sjcl 1.0.0 → 1.0.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 9bc27222ca1e75a41a1db9f11f8cb007b6a79874
-  data.tar.gz: 999c3ec4e08aef5f06daa2d60f6756f93f94331a
+  metadata.gz: 968c459e932db96eda2d7eb914fda7a0c21fba74
+  data.tar.gz: 559eb8fee1ca448515d7c88534e9e4bb6ff8857f
 SHA512:
-  metadata.gz: 716feceacd1b35b785cb122cf53aeb2735292b9e0765da504779fa5ff49fd13c3b4411ad9bb8215d753fcb8b0f3ff5c44270d4510cdd7157c5e350304f097e53
-  data.tar.gz: 1c8821376b8969072246b53058dc163b5250de237ed80aca1954d33f88f8f332993f9c478439d4b774ce7ad5c6a597084c5d743328a2f88daea865518e2f17c0
+  metadata.gz: 6718ccd8639b75d9d58cc76b8cfcc21add1f0750e7ed6396818e687bd323df9d90478493eea2031ce42207794cbc7fe6422add256a73ad895826663701bc6b99
+  data.tar.gz: feedec8ea9568bff8bb32f30802db9e685a3cb3ab97a139f67a487866a637b8d6cc30b3ebc09fbe7ace8e1a3a352b2d4a673c105ddb395177e484bd2838f6d19

data/README.md

@@ -32,6 +32,11 @@ gem install sjcl
 
 ### Changelog
 
+- 1.0.1
+  - Match comparison fucntion from SJCL js
+  - Include SJCL version in JSON
+  - Better errors thrown
+  - Update docs
 - 1.0.0
   - Update to use OpenSSL PBKDF2 function for increased speed
   - Increase default iterations to 100,000

data/lib/sjcl.rb

@@ -12,7 +12,7 @@ require 'base64'
 module SJCL
 
   DEFAULT = {
-    iter:100_000, ks:256, ts:64,
+    v:1, iter:100_000, ks:256, ts:64,
     mode:"ccm", adata:"", cipher:"aes"
   }
 

data/lib/sjcl/bit_array.rb

@@ -141,16 +141,15 @@ module SJCL::BitArray
   end
 
   # Compare two SJCL type BitArrays
-  # caveat: ignore out of band data
+  # in a predictable amount of time
   def self.compare(arr1, arr2)
+    x = 0
     return false if arr1.length != arr2.length
     arr1 = convertToSigned32(arr1)
     arr2 = convertToSigned32(arr2)
-    (arr1.length- 1).times do |i|
-      return false if arr1[i] != arr2[i]
+    (arr1.length).times do |i|
+      x = arr1[i] ^ arr2[i]
     end
-    # The last word is a funky use of a double
-    return false if arr2[arr2.length - 1] != arr1[arr1.length - 1]
-    return true
+    return (x == 0)
   end
 end

data/lib/sjcl/ccm.rb

@@ -1,5 +1,8 @@
 module SJCL::Mode
   module CCM
+    class TagAuthError < ::StandardError; end
+    class Error < ::StandardError; end
+
     NAME = "ccm"
 
     def self.encrypt(prf, plaintext, iv, adata=[], tlen=64)
@@ -7,7 +10,7 @@ module SJCL::Mode
       out = plaintext.dup
       ivl = SJCL::BitArray.bitLength(iv) / 8
       ol = SJCL::BitArray.bitLength(out) / 8
-      raise "ccm: IV must be at least 7 bytes" if ivl < 7
+      raise Error, "ccm: IV must be at least 7 bytes" if ivl < 7
       while ccml < 4 && ((ol & 0xFFFFFFFF) >> 8*ccml > 0)
         ccml += 1
       end
@@ -28,7 +31,7 @@ module SJCL::Mode
       tag = SJCL::BitArray.bitSlice(ciphertext, ol - tlen)
 
       ol = (ol - tlen) / 8;
-      raise "ccm: iv must be at least 7 bytes" if (ivl < 7)
+      raise Error, "ccm: iv must be at least 7 bytes" if (ivl < 7)
 
       # compute the length of the length
       while ccml < 4 && ((ol & 0xFFFFFFFF) >> 8*ccml > 0)
@@ -46,7 +49,7 @@ module SJCL::Mode
       # check the tag
       tag2 = computeTag(prf, out[:data], iv, adata, tlen, ccml)
       if (!SJCL::BitArray.compare(out[:tag], tag2))
-        raise "ccm: tag doesn't match"
+        raise TagAuthError, "ccm: tag doesn't match"
       end
       return out[:data]
     end
@@ -54,7 +57,7 @@ module SJCL::Mode
     def self.computeTag(prf, plaintext, iv, adata, tlen, l)
       tlen /= 8
       if (tlen % 2 != 0 || tlen < 4 || tlen > 16)
-        raise "ccm: invalid tag length"
+        raise Error, "ccm: invalid tag length"
       end
 
       # mac the flags

data/lib/sjcl/version.rb

@@ -1,3 +1,3 @@
 module SJCL
-  VERSION = "1.0.0"
+  VERSION = "1.0.1"
 end

data/spec/integration_spec.rb

@@ -28,4 +28,19 @@ describe "the SJCL aes crypto" do
     puts "sjcl.decrypt('s33krit','#{result}')"
     # Checking this by hand for now :(
   end
+
+  it "should fail to decrypt tampered with adata tag" do
+    json = '{"iv":"+Y+RZjk81MN9wkLVRgfLkA==","v":1,"iter":10000,"ks":256,"ts":64,"mode":"ccm","adata":"Tampered","cipher":"aes","salt":"4TD5tILYe6U=","ct":"NUeGvbXWVEmssnSGORpVSl1OefdLHjU2yPZnxVsPifyD1TJ3+w=="}'
+    expect {
+      SJCL.decrypt('s33krit', json)
+    }.to raise_error SJCL::Mode::CCM::TagAuthError
+  end
+
+  it "should fail to decrypt tampered with crypts" do
+    json = '{"iv":"+Y+RZjk81MN9wkLVRgfLkA==","v":1,"iter":10000,"ks":256,"ts":64,"mode":"ccm","adata":"","cipher":"aes","salt":"4TD5tILYe6U=","ct":"NUeGvbXWVEmssnSGORpVSl1OefdLHjU2yPZnxVsPifyD1tJ3+w=="}'
+    expect {
+      SJCL.decrypt('s33krit', json)
+    }.to raise_error SJCL::Mode::CCM::TagAuthError
+  end
+
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: sjcl
 version: !ruby/object:Gem::Version
-  version: 1.0.0
+  version: 1.0.1
 platform: ruby
 authors:
 - Mark Percival
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-01-07 00:00:00.000000000 Z
+date: 2015-01-08 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake