oydid 0.9.4 → 0.9.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0f96270f4b2465c3dadb499841094e20c27c1e6512e18f69c2e2f7dbb2c6559f
-  data.tar.gz: 0aff913041f3105b4569c41c88918439b50754431e24c85e51197f851fd436d9
+  metadata.gz: e2852f618ab2af5a4076ece7807b931168d061345496397dfc3f409faf25da10
+  data.tar.gz: 53bc6f370b519b0c72eedbf0bac1fb742fd5288b3696e93c080137531e8eedb7
 SHA512:
-  metadata.gz: 2505aeb0d16fc4a7786b24bbd1dcd607e7ac71122738ddc0bff9c6880d813813c5e6f2c134977a4bbf92b765565b8899822ae5d66dfe1977f214b89960ed6733
-  data.tar.gz: 49b7a640acf6793d33a504b45c4f69b30767a86d95fe4f7fd3236c26e4494456ccf4e799effe12c856b85a2ab675fa9887664c934bdcdd93710381466af27145
+  metadata.gz: 8cc1a99558914d4c968db056cfbd2aa50835ecbc22dc981e54f4eee24c95dbc9fc0e4c7e7c2378c4fe96672255ce54ae9ce91d6d3e3a6e1f2fe96a7d4a26b3fb
+  data.tar.gz: 420f07f1d3a5145dedfdfb1d65fe8cf83c979bcd99283e48437b2291e04007e3532ea3ea5ff53a9cc8a35fb155989989d0bac094fc8051e9d083641a83a54ff1

data/VERSION

@@ -1 +1 @@
-0.9.4
+0.9.6

data/lib/oydid/didcomm.rb

@@ -3,6 +3,11 @@
 
 class Oydid
 
+    # jwt-eddsa normalises the algorithm name to 'EdDSA' in the JOSE header, but
+    # dcsm writes an explicit 'ED25519' header. Accept both spellings of the same
+    # Ed25519 signature algorithm when verifying.
+    ED25519_ALGS = ['EdDSA', 'ED25519'].freeze
+
     # DIDComm Plain Message ---------------------
     def self.dcpm(payload, options)
         dcDoc = {}
@@ -24,7 +29,9 @@ class Oydid
         code, length, digest = multi_decode(private_key_encoded).first.unpack('SCa*')
         case Multicodecs[code].name
         when 'ed25519-priv'
-            private_key = RbNaCl::Signatures::Ed25519::SigningKey.new(digest)
+            # jwt-eddsa signs with an Ed25519::SigningKey from the ed25519 gem;
+            # an RbNaCl signing key is rejected with JWT::EncodeError.
+            private_key = Ed25519::SigningKey.new(digest)
             token = JWT.encode payload, private_key, 'ED25519', { typ: 'JWM', kid: options[:sign_did].to_s, alg: 'ED25519' }
         else
             token = nil
@@ -33,18 +40,67 @@ class Oydid
         return [token, error]
     end
 
