ruby-paseto 0.1.2 → 0.2.0

data/lib/paseto/interface/version.rb

@@ -8,144 +8,57 @@ module Paseto
       extend T::Helpers
 
       include Comparable
-      include Kernel
 
       abstract!
 
-      module ClassMethods
-        extend T::Sig
-        extend T::Helpers
+      sig { abstract.params(key: String, nonce: String, payload: String).returns(String) }
+      def crypt(key:, nonce:, payload:); end
 
-        interface!
+      sig { abstract.params(data: String, digest_size: Integer).returns(String) }
+      def digest(data, digest_size:); end
 
-        sig { abstract.params(key: String, nonce: String, payload: String).returns(String) }
-        def crypt(key:, nonce:, payload:); end
+      sig { abstract.returns(Integer) }
+      def digest_bytes; end
 
-        sig { abstract.params(data: String, digest_size: Integer).returns(String) }
-        def digest(data, digest_size:); end
+      sig { abstract.params(data: String, key: String, digest_size: Integer).returns(String) }
+      def hmac(data, key:, digest_size: nil); end
 
-        sig { abstract.returns(Integer) }
-        def digest_bytes; end
+      sig { abstract.returns(Interface::ID) }
+      def id; end
 
-        sig { abstract.params(data: String, key: String, digest_size: Integer).returns(String) }
-        def hmac(data, key:, digest_size:); end
-
-        sig { abstract.returns(Interface::ID) }
-        def id; end
-
-        sig do
-          abstract.params(
-            password: String,
-            salt: String,
-            length: Integer,
-            parameters: Integer
-          ).returns(String)
-        end
-        def kdf(password, salt:, length:, **parameters); end
-
-        sig { abstract.returns(String) }
-        def paserk_version; end
-
-        sig { abstract.returns(String) }
-        def pbkd_local_header; end
-
-        sig { abstract.returns(String) }
-        def pbkd_secret_header; end
-
-        sig { abstract.params(password: String).returns(Interface::PBKD) }
-        def pbkw(password); end
-
-        sig { abstract.params(key: SymmetricKey).returns(Interface::PIE) }
-        def pie(key); end
-
-        sig { abstract.params(key: AsymmetricKey).returns(Interface::PKE) }
-        def pke(key); end
-
-        sig { abstract.params(size: Integer).returns(String) }
-        def random(size); end
-
-        sig { abstract.returns(String) }
-        def version; end
-      end
-
-      mixes_in_class_methods(ClassMethods)
-
-      sig(:final) { params(key: String, nonce: String, payload: String).returns(String) }
-      def crypt(key:, nonce:, payload:)
-        self.class.crypt(key: key, nonce: nonce, payload: payload)
-      end
-
-      sig(:final) { params(data: String, digest_size: T.nilable(Integer)).returns(String) }
-      def digest(data, digest_size: nil)
-        self.class.digest(data, digest_size: digest_size || digest_bytes)
-      end
-
-      sig(:final) { returns(Integer) }
-      def digest_bytes
-        self.class.digest_bytes
-      end
-
-      sig(:final) { params(data: String, key: String, digest_size: T.nilable(Integer)).returns(String) }
-      def hmac(data, key:, digest_size: nil)
-        self.class.hmac(data, key: key, digest_size: digest_size || digest_bytes)
-      end
-
-      sig(:final) { returns(Interface::ID) }
-      def id
-        self.class.id
-      end
-
-      sig(:final) do
-        params(
+      sig do
+        abstract.params(
           password: String,
           salt: String,
           length: Integer,
-          parameters: T.any(Symbol, Integer)
+          parameters: Integer
         ).returns(String)
       end
-      def kdf(password, salt:, length:, **parameters)
-        self.class.kdf(password, salt: salt, length: length, **parameters)
-      end
+      def kdf(password, salt:, length:, **parameters); end
 
-      sig(:final) { returns(String) }
-      def paserk_version
-        self.class.paserk_version
-      end
+      sig { abstract.returns(String) }
+      def paserk_version; end
 
-      sig(:final) { returns(String) }
-      def pbkd_local_header
-        self.class.pbkd_local_header
-      end
+      sig { abstract.returns(String) }
+      def pbkd_local_header; end
 
