smaak 0.0.5 → 0.0.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: ddec83cc7a5d5c010e63518fd89b5fe8fc5bf7bf
-  data.tar.gz: a5f99cbce942c1d6a206e497efa1695816bfdfae
+  metadata.gz: 79837f66e4da4cd06c198b68f4ed72c059b3f0b5
+  data.tar.gz: ce28822db26ceb509362dd03e66da05971b14e8f
 SHA512:
-  metadata.gz: 2a9a7b93c4c338723c6e7cd7411fa710a8d15d73ab64144df0efdcdc4699abf3649ef163adf7583252dc213b57dc925b3f5c2ba813fa578987cd2b8f4806fd3d
-  data.tar.gz: a6e58e031f5258a628698fd795f6ecb5214c48da051c8c234459c1756e2fb78e671283c9b4ff041c26727db488d086e8e743240d07c78a4df802532af6810a43
+  metadata.gz: 887a641de2a26636eb03a6ffba6f8fde13f43bd2d7563380688fe0d4d129d4630c66594b1ab1aa65d9d3f7d22894b779bd87797ccce42202d2f5039caaf0f7b6
+  data.tar.gz: cde62c30f2a56a78acd2de3df92b349e563bfe3c4c34384ff593692a45c4a32d80f7ea575069bfecee62b28b146b8a5f580ddf044b0e0cde289162a63cd4973b

data/README.md

@@ -16,6 +16,28 @@ Or install it yourself as:
 
     $ gem install smaak
 
+## Use cases
+
+This gem and mechanism is attempts to alleviate the following attacks and concerns for inter-service communication. This is not a public client/server mechanism.
+
+Man-in-the-middle attack:
+
+Use this gem to communicate inside an HTTP tunnel that you trust. For internal private networks, place a secure CA on your network.
+
+Masquerading:
+
+Each association made requires messages to be signed using that association's keypair.
+
+Forgery:
+
+The indentity of the requestor is signed. The HTTP headers, URL and body / querystring is not. Authorization is left to a service that understands the identity and its permissions.
+
+Replay:
+
+The request is signed with an expiry and a nonce.
+
+Designing for future protocol security requirements. The nonce and expiry are optional features. Passing in a RequestData object for signing, and a RequestSigningValidator object that validates the data content includes all that is required for security, allows us to, in future, cater for man-in-the-middle attacks as well if, for example, the validator requires timestamp, url, form data/querystring, method, etc. to be in the data. If this is all signed, a device in the middle cannot modify the request without the source's private key, and man-in-the-middle is defeated.
+
 ## Usage
 
 TODO: Write usage instructions here

data/lib/smaak/client.rb

@@ -14,7 +14,7 @@ module Smaak
       @identity = identity
     end
 
-    def build_auth_header(associate_identity)
+    def build_auth_header(associate_identity, request_signing_data = nil, request_signing_data_validator = nil)
       raise ArgumentError.new("Associate invalid") if not validate_associate(associate_identity)
       associate = @association_store[associate_identity]
       message_data = Smaak::compile_auth_message_data(associate['public_key'], associate['psk'], @token_life, @identity)

data/lib/smaak/version.rb

@@ -1,3 +1,3 @@
 module Smaak
-  VERSION = "0.0.5"
+  VERSION = "0.0.6"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: smaak
 version: !ruby/object:Gem::Version
-  version: 0.0.5
+  version: 0.0.6
 platform: ruby
 authors:
 - Ernst van Graan