+    # w3c() mixes string keys at the top level with symbol keys inside a
+    # verification method, so read every attribute through this helper.
+    def self.dd_attr(hash, key)
+        return nil unless hash.is_a?(Hash)
+        hash[key].nil? ? hash[key.to_sym] : hash[key]
+    end
+
+    # The 'authentication' section of a DID document may embed a verification
+    # method or - which is how did:oyd resolves it - reference one by id. Only
+    # keys listed there may be used to authenticate the DID subject, so a
+    # document without an authentication section is rejected rather than
+    # silently falling back to some other key.
+    def self.authentication_key(didDocument)
+        verification_methods = dd_attr(didDocument, "verificationMethod") || []
+        entry = (dd_attr(didDocument, "authentication") || []).first
+        vm = case entry
+             when Hash   then entry
+             when String then verification_methods.find { |v| dd_attr(v, "id").to_s == entry }
+             end
+        key = dd_attr(vm, "publicKeyMultibase")
+        if key.to_s == ""
+            return [nil, "no authentication key in DID document"]
+        end
+        return [key, ""]
+    end
+
+    # A DID may be written with or without the default location and with the
+    # location separator in either spelling, so compare the normalised forms.
+    # A fragment ("#key-doc") names a key within the DID, not another subject.
+    def self.same_did?(one, other)
+        percent_encode(one.to_s.split("#").first.to_s) ==
+            percent_encode(other.to_s.split("#").first.to_s)
+    end
+
+    # Verifying a token proves that whoever controls the DID named in its own
+    # 'kid' header signed it - not that the expected party did. Callers that
+    # read the result as an authorisation have to say which DID they expect,
+    # which is what options[:expect_did] is for. Checked before resolving, so a
+    # token from a foreign DID costs no network round trip.
     def self.dcsm_verify(token, options)
         error = ""
         decoded_payload = JWT.decode token, nil, false
         pubkey_did = decoded_payload.last["kid"]
+        if options[:expect_did].to_s != "" && !same_did?(pubkey_did, options[:expect_did])
+            return [nil, "token was signed by " + pubkey_did.to_s +
+                         ", expected " + options[:expect_did].to_s]
+        end
         result, msg = Oydid.read(pubkey_did, options)
-        public_key_encoded = Oydid.w3c(result, options)["authentication"].first["publicKeyMultibase"]
+        if result.nil?
+            return [nil, msg.to_s == "" ? "cannot resolve " + pubkey_did.to_s : msg.to_s]
+        end
+        public_key_encoded, error = authentication_key(Oydid.w3c(result, options))
+        if public_key_encoded.nil?
+            return [nil, error]
+        end
         begin
             code, length, digest = multi_decode(public_key_encoded).first.unpack('CCa*')
             case Multicodecs[code].name
             when 'ed25519-pub'
-                public_key = RbNaCl::Signatures::Ed25519::VerifyKey.new(digest)
-                payload = JWT.decode token.to_s, public_key, true, { algorithm: 'ED25519' }
+                public_key = Ed25519::VerifyKey.new(digest)
+                payload = JWT.decode token.to_s, public_key, true, { algorithms: ED25519_ALGS }
             else
                 payload = nil
                 error = "unsupported key codec"
@@ -61,7 +117,7 @@ class Oydid
         code, length, digest = multi_decode(private_key_encoded).first.unpack('SCa*')
         case Multicodecs[code].name
         when 'ed25519-priv'
-            private_key = RbNaCl::Signatures::Ed25519::SigningKey.new(digest)
+            private_key = Ed25519::SigningKey.new(digest)
             token = JWT.encode payload, private_key, 'ED25519'
         when 'p256-priv'
             group = OpenSSL::PKey::EC::Group.new('prime256v1')
@@ -98,8 +154,8 @@ class Oydid
         code, length, digest = Oydid.multi_decode(public_key_encoded).first.unpack('CCa*')
         case Multicodecs[code].name
         when 'ed25519-pub'
-            public_key = RbNaCl::Signatures::Ed25519::VerifyKey.new(digest)
-            payload = JWT.decode token.to_s, public_key, true, { algorithm: 'ED25519' }
+            public_key = Ed25519::VerifyKey.new(digest)
+            payload = JWT.decode token.to_s, public_key, true, { algorithms: ED25519_ALGS }
         else
             payload = nil
             error = "unsupported key codec"
@@ -108,12 +164,24 @@ class Oydid
     end
 
     # signing for JWS ---------------------------
+    # An empty HMAC key is no key at all: OpenSSL::HMAC.digest('SHA256', '', data)
+    # returns a valid digest, so anyone can recompute the signature. jwt >= 3.2.0
+    # refuses it (CVE-2026-45363), earlier versions happily accepted forged
+    # tokens - most notably via the CLI, where a missing --hmac_secret arrives
+    # here as "". Reject it ourselves so the behaviour does not depend on which
+    # jwt version a consumer resolves.
     def self.msg_sign(payload, hmac_secret)
+        if hmac_secret.to_s == ""
+            return [nil, "HMAC secret must not be empty"]
+        end
         token = JWT.encode payload, hmac_secret, 'HS256'
         return [token, ""]
     end
 
     def self.msg_verify_jws(token, hmac_secret)
+        if hmac_secret.to_s == ""
+            return [nil, "HMAC secret must not be empty"]
+        end
         begin
             decoded_token = JWT.decode token, hmac_secret, true, { algorithm: 'HS256' }
             return [decoded_token, ""]

data/lib/oydid/log.rb

@@ -90,6 +90,21 @@ class Oydid
         end
     end
 
+    # collapse byte-identical log entries (keep first), keyed on the entry hash
+    # that `previous` references resolve to. A replayed CREATE or tangling
+    # TERMINATE would otherwise trip dag_did's CREATE/terminate counts and make
+    # the DID unresolvable - reachable through the unauthenticated append path
+    # with no signing key. Genuinely distinct fork entries (different hash) are
+    # kept and still fail closed as ambiguous.
+    def self.dedup_log(logs)
+        return logs unless logs.is_a?(Array)
+        seen = {}
+        logs.select do |el|
+            key = (canonical(el.slice("ts","op","doc","sig","previous")) rescue el.inspect)
+            seen.key?(key) ? false : (seen[key] = true)
+        end
+    end
+
     def self.dag_did(logs, options)
         dag = DAG.new
         dag_log = []