-      sig(:final) { returns(String) }
-      def pbkd_secret_header
-        self.class.pbkd_secret_header
-      end
+      sig { abstract.returns(String) }
+      def pbkd_secret_header; end
 
-      sig(:final) { params(password: String).returns(Interface::PBKD) }
-      def pbkw(password)
-        self.class.pbkw(password)
-      end
+      sig { abstract.params(password: String).returns(Interface::PBKD) }
+      def pbkw(password); end
 
-      sig(:final) { params(key: SymmetricKey).returns(Interface::PIE) }
-      def pie(key)
-        self.class.pie(key)
-      end
+      sig { abstract.params(key: SymmetricKey).returns(Interface::PIE) }
+      def pie(key); end
 
-      sig(:final) { params(key: AsymmetricKey).returns(Interface::PKE) }
-      def pke(key)
-        self.class.pke(key)
-      end
+      sig { abstract.params(key: AsymmetricKey).returns(Interface::PKE) }
+      def pke(key); end
 
-      sig(:final) { params(size: Integer).returns(String) }
-      def random(size)
-        self.class.random(size)
-      end
+      sig { abstract.params(size: Integer).returns(String) }
+      def random(size); end
 
-      sig(:final) { returns(String) }
-      def version
-        self.class.version
-      end
+      sig { abstract.returns(String) }
+      def version; end
 
       sig(:final) { params(other: T.untyped).returns(T.nilable(Integer)) }
       def <=>(other)

data/lib/paseto/operations/id/i_dv3.rb

@@ -12,7 +12,7 @@ module Paseto
 
         sig { override.returns(Protocol::Version3) }
         def self.protocol
-          Protocol::Version3.new
+          Protocol::Version3.instance
         end
       end
     end

data/lib/paseto/operations/id/i_dv4.rb

@@ -12,7 +12,7 @@ module Paseto
 
         sig { override.returns(Protocol::Version4) }
         def self.protocol
-          Protocol::Version4.new
+          Protocol::Version4.instance
         end
       end
     end

data/lib/paseto/operations/pbkd/p_b_k_dv3.rb

@@ -11,13 +11,12 @@ module Paseto
         include Interface::PBKD
 
         sig { override.returns(Protocol::Version3) }
-        def self.protocol
-          Protocol::Version3.new
-        end
+        attr_reader :protocol
 
         sig { params(password: String).void }
         def initialize(password)
           @password = password
+          @protocol = T.let(Protocol::Version3.instance, Protocol::Version3)
         end
 
         sig do
@@ -43,7 +42,7 @@ module Paseto
         sig { override.params(salt: String, params: T::Hash[Symbol, Integer]).returns(String) }
         def pre_key(salt:, params:)
           iterations = T.must(params[:iterations])
-          protocol.kdf(@password, salt: salt, length: 32, iterations: iterations)
+          protocol.kdf(@password, salt:, length: 32, iterations:)
         end
 
         sig { override.returns(String) }
@@ -76,7 +75,7 @@ module Paseto
             nonce: T.must(data.byteslice(36, 16)),
             edk: T.must(data.byteslice(52, edk_len)),
             tag: T.must(data.byteslice(-48, 48)),
-            params: { iterations: iterations }
+            params: { iterations: }
           }
         end
       end

data/lib/paseto/operations/pbkd/p_b_k_dv4.rb

@@ -11,13 +11,12 @@ module Paseto
         include Interface::PBKD
 
         sig { override.returns(Protocol::Version4) }
-        def self.protocol
-          Protocol::Version4.new
-        end
+        attr_reader :protocol
 
         sig { params(password: String).void }
         def initialize(password)
           @password = password
+          @protocol = T.let(Protocol::Version4.instance, Protocol::Version4)
         end
 
         sig do
@@ -49,7 +48,7 @@ module Paseto
         def pre_key(salt:, params:)
           opslimit = T.must(params[:opslimit])
           memlimit = T.must(params[:memlimit])
-          protocol.kdf(@password, salt: salt, length: 32, opslimit: opslimit, memlimit: memlimit)
+          protocol.kdf(@password, salt:, length: 32, opslimit:, memlimit:)
         end
 
         sig { override.returns(String) }

data/lib/paseto/operations/pbkw.rb

@@ -30,11 +30,11 @@ module Paseto
         salt = @coder.random_salt
         nonce = @coder.random_nonce
 
-        pre_key = @coder.pre_key(salt: salt, params: opts)
+        pre_key = @coder.pre_key(salt:, params: opts)
 
-        edk = @coder.crypt(payload: key.to_bytes, key: pre_key, nonce: nonce)
+        edk = @coder.crypt(payload: key.to_bytes, key: pre_key, nonce:)
 
-        message, t = @coder.authenticate(header: h, pre_key: pre_key, salt: salt, nonce: nonce, edk: edk, params: opts)
+        message, t = @coder.authenticate(header: h, pre_key:, salt:, nonce:, edk:, params: opts)
 
         data = Util.encode64("#{message}#{t}")
         "#{h}.#{data}"
@@ -49,12 +49,12 @@ module Paseto
 
         @coder.decode(data) => {salt:, nonce:, edk:, tag:, params:}
 
-        pre_key = @coder.pre_key(salt: salt, params: params)
+        pre_key = @coder.pre_key(salt:, params:)
 
-        _, t2 = @coder.authenticate(header: header, pre_key: pre_key, salt: salt, nonce: nonce, edk: edk, params: params)
+        _, t2 = @coder.authenticate(header:, pre_key:, salt:, nonce:, edk:, params:)
         raise InvalidAuthenticator unless Util.constant_compare(t2, tag)
 
-        ptk = @coder.crypt(payload: edk, key: pre_key, nonce: nonce)
+        ptk = @coder.crypt(payload: edk, key: pre_key, nonce:)
         PaserkTypes.deserialize(header).generate(ptk)
       end
 

data/lib/paseto/operations/pke/p_k_ev3.rb

@@ -10,28 +10,24 @@ module Paseto
 
         include Interface::PKE
 
-        sig { override.params(esk: OpenSSL::PKey::EC).returns(String) }
-        def self.epk_bytes_from_esk(esk)
-          esk.public_key.to_octet_string(:compressed)
-        end
+        sig { override.returns(Protocol::Version3) }
+        attr_reader :protocol
 
-        sig(:final) { override.returns(OpenSSL::PKey::EC) }
-        def self.generate_ephemeral_key
-          OpenSSL::PKey::EC.generate('secp384r1')
-        end
+        sig { override.returns(String) }
+        attr_reader :header
 
-        sig(:final) { override.returns(String) }
-        def self.header
-          'k3.seal.'
-        end
+        sig { params(sealing_key: AsymmetricKey).void }
+        def initialize(sealing_key)
+          raise LucidityError unless sealing_key.is_a? V3::Public
 
-        sig { override.returns(Protocol::Version3) }
-        def self.protocol
-          Protocol::Version3.new
+          @header = T.let('k3.seal.', String)
+          @protocol = T.let(Protocol::Version3.instance, Protocol::Version3)
+          @sealing_key = T.let(sealing_key, V3::Public)
+          @pk = T.let(@sealing_key.public_bytes, String)
         end
 
         sig { override.params(encoded_data: String).returns([String, OpenSSL::PKey::EC::Point, String]) }
-        def self.split(encoded_data)
+        def split(encoded_data)
           data = Util.decode64(encoded_data)
 
           t = T.must(data.slice(0, 48))
@@ -44,14 +40,6 @@ module Paseto
           [t, epk, edk]
         end
 
-        sig { params(sealing_key: AsymmetricKey).void }
-        def initialize(sealing_key)
-          raise LucidityError unless sealing_key.is_a? V3::Public
-
-          @sealing_key = T.let(sealing_key, V3::Public)
-          @pk = T.let(@sealing_key.public_bytes, String)
-        end
-
         sig { override.params(message: String, ek: String, n: String).returns(SymmetricKey) }
         def decrypt(message:, ek:, n:)
           pdk = protocol.crypt(key: ek, nonce: n, payload: message)
@@ -67,7 +55,7 @@ module Paseto
           ek = T.must(x[0, 32])
           n = T.must(x[32, 16])
 
