self)
+          end
+
+          def input_type; :octets; end
+          def output_type; :octets; end
+        end
+
+        # `parameters`: optional hash parsed from the ds:Transform element
+        # (e.g. { xpaths: [...] } for the XPath Filter transform).
+        def initialize(parameters: nil, context: nil, signature_element: nil)
+          @parameters = parameters || {}
+          @context = context
+          @signature_element = signature_element
+        end
+
+        def transform(_input)
+          raise NotImplementedError,
+                "#{self.class} must implement #transform"
+        end
+      end
+    end
+  end
+end

data/lib/moxml/signature/algorithms.rb

@@ -0,0 +1,113 @@
+# frozen_string_literal: true
+
+module Moxml
+  module Signature
+    # Open-closed registry of W3C XML Signature algorithms keyed by URI.
+    #
+    # Adding a new algorithm:
+    #   1. Subclass the relevant base (DigestBase, SignatureMethodBase, etc.)
+    #   2. Declare `identifier "http://..."` on the subclass.
+    #   3. Add an autoload entry below and a reference in `load_builtins!`.
+    #
+    # No edits to existing classes are required to add a new algorithm.
+    module Algorithms
+      CATEGORIES = %i[digest signature_method canonicalization transform].freeze
+
+      class << self
+        def registry
+          @registry ||= CATEGORIES.to_h { |c| [c, {}] }
+        end
+
+        def register(category, uri, klass)
+          validate_category!(category)
+          registry[category][uri] = klass
+          klass
+        end
+
+        def lookup(category, uri)
+          load_builtins! unless @builtins_loaded
+          registry[category][uri] ||
+            raise(UnknownAlgorithm.new(category, uri))
+        end
+
+        def registered?(category, uri)
+          load_builtins! unless @builtins_loaded
+          registry[category].key?(uri)
+        end
+
+        def [](category)
+          validate_category!(category)
+          registry[category]
+        end
+
+        # Forces autoload of every built-in algorithm class so that
+        # self-registration runs. Pure autoload — no `require` calls.
+        def load_builtins!
+          return if @builtins_loaded
+
+          # Digests
+          SHA1
+          SHA224
+          SHA256
+          SHA384
+          SHA512
+          # Signature methods
+          RsaPkcs1Sha
+          HmacSha
+          EcdsaSha
+          DsaSha
+          # Canonicalization
+          ExcC14n10
+          InclusiveC14n10
+          InclusiveC14n11
+          # Transforms
+          Base64Transform
+          EnvelopedSignatureTransform
+
+          @builtins_loaded = true
+        end
+
+        private
+
+        def validate_category!(category)
+          return if CATEGORIES.include?(category)
+
+          raise ArgumentError,
+                "unknown algorithm category #{category.inspect}; " \
+                "expected one of #{CATEGORIES.inspect}"
+        end
+      end
+
+      # Base classes — interfaces only.
+      autoload :DigestBase, "moxml/signature/algorithms/digest_base"
+      autoload :SignatureMethodBase,
+               "moxml/signature/algorithms/signature_method_base"
+      autoload :CanonicalizationBase,
+               "moxml/signature/algorithms/canonicalization_base"
+      autoload :TransformBase, "moxml/signature/algorithms/transform_base"
+
+      # Digests
+      autoload :SHA1, "moxml/signature/algorithms/sha1"
+      autoload :SHA224, "moxml/signature/algorithms/sha224"
+      autoload :SHA256, "moxml/signature/algorithms/sha256"
+      autoload :SHA384, "moxml/signature/algorithms/sha384"
+      autoload :SHA512, "moxml/signature/algorithms/sha512"
+
+      # Signature methods
+      autoload :RsaPkcs1Sha, "moxml/signature/algorithms/rsa_pkcs1_sha"
+      autoload :HmacSha, "moxml/signature/algorithms/hmac_sha"
+      autoload :EcdsaSha, "moxml/signature/algorithms/ecdsa_sha"
+      autoload :DsaSha, "moxml/signature/algorithms/dsa_sha"
+
+      # Canonicalization (delegates to Moxml::C14n engine)
+      autoload :ExcC14n10, "moxml/signature/algorithms/exc_c14n_10"
+      autoload :InclusiveC14n10, "moxml/signature/algorithms/inclusive_c14n_10"
+      autoload :InclusiveC14n11, "moxml/signature/algorithms/inclusive_c14n_11"
+
+      # Transforms
+      autoload :Base64Transform, "moxml/signature/algorithms/base64_transform"
+      autoload :EnvelopedSignatureTransform,
+               "moxml/signature/algorithms/enveloped_signature_transform"
+    end
+  end
+end