data/lib/oydid.rb

@@ -142,6 +142,14 @@ class Oydid
                 log_hash = hash_split[0]
                 log_location = hash_split[1]
             end
+            # D11: the log reference may carry its location as %40 (the
+            # W3C-conform form of @); split on both, exactly as the DID split
+            # above does.
+            if log_hash.include?(CGI.escape LOCATION_PREFIX)
+                hash_split = log_hash.split(CGI.escape LOCATION_PREFIX)
+                log_hash = hash_split[0]
+                log_location = hash_split[1]
+            end
         end
         if log_location == ""
             log_location = DEFAULT_LOCATION
@@ -152,6 +160,7 @@ class Oydid
         if log_array.nil?
             return [nil, msg]
         else
+            log_array = dedup_log(log_array)
             if options[:trace]
                 puts " .. Log retrieved"
             end

data/spec/oydid_spec.rb

@@ -646,6 +646,37 @@ describe "OYDID handling" do
     end
   end
 
+  # SECURITY regression: the append endpoint is unauthenticated, so a byte-identical
+  # log entry can be replayed with no signing key. A duplicated CREATE trips dag_did's
+  # "wrong number of CREATE entries" and a duplicated tangling TERMINATE its terminate
+  # count, making the DID unresolvable. dedup_log collapses byte-identical replays
+  # (keep-first) at ingestion; genuinely distinct fork entries survive and still fail
+  # closed as ambiguous.
+  describe "dedup_log collapses byte-identical replayed entries" do
+    let(:create_e) { { "ts" => 1, "op" => 2, "doc" => "zCreate", "sig" => "z", "previous" => [] } }
+    let(:term_e)   { { "ts" => 1, "op" => 0, "doc" => "zTerm",   "sig" => "z", "previous" => [] } }
+
+    it "removes a byte-identical duplicate, keeping the first" do
+      deduped = Oydid.dedup_log([create_e, term_e, create_e.dup])
+      expect(deduped.length).to eq 2
+      expect(deduped.count { |e| e["op"] == 2 }).to eq 1
+    end
+
+    it "lets a de-duplicated log resolve where the raw one fails" do
+      logs = [create_e, term_e, create_e.dup]
+      expect(Oydid.dag_did(logs, { silent: true }).last).to match(/wrong number of CREATE/)
+      dag, create_index, _t, msg = Oydid.dag_did(Oydid.dedup_log(logs), { silent: true })
+      expect(msg).to eq ""
+      expect(dag).not_to be_nil
+      expect(create_index).to eq 0
+    end
+
+    it "keeps genuinely distinct entries (a real fork is not collapsed)" do
+      fork = create_e.merge("doc" => "zCreate2")
+      expect(Oydid.dedup_log([create_e, fork, term_e]).length).to eq 3
+    end
+  end
+
   # a broken repository (5xx) has to stay distinguishable from a DID that is
   # not stored there - otherwise the caller reports "not found" and thereby
   # claims the identifier never existed
@@ -1155,4 +1186,116 @@ describe "OYDID handling" do
       end
     end
   end
+  # These four defects together made the whole DIDComm branch unusable and, in
+  # the HMAC case, forgeable. Nothing in the suite touched it before.
+  describe "DIDComm signing" do
+    let(:priv) { Oydid.generate_private_key("didcomm-spec-pwd", "ed25519-priv", {}).first }
+    let(:pub)  { Oydid.public_key(priv, {}).first }
+
+    # jwt < 3.2.0 verified an HS256 token against an empty key, so anybody could
+    # forge one (CVE-2026-45363). The CLI reaches here with "" whenever
+    # --hmac_secret is omitted, so the gem refuses the empty key itself.
+    it "refuses to sign with an empty HMAC secret" do
+      token, msg = Oydid.msg_sign({ "a" => 1 }, "")
+
+      expect(token).to be_nil
+      expect(msg).to eq("HMAC secret must not be empty")
+    end
+
+    it "refuses to verify a token forged with an empty HMAC key" do
+      header  = Base64.urlsafe_encode64('{"alg":"HS256"}').delete("=")
+      payload = Base64.urlsafe_encode64('{"sub":"attacker"}').delete("=")
+      digest  = OpenSSL::HMAC.digest("SHA256", "", "#{header}.#{payload}")
+      forged  = "#{header}.#{payload}.#{Base64.urlsafe_encode64(digest).delete('=')}"
+
+      decoded, msg = Oydid.msg_verify_jws(forged, "")
+
+      expect(decoded).to be_nil
+      expect(msg).to eq("HMAC secret must not be empty")
+    end
+
+    it "still round-trips an HMAC signature with a real secret" do
+      token, = Oydid.msg_sign({ "a" => 1 }, "s3cr3t")
+      decoded, msg = Oydid.msg_verify_jws(token, "s3cr3t")
+
+      expect(msg).to eq("")
+      expect(decoded.first).to eq({ "a" => 1 })
+    end
+