-          { ek: ek, n: n }
+          { ek:, n: }
         end
 
         sig { override.params(xk: String, epk: OpenSSL::PKey::EC::Point).returns(String) }
@@ -81,6 +69,16 @@ module Paseto
           protocol.crypt(payload: message, key: ek, nonce: n)
         end
 
+        sig { override.params(esk: OpenSSL::PKey::EC).returns(String) }
+        def epk_bytes_from_esk(esk)
+          esk.public_key.to_octet_string(:compressed)
+        end
+
+        sig(:final) { override.returns(OpenSSL::PKey::EC) }
+        def generate_ephemeral_key
+          OpenSSL::PKey::EC.generate('secp384r1')
+        end
+
         sig { override.params(ak: String, epk: OpenSSL::PKey::EC::Point, edk: String).returns(String) }
         def tag(ak:, epk:, edk:)
           epk_bytes = epk.to_octet_string(:compressed)

data/lib/paseto/operations/pke/p_k_ev4.rb

@@ -10,44 +10,18 @@ module Paseto
 
         include Interface::PKE
 
-        sig { override.params(esk: RbNaCl::PrivateKey).returns(String) }
-        def self.epk_bytes_from_esk(esk)
-          esk.public_key.to_bytes
-        end
-
-        sig(:final) { override.returns(RbNaCl::PrivateKey) }
-        def self.generate_ephemeral_key
-          RbNaCl::PrivateKey.generate
-        end
-
-        sig(:final) { override.returns(String) }
-        def self.header
-          'k4.seal.'
-        end
+        sig { override.returns(String) }
+        attr_reader :header
 
         sig { override.returns(Protocol::Version4) }
-        def self.protocol
-          Protocol::Version4.new
-        end
-
-        sig { override.params(encoded_data: String).returns([String, RbNaCl::PublicKey, String]) }
-        def self.split(encoded_data)
-          data = Util.decode64(encoded_data)
-
-          t = T.must(data.slice(0, 32))
-
-          epk_bytes = T.must(data.slice(32, 32))
-          epk = RbNaCl::PublicKey.new(epk_bytes)
-
-          edk = T.must(data.slice(64, 32))
-
-          [t, epk, edk]
-        end
+        attr_reader :protocol
 
         sig { params(sealing_key: AsymmetricKey).void }
         def initialize(sealing_key)
           raise LucidityError unless sealing_key.is_a? V4::Public
 
+          @header = T.let('k4.seal.', String)
+          @protocol = T.let(Protocol::Version4.instance, Protocol::Version4)
           @sealing_key = T.let(sealing_key, V4::Public)
           @pk = T.let(@sealing_key.x25519_public_key, RbNaCl::PublicKey)
           @pk_bytes = T.let(@pk.to_bytes, String)
@@ -61,13 +35,14 @@ module Paseto
 
         sig { override.params(xk: String, epk: RbNaCl::PublicKey).returns({ ek: String, n: String }) }
         def derive_ek_n(xk:, epk:)
+          epk_bytes = epk.to_bytes
           ek = protocol.digest(
-            "#{DOMAIN_SEPARATOR_ENCRYPT}#{header}#{xk}#{epk.to_bytes}#{@pk_bytes}",
+            "#{DOMAIN_SEPARATOR_ENCRYPT}#{header}#{xk}#{epk_bytes}#{@pk_bytes}",
             digest_size: 32
           )
-          n = protocol.digest("#{epk.to_bytes}#{@pk_bytes}", digest_size: 24)
+          n = protocol.digest("#{epk_bytes}#{@pk_bytes}", digest_size: 24)
 
-          { ek: ek, n: n }
+          { ek:, n: }
         end
 
         sig { override.params(xk: String, epk: RbNaCl::PublicKey).returns(String) }
@@ -80,6 +55,30 @@ module Paseto
           protocol.crypt(payload: message, key: ek, nonce: n)
         end
 
