json-jwt-1.6.2/0000755000175600017570000000000012736141241012335 5ustar pravipravijson-jwt-1.6.2/spec/0000755000175600017570000000000012736141241013267 5ustar pravipravijson-jwt-1.6.2/spec/fixtures/0000755000175600017570000000000012736141241015140 5ustar pravipravijson-jwt-1.6.2/spec/fixtures/ecdsa/0000755000175600017570000000000012736141241016217 5ustar pravipravijson-jwt-1.6.2/spec/fixtures/ecdsa/384/0000755000175600017570000000000012736141241016535 5ustar pravipravijson-jwt-1.6.2/spec/fixtures/ecdsa/384/public_key.pem0000644000175600017570000000032612736141241021367 0ustar pravipravi-----BEGIN PUBLIC KEY----- MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEplzApyFnK7qzhg5XnIZbFj2hZoH2Vdl4 +RFm7DnsNMG9tyqrpfq2RyjfKABbcFRtixBzffhk3fcbmeipGLkvQBNCzeNm6QL3 hOUTH6IFBzOL0Y7HsGTopNTTspLjlivb -----END PUBLIC KEY-----json-jwt-1.6.2/spec/fixtures/ecdsa/384/private_key.pem0000644000175600017570000000044012736141241021560 0ustar pravipravi-----BEGIN EC PRIVATE KEY----- MIGkAgEBBDB1NRLzYeQa7oRUwWrnQFZOBVqzlyJ9n654/PFjCLJh/A/uGWeECoM2 1hXEvp80pqGgBwYFK4EEACKhZANiAASmXMCnIWcrurOGDlechlsWPaFmgfZV2Xj5 EWbsOew0wb23Kqul+rZHKN8oAFtwVG2LEHN9+GTd9xuZ6KkYuS9AE0LN42bpAveE 5RMfogUHM4vRjsewZOik1NOykuOWK9s= -----END EC PRIVATE KEY----- json-jwt-1.6.2/spec/fixtures/ecdsa/512/0000755000175600017570000000000012736141241016526 5ustar pravipravijson-jwt-1.6.2/spec/fixtures/ecdsa/512/public_key.pem0000644000175600017570000000041312736141241021355 0ustar pravipravi-----BEGIN PUBLIC KEY----- MIGbMBAGByqGSM49AgEGBSuBBAAjA4GGAAQBwwIP5rRrqucT1O8LSY6oX8MZdGDl jeJNvh4c3BObaQPqK6PH0z9/x38UYevQ6GmrMSfitg9hmi4axsg8SAvSr/8BQtgR 3yX5tX8Ejbz1p7OFItnVEMXaW2AM8TL1jti2phrhwlymLLNUMyldbAGnpyODpNcg 2ShWtVdmE3jTiKG7gjY= -----END PUBLIC KEY-----json-jwt-1.6.2/spec/fixtures/ecdsa/512/private_key.pem0000644000175600017570000000055412736141241021557 0ustar pravipravi-----BEGIN EC PRIVATE KEY----- MIHcAgEBBEIBBpwKqvGEZGpE3wX1fDzJjrrM4uXr16WKsijjqjRP8tHdnvr5p2fO zrPVyDVbiQDulOhSh9aouunuwmbudKjWvZagBwYFK4EEACOhgYkDgYYABAHDAg/m tGuq5xPU7wtJjqhfwxl0YOWN4k2+HhzcE5tpA+oro8fTP3/HfxRh69DoaasxJ+K2 D2GaLhrGyDxIC9Kv/wFC2BHfJfm1fwSNvPWns4Ui2dUQxdpbYAzxMvWO2LamGuHC XKYss1QzKV1sAaenI4Ok1yDZKFa1V2YTeNOIobuCNg== -----END EC PRIVATE KEY-----json-jwt-1.6.2/spec/fixtures/ecdsa/256/0000755000175600017570000000000012736141241016533 5ustar pravipravijson-jwt-1.6.2/spec/fixtures/ecdsa/256/public_key.pem0000644000175600017570000000026112736141241021363 0ustar pravipravi-----BEGIN PUBLIC KEY----- MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEsaPyrO4Lh9kh2FxrF9y1QVmZznWn RRJwpr12UHqzrVYwzPhb3POqWsmGqv4nKum+WdogjJlAToN+uA+TEwDDUw== -----END PUBLIC KEY-----json-jwt-1.6.2/spec/fixtures/ecdsa/256/private_key.pem0000644000175600017570000000034212736141241021557 0ustar pravipravi-----BEGIN EC PRIVATE KEY----- MHcCAQEEIHo5LvIgMVpOlEKjjZiE5n+xYtTxLm4Eumx7FRMgICyDoAoGCCqGSM49 AwEHoUQDQgAEsaPyrO4Lh9kh2FxrF9y1QVmZznWnRRJwpr12UHqzrVYwzPhb3POq WsmGqv4nKum+WdogjJlAToN+uA+TEwDDUw== -----END EC PRIVATE KEY-----json-jwt-1.6.2/spec/fixtures/rsa/0000755000175600017570000000000012736141241015725 5ustar pravipravijson-jwt-1.6.2/spec/fixtures/rsa/private_key.der0000644000175600017570000000230212736141241020740 0ustar pravipravi00  *H 0ͅүz@9_ăDyi%3K?m IT'jyW0>[y ]+O MF?36℞KElG2A3Ƀi{)۽Ni<DM F5 ˚%$ z[rOhsV]')yZ!8TfH'!-@fSLփ.'o|H%H@Cܳ1Lǫ6a?yjJ蕊_:=N=,}sK|PaoҿwI{jB;>ogG}4-Ayzs8c%腙dž6TmSqLӚ*J.}]cg,5& 4?8n 5AOɣjrݒsDw!H q!7L эx4r4\`4mױvwRq.Mg= Um_ĸfMվ3*W8x%)u8cʳT0tƓBje￁(% T׌عU-B mKm>O=Oz^L5޷OKҝILwen;EMc7lq t7ݬ(/M{EP8`J>қ  1]&ǯ1Lyz뭸MRz .?6sSޠG?6|fO_e0kU});qv &pu21 V3ӨRAhw8n=%U" V8%B>\ Gcg wC%]!.Rnjۿ"vu<@ہ7/TK1pCj_~y'rfB*DhRfOPOYǭ_Y4sXW3omڈGԍ ƱUh*Q;( 0C45C$p(蛫JP%j/Ҝ~:U|*Aޫo(fĆSV,K20)Â*?3/;U0 q\ {'\8i5UlNS~ĺGSکc+lW?+5&ڤ?=~jmn7= '2.0.0' && OpenSSL::OPENSSL_VERSION >= 'OpenSSL 1.0.1' end require 'helpers/sign_key_fixture_helper' require 'helpers/nimbus_spec_helper' json-jwt-1.6.2/spec/helpers/0000755000175600017570000000000012736141241014731 5ustar pravipravijson-jwt-1.6.2/spec/helpers/sign_key_fixture_helper.rb0000644000175600017570000000206412736141241022175 0ustar pravipravimodule SignKeyFixtureHelper def shared_secret 'shared-secret' end def pem_file(file_name) File.new pem_file_path(file_name) end def pem_file_path(file_name) File.join( File.dirname(__FILE__), "../fixtures/#{file_name}.pem" ) end def der_file_path(file_name) File.join( File.dirname(__FILE__), "../fixtures/#{file_name}.der" ) end def private_key(algorithm = :rsa, options = {}) case algorithm when :rsa OpenSSL::PKey::RSA.new( pem_file("#{algorithm}/private_key"), 'pass-phrase' ) when :ecdsa OpenSSL::PKey::EC.new( pem_file("#{algorithm}/#{options[:digest_length] || 256}/private_key") ) end end def public_key(algorithm = :rsa, options = {}) case algorithm when :rsa OpenSSL::PKey::RSA.new( pem_file("#{algorithm}/public_key") ) when :ecdsa OpenSSL::PKey::EC.new( pem_file("#{algorithm}/#{options[:digest_length] || 256}/public_key") ) end end end include SignKeyFixtureHelperjson-jwt-1.6.2/spec/helpers/nimbus_spec_helper.rb0000644000175600017570000000054512736141241021130 0ustar pravipravimodule NimbusSpecHelper module_function def setup nimbus_path = File.expand_path( File.join( File.dirname(__FILE__), 'json-jwt-nimbus', 'nimbus_jwe.rb' ) ) if File.exist? nimbus_path require nimbus_path end end def nimbus_available? defined? NimbusJWE end end NimbusSpecHelper.setupjson-jwt-1.6.2/spec/json/0000755000175600017570000000000012736141241014240 5ustar pravipravijson-jwt-1.6.2/spec/json/jws_spec.rb0000644000175600017570000002467112736141241016414 0ustar pravipravirequire 'spec_helper' describe JSON::JWS do let(:alg) { :none } let(:jwt) do _jwt_ = JSON::JWT.new claims _jwt_.alg = alg _jwt_ end let(:jws) { JSON::JWS.new jwt } let(:signed) { jws.sign! private_key_or_secret } let(:decoded) { JSON::JWT.decode signed.to_s, public_key_or_secret } let(:claims) do { iss: 'joe', exp: 1300819380, :'http://example.com/is_root' => true } end let(:expected_signature) do { :HS256 => 'DyuTgO2Ggb5nrhkkhI-RjVYIBe3o8oL4ijkAn94YPxQ', :HS384 => 'a5-7rr61TG8Snv9xxJ7l064ky-SCq1Mswe9t8HEorvoc_nnfIeUy9WQCLMIli34R', :HS512 => 'ce-GlHDaNwaHfmAFRGp3QPPKvrpruTug2hC1bf6yNlbuvkMwJw2jFZgq_4wmIPetRdiBy7XFq7rrtmw1Im7tmQ', :RS256 => 'E5VELqAdla2Bx1axc9KFxO0EiCr0Mw6HPYX070qGQ8zA_XmyxGPUZLyyWU_6Cn399W-oYBWO2ynLlr8pqqjP3jXevyCeYeGRVN0HzLYiBebEugNnc3hevr7WV2UzfksWRA-Ux2bDv2sz9p_LGbL33wWNxGDvIlpDyZUul_a48nCipS0riBjkTLTSE8dfBxQTXEF5GEUUu99ot6aBLzUhc25nHXSXogXF6MHK-hAcE7f4v-vJ0lbPbHLVGUopIoxoqe4XjoBpzE5UvhrVl5LYbdjbyJhu5ZIA8GLsgwtUFh3dfdIechORoR3k5NSFSv8157bAEa8t4iwgWD2MSNSQnw', :RS384 => 'lT5JbytGKgG9QrwkJuxgw7UjmN9tjkEQW9pVGR2XnKEdC0_wLNIzAmT-jTwyMDGBLUkWO7opDOP6Xy6_DOTg58k9PwVkyQzrLnmxJMEng2Q-aMqcitRSIvUk3DPy8kemp8yUPls9NzWmByM2GoUVHbDsR0r-tZN-g_9QYev32mvMhjMr30JI5S2xiRjc9m2GAaXMOQmNTovJgV4bgCp4UjruCrA0BD1JJwDqKYoR_YYr_ALcVjD_LUgy80udJvbi8MAYJVUf0QYtQDrX2wnT_-eiiWjD5XafLuXEQVDRh-v2MKAwdvtXMq5cZ08Zjl2SyHxJ3OqhEeWPvYGltxZh_A', :RS512 => 'EHeGM2Mo3ghhUfSB99AlREehrbC6OPE-nYL_rwf88ysTnJ8L1QQ0UuCrXq4SpRutGLK_bYTK3ZALvFRPoOgK_g0QWmqv6qjQRU_QTxoq8y8APP-IgKKDuIiGH6daBV2rAPLDReqYNKsKjmTvZJo2c0a0e_WZkkj_ZwpgjTG3v0gW9lbDAzLJDz18eqtR4ZO7JTu_fyNrUrNk-w2_wpxSsn9sygIMp0lKE0_pt0b01fz3gjTDjlltU0cKSalUp4geaBDH7QRcexrolIctdQFbNKTXQxoigxD3NLNkKGH7f6A8KZdcOm8AnEjullcZs8_OWGnW43p1qrxoBRSivb9pqQ' } end shared_examples_for :jwt_with_alg do it { should == jwt } its(:header) { should == jwt.header } end context 'before sign' do subject { jws } it_behaves_like :jwt_with_alg its(:signature) { should be_nil } end describe '#content_type' do it do jws.content_type.should == 'application/jose' end end describe '#sign!' do shared_examples_for :generate_expected_signature do it do UrlSafeBase64.encode64(signed.signature).should == expected_signature[alg] end end subject { signed } [:HS256, :HS384, :HS512].each do |algorithm| describe algorithm do let(:alg) { algorithm } context 'when String key given' do let(:private_key_or_secret) { shared_secret } it_behaves_like :jwt_with_alg it_behaves_like :generate_expected_signature end context 'when JSON::JWK key given' do let(:private_key_or_secret) { JSON::JWK.new shared_secret } it_behaves_like :jwt_with_alg it_behaves_like :generate_expected_signature end end end [:RS256, :RS384, :RS512].each do |algorithm| describe algorithm do let(:alg) { algorithm } context 'when OpenSSL::PKey::RSA key given' do let(:private_key_or_secret) { private_key } it_behaves_like :jwt_with_alg it_behaves_like :generate_expected_signature end context 'when JSON::JWK key given' do let(:private_key_or_secret) { JSON::JWK.new private_key } it_behaves_like :jwt_with_alg it_behaves_like :generate_expected_signature end end end [:ES256, :ES384, :ES512].each do |algorithm| describe algorithm do let(:alg) { algorithm } shared_examples_for :self_verifiable do it 'should be self-verifiable' do expect do JSON::JWT.decode( JSON::JWT.new(claims).sign( private_key_or_secret, algorithm ).to_s, public_key_or_secret ) end.not_to raise_error end end context 'when OpenSSL::PKey::EC key given' do let(:private_key_or_secret) { private_key :ecdsa, digest_length: algorithm.to_s[2,3].to_i } let(:public_key_or_secret) { public_key :ecdsa, digest_length: algorithm.to_s[2,3].to_i } it_behaves_like :jwt_with_alg it_behaves_like :self_verifiable end context 'when JSON::JWK key given' do let(:private_key_or_secret) { JSON::JWK.new(private_key :ecdsa, digest_length: algorithm.to_s[2,3].to_i) } let(:public_key_or_secret) { JSON::JWK.new(public_key :ecdsa, digest_length: algorithm.to_s[2,3].to_i) } it_behaves_like :jwt_with_alg it_behaves_like :self_verifiable end end end context 'when JSON::JWK::Set key given' do let(:alg) { :HS256 } let(:kid) { 'kid' } let(:jwks) do jwk = JSON::JWK.new shared_secret, kid: kid JSON::JWK::Set.new jwk, JSON::JWK.new('another') end let(:signed) { jws.sign!(jwks) } context 'when jwk is found by given kid' do before { jws.kid = kid } it { should == jws.sign!('secret') } end context 'otherwise' do it do expect do subject end.to raise_error JSON::JWK::Set::KidNotFound end end end describe 'unknown algorithm' do let(:alg) { :unknown } it do expect do jws.sign! 'key' end.to raise_error JSON::JWS::UnexpectedAlgorithm end end end describe '#verify!' do shared_examples_for :success_signature_verification do it do expect { decoded }.not_to raise_error decoded.should be_a JSON::JWT end describe 'header' do let(:header) { decoded.header } it 'should be parsed successfully' do header[:typ].should == 'JWT' header[:alg].should == alg.to_s end end describe 'claims' do it 'should be parsed successfully' do decoded[:iss].should == 'joe' decoded[:exp].should == 1300819380 decoded[:'http://example.com/is_root'] == true end end end subject { decoded } [:HS256, :HS384, :HS512].each do |algorithm| describe algorithm do let(:alg) { algorithm } let(:private_key_or_secret) { shared_secret } context 'when String key given' do let(:public_key_or_secret) { shared_secret } it_behaves_like :success_signature_verification end context 'when JSON::JWK key given' do let(:public_key_or_secret) { JSON::JWK.new shared_secret } it_behaves_like :success_signature_verification end end end [:RS256, :RS384, :RS512].each do |algorithm| describe algorithm do let(:alg) { algorithm } let(:private_key_or_secret) { private_key } context 'when OpenSSL::PKey::RSA key given' do let(:public_key_or_secret) { public_key } it_behaves_like :success_signature_verification end context 'when JSON::JWK key given' do let(:public_key_or_secret) { JSON::JWK.new public_key } it_behaves_like :success_signature_verification end end end [:ES256, :ES384, :ES512].each do |algorithm| describe algorithm do let(:alg) { algorithm } let(:private_key_or_secret) { private_key :ecdsa, digest_length: algorithm.to_s[2,3].to_i } context 'when OpenSSL::PKey::EC key given' do let(:public_key_or_secret) { public_key :ecdsa, digest_length: algorithm.to_s[2,3].to_i } it_behaves_like :success_signature_verification end context 'when JSON::JWK key given' do let(:public_key_or_secret) { JSON::JWK.new public_key(:ecdsa, digest_length: algorithm.to_s[2,3].to_i) } it_behaves_like :success_signature_verification end end end context 'when JSON::JWK::Set key given' do subject { JSON::JWT.decode signed.to_s, jwks } let(:alg) { :HS256 } let(:kid) { 'kid' } let(:jwks) do jwk = JSON::JWK.new shared_secret, kid: kid JSON::JWK::Set.new jwk, JSON::JWK.new('another') end let(:signed) { jws.sign!