+    # jwt-eddsa signs with Ed25519::SigningKey; handing it the RbNaCl key raised
+    # JWT::EncodeError, so "oydid jws" could not produce a token at all.
+    it "signs a DIDComm message with the Ed25519 document key" do
+      token, msg = Oydid.dcsm({ "a" => 1 }, priv, { sign_did: "did:oyd:zSpec" })
+
+      expect(msg).to eq("")
+      _, _, digest = Oydid.multi_decode(pub).first.unpack("CCa*")
+      decoded = JWT.decode(token, Ed25519::VerifyKey.new(digest), true,
+                           { algorithms: Oydid::ED25519_ALGS })
+      expect(decoded.first).to eq({ "a" => 1 })
+      expect(decoded.last["kid"]).to eq("did:oyd:zSpec")
+    end
+
+    # w3c() lists "authentication" as a reference and uses symbol keys inside a
+    # verification method - the old code indexed a String with "publicKeyMultibase".
+    describe "authentication_key" do
+      let(:didDocument) do
+        { "authentication" => ["did:oyd:zSpec#key-doc"],
+          "verificationMethod" => [
+            { id: "did:oyd:zSpec#key-rev", publicKeyMultibase: "z6MkRev" },
+            { id: "did:oyd:zSpec#key-doc", publicKeyMultibase: "z6MkDoc" }
+          ] }
+      end
+
+      it "dereferences a referenced verification method" do
+        key, msg = Oydid.authentication_key(didDocument)
+
+        expect(key).to eq("z6MkDoc")
+        expect(msg).to eq("")
+      end
+
+      it "accepts an embedded verification method" do
+        key, = Oydid.authentication_key(
+          { "authentication" => [{ "publicKeyMultibase" => "z6MkEmbedded" }] })
+
+        expect(key).to eq("z6MkEmbedded")
+      end
+
+      # a DID created without --authentication has no such section; report it
+      # instead of raising NoMethodError on nil
+      it "reports a document without an authentication section" do
+        key, msg = Oydid.authentication_key(didDocument.reject { |k, _| k == "authentication" })
+
+        expect(key).to be_nil
+        expect(msg).to eq("no authentication key in DID document")
+      end
+    end
+
+    # dcsm_verify takes the public key from the token's own kid header, so a
+    # green result on its own says nothing about *who* signed. --expect-did is
+    # what turns it into an authorisation check.
+    describe "expect_did" do
+      let(:token) { Oydid.dcsm({ "a" => 1 }, priv, { sign_did: "did:oyd:zSigner" }).first }
+
+      it "treats the two spellings of the location separator as one DID" do
+        expect(Oydid.same_did?("did:oyd:zAbc%40example.com", "did:oyd:zAbc@example.com")).to be true
+      end
+
+      it "ignores a key fragment" do
+        expect(Oydid.same_did?("did:oyd:zAbc#key-doc", "did:oyd:zAbc")).to be true
+      end
+
+      it "separates different DIDs" do
+        expect(Oydid.same_did?("did:oyd:zAbc", "did:oyd:zDef")).to be false
+      end
+
+      # webmock lets no unstubbed request through, so this also shows that the
+      # mismatch is caught before the DID is resolved
+      it "refuses a token signed by another DID without resolving it" do
+        payload, msg = Oydid.dcsm_verify(token, { expect_did: "did:oyd:zSomeoneElse" })
+
+        expect(payload).to be_nil
+        expect(msg).to eq("token was signed by did:oyd:zSigner, expected did:oyd:zSomeoneElse")
+      end
+    end
+  end
 end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: oydid
 version: !ruby/object:Gem::Version
-  version: 0.9.4
+  version: 0.9.6
 platform: ruby
 authors:
 - Christoph Fabianek
 bindir: bin
 cert_chain: []
-date: 2026-09-01 00:00:00.000000000 Z
+date: 2026-09-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: simple_dag
@@ -41,16 +41,22 @@ dependencies:
   name: jwt
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '3.2'
+    - - "<"
       - !ruby/object:Gem::Version
-        version: 3.1.2
+        version: '4'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '3.2'
+    - - "<"
       - !ruby/object:Gem::Version
-        version: 3.1.2
+        version: '4'
 - !ruby/object:Gem::Dependency
   name: jwt-eddsa
   requirement: !ruby/object:Gem::Requirement
@@ -97,16 +103,22 @@ dependencies:
   name: json
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.19.9
+    - - "<"
       - !ruby/object:Gem::Version
-        version: 2.18.1
+        version: '3'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.19.9
+    - - "<"
       - !ruby/object:Gem::Version
-        version: 2.18.1
+        version: '3'
 - !ruby/object:Gem::Dependency
   name: json-ld
   requirement: !ruby/object:Gem::Requirement