sshkeyproof 0.1

data/CHANGELOG

@@ -0,0 +1,2 @@
+v0.1. first version
+

data/Manifest

@@ -0,0 +1,6 @@
+CHANGELOG
+Manifest
+README.md
+Rakefile
+lib/sshkeyauth.rb
+test/test_all.rb

data/README.md

@@ -0,0 +1,24 @@
+
+h3. gem install 'sshkeyproof'
+
+If you have a user's public key, you can verify they are who they say they are (ie. they hold the correspending private key):
+    
+
+h3. Client
+
+The client takes their private key (defaults to ~/.ssh/id_rsa) and encrypts a random string as proof of work.
+
+    request = Sshkeyproof::Client.new key_file: "./id_rsa"
+    
+    
+h3. Server
+
+The server takes the request string and verifies it
+
+    s = Sshkeyproof::Server.new request
+ 
+    s.fingerprint # => public key SHA1 fingerprint
+
+    s.correct?(public_key)   # => true
+
+

data/Rakefile

@@ -0,0 +1,9 @@
+require 'echoe'
+
+Echoe.new('sshkeyproof') do |p|
+  p.author = "Andrew Snow"
+  p.email = 'andrew@modulus.org'
+  p.summary = 'Ruby gem to prove client has the other half of a keypair'
+  p.url = 'https://github.com/andys/sshkeyproof'
+  p.runtime_dependencies = ['sshkey']
+end

data/lib/sshkeyauth.rb

@@ -0,0 +1,38 @@
+
+require 'openssl'
+require 'sshkey'
+
+module Sshkeyproof
+  class Client
+    def initialize(params={})
+      key_file = params[:key_file] || '~/.ssh/id_rsa'
+      ssh_key  = params[:ssh_key] || File.read(key_file)
+      openssl_key = params[:openssl_key] || OpenSSL::PKey::RSA.new(ssh_key)
+      @privkey = openssl_key if openssl_key.private?
+      @pubkey = @privkey && @privkey.public_key || openssl_key
+    end
+    
+    def random
+      @random ||= OpenSSL::Random.random_bytes(10).unpack('H*').first
+    end
+    
+    def request
+      ciphertext = @privkey.private_encrypt(random).unpack('H*').first
+      "#{SSHKey.sha1_fingerprint(@pubkey.to_s)}|#{random.unpack('H*').first}|#{ciphertext}"
+    end
+    
+  end
+  
+  class Server
+    attr_reader :fingerprint
+    def initialize(request_string)
+      (@fingerprint,@random,@ciphertext) = request_string.to_s.split("|")
+    end
+    
+    def correct?(key)
+      openssl_key = String===key ? OpenSSL::PKey::RSA.new(key) : key
+      @fingerprint && @random && @ciphertext && openssl_key.public_key.public_decrypt([@ciphertext].pack('H*')) == [@random].pack('H*') rescue nil
+    end
+  end
+  
+end

data/sshkeyproof.gemspec

@@ -0,0 +1,33 @@
+# -*- encoding: utf-8 -*-
+
+Gem::Specification.new do |s|
+  s.name = "sshkeyproof"
+  s.version = "0.1"
+
+  s.required_rubygems_version = Gem::Requirement.new(">= 1.2") if s.respond_to? :required_rubygems_version=
+  s.authors = ["Andrew Snow"]
+  s.date = "2013-01-24"
+  s.description = "Ruby gem to prove client has the other half of a keypair"
+  s.email = "andrew@modulus.org"
+  s.extra_rdoc_files = ["CHANGELOG", "README.md", "lib/sshkeyauth.rb"]
+  s.files = ["CHANGELOG", "Manifest", "README.md", "Rakefile", "lib/sshkeyauth.rb", "test/test_all.rb", "sshkeyproof.gemspec"]
+  s.homepage = "https://github.com/andys/sshkeyproof"
+  s.rdoc_options = ["--line-numbers", "--inline-source", "--title", "Sshkeyproof", "--main", "README.md"]
+  s.require_paths = ["lib"]
+  s.rubyforge_project = "sshkeyproof"
+  s.rubygems_version = "1.8.24"
+  s.summary = "Ruby gem to prove client has the other half of a keypair"
+  s.test_files = ["test/test_all.rb"]
+
+  if s.respond_to? :specification_version then
+    s.specification_version = 3
+
+    if Gem::Version.new(Gem::VERSION) >= Gem::Version.new('1.2.0') then
+      s.add_runtime_dependency(%q<sshkey>, [">= 0"])
+    else
+      s.add_dependency(%q<sshkey>, [">= 0"])
+    end
+  else
+    s.add_dependency(%q<sshkey>, [">= 0"])
+  end
+end

data/test/test_all.rb

@@ -0,0 +1,36 @@
+require "#{File.dirname(__FILE__)}/../lib/sshkeyproof"
+require 'test/unit'
+
+ class TestSshkeyproof < Test::Unit::TestCase
+  def setup
+    @ssh_key = SSHKey.generate(type:"RSA", bits:1024, comment:"foo@bar.com")
+    @client = Sshkeyproof::Client.new ssh_key: @ssh_key.private_key
+    @request = @client.request
+  end
+
+  def test_success
+    server = Sshkeyproof::Server.new @request
+    assert_equal true, server.correct?(@ssh_key.public_key)
+  end
+  
+  def test_bad_ciphertext
+    badrequest = @request.dup
+    
+    #fiddle the cipher text
+    badrequest[-3] = '0'
+    badrequest[-2] = '0'
+    badrequest[-1] = '0'
+    
+    server = Sshkeyproof::Server.new badrequest
+    assert_equal nil, server.correct?(@ssh_key.public_key)
+  end
+
+  def test_wrong_key
+    ssh_key2 = SSHKey.generate(type:"RSA", bits:1024, comment:"foo@bar.com")
+    client2 = Sshkeyproof::Client.new ssh_key: ssh_key2.private_key
+    request2 = client2.request
+
+    server = Sshkeyproof::Server.new request2
+    assert_equal nil, server.correct?(@ssh_key.public_key)
+  end
+end

metadata

@@ -0,0 +1,77 @@
+--- !ruby/object:Gem::Specification
+name: sshkeyproof
+version: !ruby/object:Gem::Version
+  prerelease: 
+  version: '0.1'
+platform: ruby
+authors:
+- Andrew Snow
+autorequire: 
+bindir: bin
+cert_chain: []
+date: 2013-01-24 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+    none: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+    none: false
+  name: sshkey
+  prerelease: false
+  type: :runtime
+description: Ruby gem to prove client has the other half of a keypair
+email: andrew@modulus.org
+executables: []
+extensions: []
+extra_rdoc_files:
+- CHANGELOG
+- README.md
+- lib/sshkeyauth.rb
+files:
+- CHANGELOG
+- Manifest
+- README.md
+- Rakefile
+- lib/sshkeyauth.rb
+- test/test_all.rb
+- sshkeyproof.gemspec
+homepage: https://github.com/andys/sshkeyproof
+licenses: []
+post_install_message: 
+rdoc_options:
+- --line-numbers
+- --inline-source
+- --title
+- Sshkeyproof
+- --main
+- README.md
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ! '>='
+    - !ruby/object:Gem::Version
+      version: '0'
+  none: false
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ! '>='
+    - !ruby/object:Gem::Version
+      version: '1.2'
+  none: false
+requirements: []
+rubyforge_project: sshkeyproof
+rubygems_version: 1.8.24
+signing_key: 
+specification_version: 3
+summary: Ruby gem to prove client has the other half of a keypair
+test_files:
+- test/test_all.rb