(jwks) } context 'when jwk is found by given kid' do before { jws.kid = kid } it { should == signed } end context 'otherwise' do it do expect do subject end.to raise_error JSON::JWK::Set::KidNotFound end end end describe 'unknown algorithm' do let(:alg) { :unknown } it do expect do jws.verify! 'key' end.to raise_error JSON::JWS::UnexpectedAlgorithm end end end describe 'to_json' do let(:alg) { :RS256 } let(:private_key_or_secret) { private_key } context 'as default' do it 'should JSONize payload' do jws.to_json.should == claims.to_json end end context 'when syntax option given' do context 'when general' do it 'should return General JWS JSON Serialization' do signed.to_json(syntax: :general).should == { payload: UrlSafeBase64.encode64(claims.to_json), signatures: [{ protected: UrlSafeBase64.encode64(signed.header.to_json), signature: UrlSafeBase64.encode64(signed.signature) }] }.to_json end context 'when not signed yet' do it 'should not fail' do jws.to_json(syntax: :general).should == { payload: UrlSafeBase64.encode64(claims.to_json), signatures: [{ protected: UrlSafeBase64.encode64(jws.header.to_json), signature: UrlSafeBase64.encode64('') }] }.to_json end end end context 'when flattened' do it 'should return Flattened JWS JSON Serialization' do signed.to_json(syntax: :flattened).should == { protected: UrlSafeBase64.encode64(signed.header.to_json), payload: UrlSafeBase64.encode64(claims.to_json), signature: UrlSafeBase64.encode64(signed.signature) }.to_json end context 'when not signed yet' do it 'should not fail' do jws.to_json(syntax: :flattened).should == { protected: UrlSafeBase64.encode64(jws.header.to_json), payload: UrlSafeBase64.encode64(claims.to_json), signature: UrlSafeBase64.encode64('') }.to_json end end end end end end json-jwt-1.6.2/spec/json/jwk_spec.rb0000644000175600017570000001256312736141241016401 0ustar pravipravirequire 'spec_helper' describe JSON::JWK do describe '#initialize' do let(:jwk) { JSON::JWK.new key } subject { jwk } shared_examples_for :jwk_with_kid do it { should be_instance_of JSON::JWK } describe 'kid' do subject { jwk[:kid] } it { should == jwk.thumbprint } end end shared_examples_for :jwk_without_kid do it { should be_instance_of JSON::JWK } describe 'kid' do subject { jwk[:kid] } it { should be_blank } end end context 'with OpenSSL::PKey::RSA' do let(:key) { public_key } it_behaves_like :jwk_with_kid end context 'with OpenSSL::PKey::EC' do let(:key) { public_key :ecdsa } it_behaves_like :jwk_with_kid end context 'with String' do let(:key) { 'secret' } it_behaves_like :jwk_with_kid end context 'with JSON::JWK' do let(:key) do JSON::JWK.new( k: 'secret', kty: :oct ) end it_behaves_like :jwk_with_kid end context 'with Hash' do let(:key) do { k: 'secret', kty: :oct } end it_behaves_like :jwk_with_kid end context 'with nothing' do let(:jwk) { JSON::JWK.new } it_behaves_like :jwk_without_kid end end describe '#content_type' do let(:jwk) { JSON::JWK.new public_key } it do jwk.content_type.should == 'application/jwk+json' end end context 'when RSA public key given' do let(:jwk) { JSON::JWK.new public_key } it { jwk.keys.collect(&:to_sym).should include :kty, :e, :n } its(:kty) { jwk[:kty].should == :RSA } its(:e) { jwk[:e].should == UrlSafeBase64.encode64(public_key.e.to_s(2)) } its(:n) { jwk[:n].should == UrlSafeBase64.encode64(public_key.n.to_s(2)) } context 'when kid/use options given' do let(:jwk) { JSON::JWK.new public_key, kid: '12345', use: :sig } it { jwk.keys.collect(&:to_sym).should include :kid, :use } its(:kid) { jwk[:kid].should == '12345' } its(:use) { jwk[:use].should == :sig } end describe '#thumbprint' do context 'using default hash function' do subject { jwk.thumbprint } it { should == 'nuBTimkcSt_AuEsD8Yv3l8CoGV31bu_3gsRDGN1iVKA' } end context 'using SHA512 hash function' do subject { jwk.thumbprint :SHA512 } it { should == '6v7pXTnQLMiQgvJlPJUdhAUSuGLzgF8C1r3ABAMFet6bc53ea-Pq4ZGbGu3RoAFsNRT1-RhTzDqtqXuLU6NOtw' } end end describe '#to_key' do it { jwk.to_key.should be_instance_of OpenSSL::PKey::RSA } end end context 'when EC public key given' do let(:jwk) { JSON::JWK.new public_key(:ecdsa) } let(:expected_coordinates) do { 256 => { x: 'saPyrO4Lh9kh2FxrF9y1QVmZznWnRRJwpr12UHqzrVY', y: 'MMz4W9zzqlrJhqr-JyrpvlnaIIyZQE6DfrgPkxMAw1M' }, 384 => { x: 'plzApyFnK7qzhg5XnIZbFj2hZoH2Vdl4-RFm7DnsNMG9tyqrpfq2RyjfKABbcFRt', y: 'ixBzffhk3fcbmeipGLkvQBNCzeNm6QL3hOUTH6IFBzOL0Y7HsGTopNTTspLjlivb' }, 512 => { x: 'AcMCD-a0a6rnE9TvC0mOqF_DGXRg5Y3iTb4eHNwTm2kD6iujx9M_f8d_FGHr0OhpqzEn4rYPYZouGsbIPEgL0q__', y: 'AULYEd8l-bV_BI289aezhSLZ1RDF2ltgDPEy9Y7YtqYa4cJcpiyzVDMpXWwBp6cjg6TXINkoVrVXZhN404ihu4I2' } } end [256, 384, 512].each do |digest_length| describe "EC#{digest_length}" do let(:jwk) { JSON::JWK.new public_key(:ecdsa, digest_length: digest_length) } it { jwk.keys.collect(&:to_sym).should include :kty, :crv, :x, :y } its(:kty) { jwk[:kty].should == :EC } its(:x) { jwk[:x].should == expected_coordinates[digest_length][:x] } its(:y) { jwk[:y].should == expected_coordinates[digest_length][:y] } end end describe 'unknown curve' do it do key = OpenSSL::PKey::EC.new('secp112r2').generate_key expect do JSON::JWK.new key end.to raise_error JSON::JWK::UnknownAlgorithm, 'Unknown EC Curve' end end describe '#thumbprint' do context 'using default hash function' do subject { jwk.thumbprint } it { should == '-egRpLjyZCqxBh4OOfd8JSvXwayHmNFAUNkbi8exfhc' } end context 'using SHA512 hash function' do subject { jwk.thumbprint :SHA512 } it { should == 'B_yXDZJ9doudaVCj5q5vqxshvVtW2IFnz_ypvRt5O60gemkDAhO78L6YMyTWH0ZRm15cO2_laTSaNO9yZQFsvQ' } end end describe '#to_key' do it { jwk.to_key.should be_instance_of OpenSSL::PKey::EC } end end context 'when shared secret given' do let(:jwk) { JSON::JWK.new 'secret' } its(:kty) { jwk[:kty].should == :oct } its(:x) { jwk[:k].should == 'secret' } describe '#thumbprint' do context 'using default hash function' do subject { jwk.thumbprint } it { should == 'XZPWsTEZFIerowAF9GHzBtq5CkAOcVvIBnkMu0IIQH0' } end context 'using SHA512 hash function' do subject { jwk.thumbprint :SHA512 } it { should == 'rK7EtcEe9Xr0kryR9lNnyOTRe7Vb_BglbTBtbcVG2LzvL26_PFaMCwOtiUiXWfCK-wV8vcxjmvbcvV4ZxDE0FQ' } end end describe '#to_key' do it { jwk.to_key.should be_instance_of String } end end describe 'unknown key type' do it do key = OpenSSL::PKey::DSA.generate 256 expect do JSON::JWK.new key end.to raise_error JSON::JWK::UnknownAlgorithm, 'Unknown Key Type' end end end json-jwt-1.6.2/spec/json/jwe_spec.rb0000644000175600017570000001767212736141241016401 0ustar pravipravirequire 'spec_helper' describe JSON::JWE do let(:shared_key) { SecureRandom.hex 32 } # default shared key is too short let(:private_key_path) { der_file_path 'rsa/private_key' } describe '#content_type' do let(:jwe) { JSON::JWE.new 'hello' } it do jwe.content_type.should == 'application/jose' end end describe 'encrypt!' do shared_examples_for :gcm_encryption_unsupported do if gcm_supported? skip 'GSM supported' else context 'when enc=A128GCM' do before { jwe.enc = :A128GCM } it do expect do jwe.encrypt! key end.to raise_error JSON::JWE::UnexpectedAlgorithm end end context 'when enc=A256GCM' do before { jwe.enc = :A256GCM } it do expect do jwe.encrypt! key end.to raise_error JSON::JWE::UnexpectedAlgorithm end end end end shared_examples_for :unexpected_algorithm_for_encryption do it do expect do jwe.encrypt!(key).to_s # NOTE: encrypt! won't raise, but to_s does. might need to fix. end.to raise_error JSON::JWE::UnexpectedAlgorithm end end shared_examples_for :unsupported_algorithm_for_encryption do it do expect do jwe.encrypt!(key).to_s # NOTE: encrypt! won't raise, but to_s does. might need to fix. end.to raise_error NotImplementedError end end context 'when plaintext given' do let(:plain_text) { 'Hello World' } let(:jwe) { JSON::JWE.new plain_text } context 'when alg=RSA1_5' do let(:key) { public_key } before { jwe.alg = :'RSA1_5' } it_behaves_like :gcm_encryption_unsupported end context 'when alg=RSA-OAEP' do let(:key) { public_key } before { jwe.alg = :'RSA-OAEP' } it_behaves_like :gcm_encryption_unsupported end context 'when alg=dir' do it :TODO end context 'when unknonw/unsupported algorithm given' do let(:key) { public_key } let(:alg) { :RSA1_5 } let(:enc) { :'A128CBC-HS256' } before { jwe.alg, jwe.enc = alg, enc } context 'when alg=unknown' do let(:alg) { :unknown } it_behaves_like :unexpected_algorithm_for_encryption end context 'when enc=unknown' do let(:enc) { :unknown } it_behaves_like :unexpected_algorithm_for_encryption end [:A128KW, :A256KW, :'ECDH-ES', :'ECDH-ES+A128KW', :'ECDH-ES+A256KW'].each do |alg| context "when alg=#{alg}" do let(:alg) { alg } it_behaves_like :unsupported_algorithm_for_encryption end end end end context 'when jwt given' do let(:plain_text) { jwt.to_s } let(:jwt) { JSON::JWT.new(foo: :bar) } let(:jwe) { JSON::JWE.new jwt } context 'when alg=RSA-OAEP' do let(:key) { public_key } before { jwe.alg = :'RSA1_5' } it_behaves_like :gcm_encryption_unsupported end context 'when alg=RSA-OAEP' do let(:key) { public_key } before { jwe.alg = :'RSA-OAEP' } it_behaves_like :gcm_encryption_unsupported end end end describe 'decrypt!' do let(:plain_text) { 'Hello World' } let(:jwe_string) do _jwe_ = JSON::JWE.new plain_text _jwe_.alg, _jwe_.enc = alg, enc _jwe_.encrypt! key _jwe_.to_s end let(:jwe) do _jwe_ = JSON::JWE.decode jwe_string, :skip_decryption _jwe_.alg, _jwe_.enc = alg, enc _jwe_ end shared_examples_for :decryptable do it do jwe.decrypt! key jwe.plain_text.should == plain_text end end shared_examples_for :gcm_decryption_unsupported do it do expect do jwe.decrypt! key end.to raise_error JSON::JWE::UnexpectedAlgorithm end end shared_examples_for :verify_cbc_authentication_tag do let(:jwe_string) do _jwe_ = JSON::JWE.new plain_text _jwe_.alg, _jwe_.enc = alg, enc _jwe_.encrypt! key _jwe_.to_s + 'tampered' end it do expect do jwe.decrypt! key end.to raise_error JSON::JWE::DecryptionFailed end end shared_examples_for :unexpected_algorithm_for_decryption do it do expect do jwe.decrypt! key end.to raise_error JSON::JWE::UnexpectedAlgorithm end end shared_examples_for :unsupported_algorithm_for_decryption do it do expect do jwe.decrypt! key end.to raise_error NotImplementedError end end context 'when alg=RSA1_5' do let(:alg) { :RSA1_5 } let(:key) { private_key } context 'when enc=A128GCM' do let(:enc) { :A128GCM } if gcm_supported? it_behaves_like :decryptable else it_behaves_like :gcm_decryption_unsupported end end context 'when enc=A256GCM' do let(:enc) { :A256GCM } if gcm_supported? it_behaves_like :decryptable else it_behaves_like :gcm_decryption_unsupported end end context 'when enc=A128CBC-HS256' do let(:enc) { :'A128CBC-HS256' } it_behaves_like :decryptable end context 'when enc=A256CBC-HS512' do let(:enc) { :'A256CBC-HS512' } it_behaves_like :decryptable end end context 'when alg=RSA-OAEP' do let(:alg) { :'RSA-OAEP' } let(:key) { private_key } context 'when enc=A128GCM' do let(:enc) { :A128GCM } if gcm_supported? it_behaves_like :decryptable else it_behaves_like :gcm_decryption_unsupported end end context 'when enc=A256GCM' do let(:enc) { :A256GCM } if gcm_supported? it_behaves_like :decryptable else it_behaves_like :gcm_decryption_unsupported end end context 'when enc=A128CBC-HS256' do let(:enc) { :'A128CBC-HS256' } it_behaves_like :decryptable it_behaves_like :verify_cbc_authentication_tag end context 'when enc=A256CBC-HS512' do let(:enc) { :'A256CBC-HS512' } it_behaves_like :decryptable it_behaves_like :verify_cbc_authentication_tag end end context 'when alg=dir' do let(:alg) { :dir } let(:key) { shared_key } context 'when enc=A128GCM' do let(:enc) { :A128GCM } if gcm_supported? it_behaves_like :decryptable else it_behaves_like :gcm_decryption_unsupported end end context 'when enc=A256GCM' do let(:enc) { :A256GCM } if gcm_supported? it_behaves_like :decryptable else it_behaves_like :gcm_decryption_unsupported end end context 'when enc=A128CBC-HS256' do let(:enc) { :'A128CBC-HS256' } it_behaves_like :decryptable it_behaves_like :verify_cbc_authentication_tag end context 'when enc=A256CBC-HS512' do let(:enc) { :'A256CBC-HS512' } it_behaves_like :decryptable it_behaves_like :verify_cbc_authentication_tag end end context 'when unknonw/unsupported algorithm given' do let(:input) { 'header.key.iv.cipher_text.auth_tag' } let(:key) { public_key } let(:alg) { :RSA1_5 } let(:enc) { :'A128CBC-HS256' } context 'when alg=unknown' do let(:alg) { :unknown } it_behaves_like :unexpected_algorithm_for_decryption end context 'when enc=unknown' do let(:enc) { :unknown } it_behaves_like :unexpected_algorithm_for_decryption end [:A128KW, :A256KW, :'ECDH-ES', :'ECDH-ES+A128KW', :'ECDH-ES+A256KW'].each do |alg| context "when alg=#{alg}" do let(:alg) { alg } it_behaves_like :unsupported_algorithm_for_decryption end end end end end json-jwt-1.6.2/spec/json/jwk/0000755000175600017570000000000012736141241015033 5ustar pravipravijson-jwt-1.6.2/spec/json/jwk/set_spec.rb0000644000175600017570000000305712736141241017172 0ustar pravipravirequire 'spec_helper' describe JSON::JWK::Set do let(:jwk) { public_key.to_jwk } let(:set) { JSON::JWK::Set.new jwk } describe '#content_type' do it do set.content_type.should == 'application/jwk-set+json' end end context 'when single JWK given' do subject { JSON::JWK::Set.new jwk } it { should == [jwk] } end context 'when multiple JWKs given' do subject { JSON::JWK::Set.new jwk, jwk } it { should == [jwk, jwk] } end context 'when an Array of JWKs given' do subject { JSON::JWK::Set.new [jwk, jwk] } it { should == [jwk, jwk] } end context 'when JSON::JWK given' do subject { JSON::JWK::Set.new jwk } it 'should keep JSON::JWK' do subject.each do |jwk| jwk.should be_instance_of JSON::JWK end end end context 'when pure Hash given' do subject { JSON::JWK::Set.new jwk.as_json } it 'should convert into JSON::JWK' do subject.each do |jwk| jwk.should be_instance_of JSON::JWK end end end context 'when pure Hash with :keys key given' do subject do JSON::JWK::Set.new( keys: jwk.as_json ) end it 'should convert into JSON::JWK' do subject.each do |jwk| jwk.should be_instance_of JSON::JWK end end end describe '#as_json' do it 'should become proper JWK set format' do json = set.as_json json.should include :keys json[:keys].should == [jwk] end end describe '#to_json' do it do expect { set.to_json }.not_to raise_error end end endjson-jwt-1.6.2/spec/json/jwk/jwkizable_spec.rb0000644000175600017570000000256412736141241020363 0ustar pravipravirequire 'spec_helper' describe JSON::JWK::JWKizable do describe '#to_jwk' do subject { key.to_jwk } shared_examples_for :jwkizable_as_public do it { should be_instance_of JSON::JWK } it { should include *public_key_attributes.collect(&:to_s) } it { should_not include *private_key_attributes.collect(&:to_s) } end shared_examples_for :jwkizable_as_private do it { should be_instance_of JSON::JWK } it { should include *public_key_attributes.collect(&:to_s) } it { should include *private_key_attributes.collect(&:to_s) } end describe OpenSSL::PKey::RSA do let(:public_key_attributes) { [:kty, :n, :e] } let(:private_key_attributes) { [:d, :p, :q] } describe :public_key do let(:key) { public_key :rsa } it_behaves_like :jwkizable_as_public end describe :private_key do let(:key) { private_key :rsa } it_behaves_like :jwkizable_as_private end end describe OpenSSL::PKey::EC do let(:public_key_attributes) { [:kty, :crv, :x, :y] } let(:private_key_attributes) { [:d] } describe :public_key do let(:key) { public_key :ecdsa } it_behaves_like :jwkizable_as_public end describe :private_key do let(:key) { private_key :ecdsa } it_behaves_like :jwkizable_as_private end end end endjson-jwt-1.6.2/spec/json/jwt_spec.rb0000644000175600017570000002153712736141241016413 0ustar pravipravirequire 'spec_helper' describe JSON::JWT do let(:jwt) { JSON::JWT.new claims } let(:jws) do jwt.alg = :HS256 jws = JSON::JWS.new jwt jws.signature = 'signature' jws end let(:claims) do { iss: 'joe', exp: 1300819380, 'http://example.com/is_root' => true }.with_indifferent_access end let(:no_signed) do 'eyJ0eXAiOiJKV1QiLCJhbGciOiJub25lIn0.eyJpc3MiOiJqb2UiLCJleHAiOjEzMDA4MTkzODAsImh0dHA6Ly9leGFtcGxlLmNvbS9pc19yb290Ijp0cnVlfQ.' end context 'when not signed nor encrypted' do it do jwt.to_s.should == no_signed end end describe '#content_type' do it do jwt.content_type.should == 'application/jwt' end end describe '#sign' do [:HS256, :HS384, :HS512].each do |algorithm| context algorithm do it do jwt.sign(shared_secret, algorithm).should be_a JSON::JWS end end end [:RS256, :RS384, :RS512].each do |algorithm| context algorithm do it do jwt.sign(private_key, algorithm).should be_a JSON::JWS end end end context 'when no algirithm specified' do subject { jwt.sign(key) } context 'when key is String' do let(:key) { shared_secret } its(:alg) { should == :HS256 } end context 'otherwise' do let(:key) { private_key } its(:alg) { should == :RS256 } end end context 'when non-JWK key is given' do let(:key) { private_key } it 'should not set kid header automatically' do jws = jwt.sign(key, :RS256) jws.kid.should be_blank end end context 'when JWK is given' do let(:key) { JSON::JWK.new private_key } it 'should set kid header automatically' do jws = jwt.sign(key, :RS256) jwt.kid.should be_blank jws.kid.should == key[:kid] end end end describe '#encrypt' do let(:shared_key) { SecureRandom.hex 16 } # default shared key is too short it 'should encryptable without signing' do jwt.encrypt(public_key).should be_a JSON::JWE end it 'should encryptable after signed' do jwt.sign(shared_key).encrypt(public_key).should be_a JSON::JWE end it 'should accept optional algorithm' do jwt.encrypt(shared_key, :dir).should be_a JSON::JWE end it 'should accept optional algorithm and encryption method' do jwt.encrypt(SecureRandom.hex(32), :dir, :'A256CBC-HS512').should be_a JSON::JWE end context 'when non-JWK key is given' do let(:key) { shared_key } it 'should not set kid header automatically' do jwe = jwt.encrypt(key, :dir) jwe.kid.should be_blank end end context 'when JWK is given' do let(:key) { JSON::JWK.new shared_key } it 'should set kid header automatically' do jwe = jwt.encrypt(key, :dir) jwt.kid.should be_blank jwe.kid.should == key[:kid] end end end describe '.decode' do context 'when not signed nor encrypted' do context 'no signature given' do it do JSON::JWT.decode(no_signed).should == jwt end end end context 'when signed' do context 'when no secret/key given' do it 'should do verification' do expect do JSON::JWT.decode jws.to_s end.to raise_error JSON::JWT::VerificationFailed end end context 'when secret/key given' do it 'should do verification' do expect do JSON::JWT.decode jws.to_s, 'secret' end.to raise_error JSON::JWT::VerificationFailed end end context 'when alg header malformed' do context 'from alg=HS256' do context 'to alg=none' do let(:malformed_jwt_string) do header, payload, signature = jws.to_s.split('.') malformed_header = {alg: :none}.to_json [ UrlSafeBase64.encode64(malformed_header), payload, '' ].join('.') end it 'should do verification' do expect do JSON::JWT.decode malformed_jwt_string, 'secret' end.to raise_error JSON::JWT::VerificationFailed end end end context 'from alg=RS256' do let(:jws) do jwt.sign private_key, :RS256 end context 'to alg=none' do let(:malformed_jwt_string) do header, payload, signature = jws.to_s.split('.') malformed_header = {alg: :none}.to_json [ UrlSafeBase64.encode64(malformed_header), payload, '' ].join('.') end it 'should fail verification' do expect do JSON::JWT.decode malformed_jwt_string, public_key end.to raise_error JSON::JWT::UnexpectedAlgorithm end end context 'to alg=HS256' do let(:malformed_jwt_string) do header, payload, signature = jws.to_s.split('.') malformed_header = {alg: :HS256}.to_json malformed_signature = OpenSSL::HMAC.digest( OpenSSL::Digest.new('SHA256'), public_key.to_s, [malformed_header, payload].join('.') ) [ UrlSafeBase64.encode64(malformed_header), payload, UrlSafeBase64.encode64(malformed_signature) ].join('.') end it 'should fail verification' do expect do JSON::JWT.decode malformed_jwt_string, public_key end.to raise_error JSON::JWS::UnexpectedAlgorithm end end end end context 'when :skip_verification given as secret/key' do it 'should skip verification' do expect do jwt = JSON::JWT.decode jws.to_s, :skip_verification jwt.header.should == {'alg' => 'HS256', 'typ' => 'JWT'} end.not_to raise_error end end context 'when JSON Serialization given' do let(:signed) { JSON::JWT.new(claims).sign('secret') } shared_examples_for :json_serialization_parser do context 'when proper secret given' do it { JSON::JWT.decode(serialized, 'secret').should == signed } end context 'when verification skipped' do it { JSON::JWT.decode(serialized, :skip_verification).should == signed } end context 'when wrong secret given' do it do expect do JSON::JWT.decode serialized, 'wrong' end.to raise_error JSON::JWT::VerificationFailed end end end context 'when general' do let(:serialized) do { payload: UrlSafeBase64.encode64(claims.to_json), signatures: [{ protected: UrlSafeBase64.encode64(signed.header.to_json), signature: UrlSafeBase64.encode64(signed.signature) }] } end it_behaves_like :json_serialization_parser end context 'when flattened' do let(:serialized) do { protected: UrlSafeBase64.encode64(signed.header.to_json), payload: UrlSafeBase64.encode64(claims.to_json), signature: UrlSafeBase64.encode64(signed.signature) } end it_behaves_like :json_serialization_parser end end end context 'when encrypted' do let(:input) { jwt.encrypt(public_key).to_s } let(:shared_key) { SecureRandom.hex 16 } # default shared key is too short it 'should decryptable' do JSON::JWT.decode(input, private_key).should be_instance_of JSON::JWE end context 'when :skip_decryption given as secret/key' do it 'should skip verification' do expect do jwe = JSON::JWT.decode input, :skip_decryption jwe.should be_instance_of JSON::JWE jwe.header.should == {'alg' => 'RSA1_5', 'enc' => 'A128CBC-HS256'} end.not_to raise_error end end end context 'when JSON parse failed' do it do expect do JSON::JWT.decode('header.payload.signature') end.to raise_error JSON::JWT::InvalidFormat end end context 'when unexpected format' do context 'when too few dots' do it do expect do JSON::JWT.decode 'header' end.to raise_error JSON::JWT::InvalidFormat end end context 'when too many dots' do it do expect do JSON::JWT.decode 'header.payload.signature.something.wrong' end.to raise_error JSON::JWT::InvalidFormat end end end end end json-jwt-1.6.2/spec/interop/0000755000175600017570000000000012736141241014747 