data/lib/moxml/signature/errors.rb

@@ -0,0 +1,99 @@
+# frozen_string_literal: true
+
+module Moxml
+  module Signature
+    class Error < ::Moxml::Error; end
+
+    class SignatureError < Error; end
+
+    class UnknownAlgorithm < Error
+      attr_reader :category, :uri
+
+      def initialize(category, uri)
+        @category = category
+        @uri = uri
+        super("Unknown #{category} algorithm: #{uri}")
+      end
+    end
+
+    class DuplicateAlgorithm < Error
+      attr_reader :category, :uri
+
+      def initialize(category, uri)
+        @category = category
+        @uri = uri
+        super("Algorithm already registered for #{category}: #{uri}")
+      end
+    end
+
+    class SigningError < Error
+      attr_reader :algorithm
+
+      def initialize(message, algorithm: nil)
+        @algorithm = algorithm
+        super(message)
+      end
+    end
+
+    class VerificationError < Error
+      attr_reader :signature_id
+
+      def initialize(message, signature_id: nil)
+        @signature_id = signature_id
+        super(message)
+      end
+    end
+
+    class ReferenceDigestMismatch < VerificationError
+      attr_reader :reference_uri, :expected, :computed
+
+      def initialize(reference_uri:, expected:, computed:, signature_id: nil)
+        @reference_uri = reference_uri
+        @expected = expected
+        @computed = computed
+        super(
+          "Digest mismatch for reference #{reference_uri.inspect}",
+          signature_id: signature_id,
+        )
+      end
+    end
+
+    class SignatureValueMismatch < VerificationError
+      attr_reader :algorithm
+
+      def initialize(algorithm: nil, signature_id: nil)
+        @algorithm = algorithm
+        super("SignatureValue did not verify", signature_id: signature_id)
+      end
+    end
+
+    class TransformError < Error
+      attr_reader :algorithm
+
+      def initialize(message, algorithm: nil)
+        @algorithm = algorithm
+        super(message)
+      end
+    end
+
+    class CanonicalizationError < Error
+      attr_reader :algorithm
+
+      def initialize(message, algorithm: nil)
+        @algorithm = algorithm
+        super(message)
+      end
+    end
+
+    class MalformedSignatureError < Error
+      attr_reader :detail
+
+      def initialize(message, detail: nil)
+        @detail = detail
+        super(message)
+      end
+    end
+
+    class SignatureKeyError < Error; end
+  end
+end