+        sig { override.params(esk: RbNaCl::PrivateKey).returns(String) }
+        def epk_bytes_from_esk(esk)
+          esk.public_key.to_bytes
+        end
+
+        sig(:final) { override.returns(RbNaCl::PrivateKey) }
+        def generate_ephemeral_key
+          RbNaCl::PrivateKey.generate
+        end
+
+        sig { override.params(encoded_data: String).returns([String, RbNaCl::PublicKey, String]) }
+        def split(encoded_data)
+          data = Util.decode64(encoded_data)
+
+          t = T.must(data.slice(0, 32))
+
+          epk_bytes = T.must(data.slice(32, 32))
+          epk = RbNaCl::PublicKey.new(epk_bytes)
+
+          edk = T.must(data.slice(64, 32))
+
+          [t, epk, edk]
+        end
+
         sig { override.params(ak: String, epk: RbNaCl::PublicKey, edk: String).returns(String) }
         def tag(ak:, epk:, edk:)
           protocol.hmac("#{header}#{epk.to_bytes}#{edk}", key: ak, digest_size: 32)

data/lib/paseto/operations/pke.rb

@@ -22,12 +22,12 @@ module Paseto
 
         xk = @sealing_key.ecdh(esk)
 
-        @coder.derive_ek_n(xk: xk, epk: epk) => {ek:, n:}
+        @coder.derive_ek_n(xk:, epk:) => {ek:, n:}
 
-        edk = @coder.encrypt(message: key.to_bytes, ek: ek, n: n)
+        edk = @coder.encrypt(message: key.to_bytes, ek:, n:)
 
-        ak = @coder.derive_ak(xk: xk, epk: epk)
-        t = @coder.tag(ak: ak, epk: epk, edk: edk)
+        ak = @coder.derive_ak(xk:, epk:)
+        t = @coder.tag(ak:, epk:, edk:)
 
         epk_bytes = @coder.epk_bytes_from_esk(esk)
         data = Util.encode64("#{t}#{epk_bytes}#{edk}")
@@ -37,20 +37,19 @@ module Paseto
       sig { params(paserk: String).returns(Interface::Key) }
       def unseal(paserk)
         paserk.split('.') => [version, type, encoded_data]
-        raise LucidityError unless version == @sealing_key.paserk_version
-        raise LucidityError unless type == 'seal'
+        raise LucidityError unless version == @sealing_key.paserk_version && type == 'seal'
 
         t, epk, edk = @coder.split(encoded_data)
 
         xk = @sealing_key.ecdh(epk)
 
-        ak = @coder.derive_ak(xk: xk, epk: epk)
-        t2 = @coder.tag(ak: ak, epk: epk, edk: edk)
+        ak = @coder.derive_ak(xk:, epk:)
+        t2 = @coder.tag(ak:, epk:, edk:)
         raise InvalidAuthenticator unless Util.constant_compare(t, t2)
 
-        @coder.derive_ek_n(xk: xk, epk: epk) => {ek:, n:}
+        @coder.derive_ek_n(xk:, epk:) => {ek:, n:}
 
-        @coder.decrypt(message: edk, ek: ek, n: n)
+        @coder.decrypt(message: edk, ek:, n:)
       end
     end
   end

data/lib/paseto/operations/wrap.rb

@@ -22,7 +22,7 @@ module Paseto
 
       sig { params(key: Interface::Key, wrapping_key: SymmetricKey, nonce: T.nilable(String)).returns(String) }
       def self.wrap(key, wrapping_key:, nonce: nil)
-        Wrappers::PIE.new(wrapping_key).encode(key, nonce: nonce)
+        Wrappers::PIE.new(wrapping_key).encode(key, nonce:)
       end
     end
   end

data/lib/paseto/paserk.rb

@@ -39,7 +39,7 @@ module Paseto
 
     sig { params(key: Interface::Key, wrapping_key: SymmetricKey, nonce: T.nilable(String)).returns(String) }
     def self.wrap(key:, wrapping_key:, nonce: nil)
-      Operations::Wrap.wrap(key, wrapping_key: wrapping_key, nonce: nonce)
+      Operations::Wrap.wrap(key, wrapping_key:, nonce:)
     end
 
     sig { params(key: Interface::Key, password: String, options: T::Hash[Symbol, T.any(Integer, Symbol)]).returns(String) }