data/lib/moxml/signature/key_extractor.rb

@@ -0,0 +1,172 @@
+# frozen_string_literal: true
+
+require "openssl"
+require "base64"
+
+module Moxml
+  module Signature
+    # Extracts an OpenSSL verification key from a Model::KeyInfo.
+    #
+    # Strategy (per spec §4.5): X509Certificate is preferred for key
+    # reconstruction because it carries the certified binding. Falls back
+    # to RSAKeyValue / DSAKeyValue / ECKeyValue if no certificate is
+    # present. KeyName is resolved via an application-supplied key map.
+    class KeyExtractor
+      attr_reader :key_map, :cert_store
+
+      def initialize(key_map: {}, cert_store: nil)
+        @key_map = key_map || {}
+        @cert_store = cert_store
+      end
+
+      def extract(key_info)
+        return nil if key_info.nil?
+
+        from_x509_data(key_info.x509_data) ||
+          from_key_value(key_info.key_value) ||
+          from_key_name(key_info.key_name)
+      end
+
+      private
+
+      def from_x509_data(x509_data)
+        return nil unless x509_data
+
+        cert_b64 = x509_data.certificates.first
+        return nil unless cert_b64
+
+        # Certificates are stored as base64-encoded DER (spec §4.5.4).
+        # Decode here so we hand OpenSSL raw DER bytes.
+        cert_der = Base64.strict_decode64(cert_b64.to_s.gsub(/\s+/, ""))
+        cert = OpenSSL::X509::Certificate.new(cert_der)
+        cert.public_key
+      rescue OpenSSL::X509::CertificateError, ArgumentError
+        nil
+      end
+
+      def from_key_value(key_value)
+        return nil unless key_value
+
+        if key_value.rsa_key_value
+          rsa_public_key(key_value.rsa_key_value)
+        elsif key_value.dsa_key_value
+          dsa_public_key(key_value.dsa_key_value)
+        elsif key_value.ec_key_value
+          ec_public_key(key_value.ec_key_value)
+        end
+      end
+
+      def from_key_name(key_name)
+        return nil unless key_name
+
+        key_map[key_name]
+      end
+
+      def rsa_public_key(rsa_kv)
+        n = crypto_binary_to_integer(rsa_kv.modulus)
+        e = crypto_binary_to_integer(rsa_kv.exponent)
+        return nil unless n && e
+
+        # OpenSSL 3.x removed RSA.new(n, e). Reconstruct via the
+        # SubjectPublicKeyInfo form (PKCS#1 RSA public key DER).
+        asn1 = OpenSSL::ASN1::Sequence.new(
+          [
+            OpenSSL::ASN1::Integer.new(n),
+            OpenSSL::ASN1::Integer.new(e),
+          ],
+        )
+        OpenSSL::PKey::RSA.new(asn1.to_der)
+      rescue OpenSSL::PKey::RSAError
+        nil
+      end
+
+      def dsa_public_key(dsa_kv)
+        p = crypto_binary_to_integer(dsa_kv.p)
+        q = crypto_binary_to_integer(dsa_kv.q)
+        g = crypto_binary_to_integer(dsa_kv.g) if dsa_kv.g
+        y = crypto_binary_to_integer(dsa_kv.y)
+        return nil unless p && q && y
+
+        params = OpenSSL::ASN1::Sequence.new(
+          [
+            OpenSSL::ASN1::Integer.new(p),
+            OpenSSL::ASN1::Integer.new(q),
+            OpenSSL::ASN1::Integer.new(g || 0),
+            OpenSSL::ASN1::Integer.new(y),
+          ],
+        )
+        OpenSSL::PKey::DSA.new(params.to_der)
+      rescue OpenSSL::PKey::DSAError
+        nil
+      end
+
+      def ec_public_key(ec_kv)
+        return nil unless ec_kv.named_curve_uri && ec_kv.public_key
+
+        curve_name = curve_name_for(ec_kv.named_curve_uri)
+        return nil unless curve_name
+
+        # The XML signature PublicKey element already contains the
+        # uncompressed-point form (0x04 || x || y) per spec §4.5.2.3.
+        public_key_decoded = Base64.strict_decode64(ec_kv.public_key)
+        spki_der = build_ec_subject_public_key_info(curve_name, public_key_decoded)
+        OpenSSL::PKey::EC.new(spki_der)
+      rescue OpenSSL::PKey::ECError, ArgumentError
+        nil
+      end
+
+      # Build a SubjectPublicKeyInfo DER for an EC public key.
+      # OpenSSL 3.0 makes PKey instances immutable; we can no longer
+      # create an empty EC key and assign public_key=. Constructing the
+      # full SPKI and reading it back via OpenSSL::PKey::EC.new(der)
+      # is the supported path.
+      def build_ec_subject_public_key_info(curve_name, point_octets)
+        algorithm = OpenSSL::ASN1::Sequence.new(
+          [
+            OpenSSL::ASN1::ObjectId.new("id-ecPublicKey"),
+            OpenSSL::ASN1::ObjectId.new(curve_name_to_oid(curve_name)),
+          ],
+        )
+        OpenSSL::ASN1::Sequence.new(
+          [
+            algorithm,
+            OpenSSL::ASN1::BitString.new(point_octets),
+          ],
+        ).to_der
+      end
+
+      CURVE_NAME_TO_OID = {
+        "prime256v1" => "1.2.840.10045.3.1.7",
+        "secp384r1" => "1.3.132.0.34",
+        "secp521r1" => "1.3.132.0.35",
+      }.freeze
+      private_constant :CURVE_NAME_TO_OID
+
+      def curve_name_to_oid(curve_name)
+        CURVE_NAME_TO_OID.fetch(curve_name)
+      end
+
+      # ds:CryptoBinary is base64-encoded I2OSP output.
+      def crypto_binary_to_integer(base64_text)
+        return nil unless base64_text
+
+        raw = Base64.strict_decode64(base64_text.to_s.gsub(/\s+/, ""))
+        raw.bytes.reduce(0) { |acc, byte| (acc << 8) | byte }
+      rescue ArgumentError
+        nil
+      end
+
+      # Map NamedCurve URN OIDs to OpenSSL curve names (RFC 5480 §2.1).
+      CURVE_OID_TO_NAME = {
+        "urn:oid:1.2.840.10045.3.1.7" => "prime256v1", # P-256
+        "urn:oid:1.3.132.0.34" => "secp384r1",         # P-384
+        "urn:oid:1.3.132.0.35" => "secp521r1",         # P-521
+      }.freeze
+      private_constant :CURVE_OID_TO_NAME
+
+      def curve_name_for(uri)
+        CURVE_OID_TO_NAME[uri]
+      end
+    end
+  end
+end

data/lib/moxml/signature/model/algorithm_method.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+module Moxml
+  module Signature
+    module Model
+      # Generic algorithm method element. Used for CanonicalizationMethod and
+      # SignatureMethod, both of which are `<Foo Algorithm="uri" />` shape.
+      class AlgorithmMethod
+        attr_accessor :algorithm, :parameters
+
+        def initialize(algorithm:, parameters: {})
+          @algorithm = algorithm
+          @parameters = parameters
+        end
+      end
+    end
+  end
+end

data/lib/moxml/signature/model/digest_method.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+module Moxml
+  module Signature
+    module Model
+      class DigestMethod
+        attr_accessor :algorithm
+
+        def initialize(algorithm:)
+          @algorithm = algorithm
+        end
+      end
+    end
+  end
+end

data/lib/moxml/signature/model/key/dsa_key_value.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+module Moxml
+  module Signature
+    module Model
+      module Key
+        # ds:DSAKeyValue — P, Q, G, Y required; J, Seed, PgenCounter optional.
+        # Attribute names mirror the W3C spec §4.5.2.1 element names
+        # (P, Q, G, Y, J, Seed, PgenCounter).
+        class DSAKeyValue
+          attr_accessor :p, :q, :g, :y, :j, :seed, :pgen_counter
+
+          # rubocop:disable Naming/MethodParameterName -- P/Q/G/Y/J are W3C spec names
+          def initialize(p:, q:, y:, g: nil, j: nil, seed: nil,
+                         pgen_counter: nil)
+            @p = p
+            @q = q
+            @y = y
+            @g = g
+            @j = j
+            @seed = seed
+            @pgen_counter = pgen_counter
+          end
+          # rubocop:enable Naming/MethodParameterName
+        end
+      end
+    end
+  end
+end