data/lib/paseto/paserk_types.rb

@@ -32,9 +32,9 @@ module Paseto
         V3::Public.from_scalar_bytes(input)
       in K3Public
         V3::Public.from_public_bytes(input)
-      in K4LocalWrap | K4LocalPBKW | K4Local if Paseto.rbnacl? && input.bytesize == 32
+      in K4LocalWrap | K4LocalPBKW | K4Local if Paseto::HAS_RBNACL && input.bytesize == 32
         V4::Local.new(ikm: input)
-      in K4SecretWrap | K4SecretPBKW | K4Secret if Paseto.rbnacl? && input.bytesize == 64
+      in K4SecretWrap | K4SecretPBKW | K4Secret if Paseto::HAS_RBNACL && input.bytesize == 64
         V4::Public.from_keypair(input)
       in K4Public
         V4::Public.from_public_bytes(input)

data/lib/paseto/protocol/version3.rb

@@ -8,10 +8,11 @@ module Paseto
       extend T::Sig
       extend T::Helpers
 
+      include Singleton
       include Interface::Version
 
       sig(:final) { override.params(key: String, nonce: String, payload: String).returns(String) }
-      def self.crypt(key:, nonce:, payload:)
+      def crypt(key:, nonce:, payload:)
         cipher = OpenSSL::Cipher.new('aes-256-ctr')
         cipher.key = key
         cipher.iv = nonce
@@ -19,22 +20,22 @@ module Paseto
       end
 
       sig(:final) { override.params(data: String, digest_size: Integer).returns(String) }
-      def self.digest(data, digest_size:)
+      def digest(data, digest_size: 48)
         T.must(OpenSSL::Digest.digest('SHA384', data).byteslice(0, digest_size))
       end
 
       sig(:final) { override.returns(Integer) }
-      def self.digest_bytes
+      def digest_bytes
         48
       end
 
       sig(:final) { override.params(data: String, key: String, digest_size: Integer).returns(String) }
-      def self.hmac(data, key:, digest_size:)
+      def hmac(data, key:, digest_size: 48)
         T.must(OpenSSL::HMAC.digest('SHA384', key, data).byteslice(0, digest_size))
       end
 
       sig(:final) { override.returns(T.class_of(Operations::ID::IDv3)) }
-      def self.id
+      def id
         Operations::ID::IDv3
       end
 
@@ -46,53 +47,53 @@ module Paseto
           parameters: Integer
         ).returns(String)
       end
-      def self.kdf(password, salt:, length:, **parameters)
+      def kdf(password, salt:, length:, **parameters)
         OpenSSL::KDF.pbkdf2_hmac(
           password,
-          salt: salt,
-          length: length,
+          salt:,
+          length:,
           iterations: T.must(parameters[:iterations]),
           hash: 'SHA384'
         )
       end
 
       sig(:final) { override.returns(String) }
-      def self.paserk_version
+      def paserk_version
         'k3'
       end
 
       sig(:final) { override.returns(String) }
-      def self.pbkd_local_header
+      def pbkd_local_header
         'k3.local-pw'
       end
 
       sig(:final) { override.returns(String) }
-      def self.pbkd_secret_header
+      def pbkd_secret_header
         'k3.secret-pw'
       end
 
       sig(:final) { override.params(password: String).returns(Operations::PBKD::PBKDv3) }
-      def self.pbkw(password)
+      def pbkw(password)
         Operations::PBKD::PBKDv3.new(password)
       end
 
       sig(:final) { override.params(key: SymmetricKey).returns(Wrappers::PIE::PieV3) }
-      def self.pie(key)
+      def pie(key)
         Wrappers::PIE::PieV3.new(key)
       end
 
       sig(:final) { override.params(key: AsymmetricKey).returns(Operations::PKE::PKEv3) }
-      def self.pke(key)
+      def pke(key)
         Operations::PKE::PKEv3.new(key)
       end
 
       sig(:final) { override.params(size: Integer).returns(String) }
-      def self.random(size)
+      def random(size)
         SecureRandom.random_bytes(size)
       end
 
       sig(:final) { override.returns(String) }
-      def self.version
+      def version
         'v3'
       end
     end