5ustar pravipravijson-jwt-1.6.2/spec/interop/with_jsrsasign_spec.rb0000644000175600017570000000332012736141241021342 0ustar pravipravirequire 'spec_helper' describe 'interop' do describe 'with jsrsasign' do context 'JWS' do let(:public_key) do pem = <<-PEM.strip_heredoc -----BEGIN PUBLIC KEY----- MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEoBUyo8CQAFPeYPvv78ylh5MwFZjT CLQeb042TjiMJxG+9DLFmRSMlBQ9T/RsLLc+PmpB1+7yPAR+oR5gZn3kJQ== -----END PUBLIC KEY----- PEM OpenSSL::PKey::EC.new pem end let(:private_key) do pem = <<-PEM.strip_heredoc -----BEGIN PRIVATE KEY----- MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgEbVzfPnZPxfAyxqE ZV05laAoJAl+/6Xt2O4mOB611sOhRANCAASgFTKjwJAAU95g++/vzKWHkzAVmNMI tB5vTjZOOIwnEb70MsWZFIyUFD1P9Gwstz4+akHX7vI8BH6hHmBmfeQl -----END PRIVATE KEY----- PEM OpenSSL::PKey::EC.new pem end let(:jws_string) do 'eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczovL2p3dC1pZHAuZXhhbXBsZS5jb20iLCJzdWIiOiJtYWlsdG86bWlrZUBleGFtcGxlLmNvbSIsIm5iZiI6MTQzNTA2MjUyMywiZXhwIjoxNDM1MDY2MTIzLCJpYXQiOjE0MzUwNjI1MjMsImp0aSI6ImlkMTIzNDU2IiwidHlwIjoiaHR0cHM6Ly9leGFtcGxlLmNvbS9yZWdpc3RlciJ9.HFmKrExGIFm5SwzTq_ayG80ELUIKnrR9psedV_6ZsuHl5ZLZ-1nV35o0yjKkN7qPQipQMK90xMvDYpi7e2XU9Q' end let(:payload) do { iss: 'https://jwt-idp.example.com', sub: 'mailto:mike@example.com', nbf: 1435062523, exp: 1435066123, iat: 1435062523, jti: 'id123456', typ: 'https://example.com/register' } end describe 'verify' do it 'should succeed' do expect do JSON::JWT.decode(jws_string, public_key) end.not_to raise_error end end end end end json-jwt-1.6.2/spec/interop/with_nimbus_jose_spec.rb0000644000175600017570000000604112736141241021657 0ustar pravipravirequire 'spec_helper' describe 'interop' do describe 'with Nimbus JOSE' do if NimbusSpecHelper.nimbus_available? context 'JWE' do let(:shared_key) { SecureRandom.hex 16 } # default shared key is too short let(:private_key_path) { der_file_path 'rsa/private_key' } describe 'encrypt!' do shared_examples_for :gcm_encryption do context 'when enc=A128GCM' do before { jwe.enc = :A128GCM } it 'should decryptable by Nimbus JOSE JWT' do jwe.encrypt! key NimbusJWE.decrypt(jwe, private_key_path).should == plain_text end end context 'when enc=A256GCM' do before { jwe.enc = :A256GCM } it 'should decryptable by Nimbus JOSE JWT' do jwe.encrypt! key NimbusJWE.decrypt(jwe, private_key_path).should == plain_text end end end shared_examples_for :cbc_encryption do context 'when enc=A128CBC-HS256' do before { jwe.enc = :'A128CBC-HS256' } it 'should decryptable by Nimbus JOSE JWT' do jwe.encrypt! key NimbusJWE.decrypt(jwe, private_key_path).should == plain_text end end context 'when enc=A256CBC-HS512' do before { jwe.enc = :'A256CBC-HS512' } it 'should decryptable by Nimbus JOSE JWT' do jwe.encrypt! key NimbusJWE.decrypt(jwe, private_key_path).should == plain_text end end end context 'when plaintext given' do let(:plain_text) { 'Hello World' } let(:jwe) { JSON::JWE.new plain_text } context 'when alg=RSA1_5' do let(:key) { public_key } before { jwe.alg = :'RSA1_5' } it_behaves_like :gcm_encryption if gcm_supported? it_behaves_like :cbc_encryption end context 'when alg=RSA-OAEP' do let(:key) { public_key } before { jwe.alg = :'RSA-OAEP' } it_behaves_like :gcm_encryption if gcm_supported? it_behaves_like :cbc_encryption end end context 'when jwt given' do let(:plain_text) { jwt.to_s } let(:jwt) { JSON::JWT.new(foo: :bar) } let(:jwe) { JSON::JWE.new jwt } context 'when alg=RSA-OAEP' do let(:key) { public_key } before { jwe.alg = :'RSA1_5' } it_behaves_like :gcm_encryption if gcm_supported? it_behaves_like :cbc_encryption end context 'when alg=RSA-OAEP' do let(:key) { public_key } before { jwe.alg = :'RSA-OAEP' } it_behaves_like :gcm_encryption if gcm_supported? it_behaves_like :cbc_encryption end end end end else skip 'Nimbus JOSE unavailable' end end end json-jwt-1.6.2/spec/interop/with_rfc_example_spec.rb0000644000175600017570000000132612736141241021630 0ustar pravipravirequire 'spec_helper' describe 'interop' do describe 'with RFC Example' do describe 'JWK Thubmprint' do subject do JSON::JWK.new( kty: :RSA, n: '0vx7agoebGcQSuuPiLJXZptN9nndrQmbXEps2aiAFbWhM78LhWx4cbbfAAtVT86zwu1RK7aPFFxuhDR1L6tSoc_BJECPebWKRXjBZCiFV4n3oknjhMstn64tZ_2W-5JsGY4Hc5n9yBXArwl93lqt7_RN5w6Cf0h4QyQ5v-65YGjQR0_FDW2QvzqY368QQMicAtaSqzs8KJZgnYb9c7d0zgdAZHzu6qMQvRL5hajrn1n91CbOpbISD08qNLyrdkt-bFTWhAI4vMQFh6WeZu0fM4lFd2NcRwr3XPksINHaQ-G_xBniIqbw0Ls1jF44-csFCur-kEgU8awapJzKnqDKgw', e: 'AQAB', alg: :RSA256, kid: '2011-04-29' ) end its(:thumbprint) { should == 'NzbLsXh8uDCcd-6MNwXF4W_7noWXFZAfHkxZsRGC9Xs' } end end end json-jwt-1.6.2/LICENSE0000644000175600017570000000203612736141241013343 0ustar pravipraviCopyright (c) 2011 nov matake Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. json-jwt-1.6.2/.gitmodules0000644000175600017570000000020012736141241014502 0ustar pravipravi[submodule "spec/helpers/json-jwt-nimbus"] path = spec/helpers/json-jwt-nimbus url = git://github.com/nov/json-jwt-nimbus.git json-jwt-1.6.2/VERSION0000644000175600017570000000000512736141241013400 0ustar pravipravi1.6.2json-jwt-1.6.2/.rspec0000644000175600017570000000003712736141241013452 0ustar pravipravi--color --format=documentation json-jwt-1.6.2/json-jwt.gemspec0000644000175600017570000000217712736141241015464 0ustar pravipraviGem::Specification.new do |gem| gem.name = "json-jwt" gem.version = File.read("VERSION") gem.authors = ["nov matake"] gem.email = ["nov@matake.jp"] gem.homepage = "https://github.com/nov/json-jwt" gem.summary = %q{JSON Web Token and its family (JSON Web Signature, JSON Web Encryption and JSON Web Key) in Ruby} gem.description = %q{JSON Web Token and its family (JSON Web Signature, JSON Web Encryption and JSON Web Key) in Ruby} gem.license = 'MIT' gem.files = `git ls-files`.split("\n") gem.test_files = `git ls-files -- {test,spec,features}/*`.split("\n") gem.executables = `git ls-files -- bin/*`.split("\n").map{ |f| File.basename(f) } gem.require_paths = ["lib"] gem.add_runtime_dependency "multi_json", ">= 1.3" gem.add_runtime_dependency "url_safe_base64" gem.add_runtime_dependency "activesupport" gem.add_runtime_dependency "bindata" gem.add_runtime_dependency "securecompare" gem.add_development_dependency "rake", ">= 0.8" gem.add_development_dependency "simplecov" gem.add_development_dependency "rspec" gem.add_development_dependency 'rspec-its' endjson-jwt-1.6.2/.travis.yml0000644000175600017570000000017312736141241014447 0ustar pravipravibefore_install: - gem install bundler - git submodule update --init --recursive rvm: - 2.0 - 2.1 - 2.2 - 2.3.0json-jwt-1.6.2/README.md0000644000175600017570000000322512736141241013616 0ustar pravipravi# JSON::JWT JSON Web Token and its family (JSON Web Signature, JSON Web Encryption and JSON Web Key) in Ruby [![Build Status](https://secure.travis-ci.org/nov/json-jwt.png)](http://travis-ci.org/nov/json-jwt) ## Installation ``` gem install json-jwt ``` ## Resources * View Source on GitHub (https://github.com/nov/json-jwt) * Report Issues on GitHub (https://github.com/nov/json-jwt/issues) * Documentation on GitHub (https://github.com/nov/json-jwt/wiki) ## Examples ```ruby require 'json/jwt' private_key = OpenSSL::PKey::RSA.new <<-PEM -----BEGIN RSA PRIVATE KEY----- MIIEpAIBAAKCAQEAyBKIFSH8dP6bDkGBziB6RXTTfZVTaaNSWNtIzDmgRFi6FbLo : -----END RSA PRIVATE KEY----- PEM public_key = OpenSSL::PKey::RSA.new <<-PEM -----BEGIN PUBLIC KEY----- MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyBKIFSH8dP6bDkGBziB6 : -----END PUBLIC KEY----- PEM # Sign & Encode claim = { iss: 'nov', exp: 1.week.from_now, nbf: Time.now } jws = JSON::JWT.new(claim).sign(private_key, :RS256) jws.to_s # Decode & Verify input = "jwt_header.jwt_claims.jwt_signature" JSON::JWT.decode(input, public_key) ``` For more details, read [Documentation Wiki](https://github.com/nov/json-jwt/wiki). ## Note on Patches/Pull Requests * Fork the project. * Make your feature addition or bug fix. * Add tests for it. This is important so I don't break it in a future version unintentionally. * Commit, do not mess with rakefile, version, or history. (if you want to have your own version, that is fine but bump version in a commit by itself I can ignore when I pull) * Send me a pull request. Bonus points for topic branches. ## Copyright Copyright (c) 2011 nov matake. See LICENSE for details. json-jwt-1.6.2/Gemfile0000644000175600017570000000004512736141241013627 0ustar pravipravisource "http://rubygems.org" gemspecjson-jwt-1.6.2/lib/0000755000175600017570000000000012736141241013103 5ustar pravipravijson-jwt-1.6.2/lib/json/0000755000175600017570000000000012736141241014054 5ustar pravipravijson-jwt-1.6.2/lib/json/jwk.rb0000644000175600017570000000551012736141241015175 0ustar pravipravimodule JSON class JWK < ActiveSupport::HashWithIndifferentAccess class UnknownAlgorithm < JWT::Exception; end def initialize(params = {}, ex_params = {}) case params when OpenSSL::PKey::RSA, OpenSSL::PKey::EC super params.to_jwk(ex_params) when OpenSSL::PKey::PKey raise UnknownAlgorithm.new('Unknown Key Type') when String super( k: params, kty: :oct ) merge! ex_params else super params merge! ex_params end self[:kid] ||= thumbprint rescue nil #ignore end def content_type 'application/jwk+json' end def thumbprint(digest = OpenSSL::Digest::SHA256.new) digest = case digest when OpenSSL::Digest digest when String, Symbol OpenSSL::Digest.new digest.to_s else raise UnknownAlgorithm.new('Unknown Digest Algorithm') end UrlSafeBase64.encode64 digest.digest(normalize.to_json) end def to_key case when rsa? to_rsa_key when ec? to_ec_key when oct? self[:k] else raise UnknownAlgorithm.new('Unknown Key Type') end end private def rsa? self[:kty].try(:to_sym) == :RSA end def ec? self[:kty].try(:to_sym) == :EC end def oct? self[:kty].try(:to_sym) == :oct end def normalize case when rsa? { e: self[:e], kty: self[:kty], n: self[:n] } when ec? { crv: self[:crv], kty: self[:kty], x: self[:x], y: self[:y] } when oct? { k: self[:k], kty: self[:kty] } else raise UnknownAlgorithm.new('Unknown Key Type') end end def to_rsa_key e, n, d, p, q = [:e, :n, :d, :p, :q].collect do |key| if self[key] OpenSSL::BN.new UrlSafeBase64.decode64(self[key]), 2 end end key = OpenSSL::PKey::RSA.new key.e = e key.n = n key.d = d if d key.p = p if p key.q = q if q key end def to_ec_key curve_name = case self[:crv].try(:to_sym) when :'P-256' 'prime256v1' when :'P-384' 'secp384r1' when :'P-521' 'secp521r1' else raise UnknownAlgorithm.new('Unknown EC Curve') end x, y, d = [:x, :y, :d].collect do |key| if self[key] OpenSSL::BN.new UrlSafeBase64.decode64(self[key]), 2 end end key = OpenSSL::PKey::EC.new curve_name key.private_key = d if d key.public_key = OpenSSL::PKey::EC::Point.new( OpenSSL::PKey::EC::Group.new(curve_name), OpenSSL::BN.new(['04' + x.to_s(16) + y.to_s(16)].pack('H*'), 2) ) key end end endjson-jwt-1.6.2/lib/json/jws.rb0000644000175600017570000001223012736141241015202 0ustar pravipravimodule JSON class JWS < JWT class InvalidFormat < JWT::InvalidFormat; end class VerificationFailed < JWT::VerificationFailed; end class UnexpectedAlgorithm < JWT::UnexpectedAlgorithm; end NUM_OF_SEGMENTS = 3 attr_accessor :signature_base_string def initialize(jwt) update jwt end def sign!(private_key_or_secret) self.signature = sign signature_base_string, private_key_or_secret self end def verify!(public_key_or_secret) if alg.try(:to_sym) == :none raise UnexpectedAlgorithm if public_key_or_secret signature == '' or raise VerificationFailed else public_key_or_secret && valid?(public_key_or_secret) or raise VerificationFailed end end def update(hash_or_jwt) super if hash_or_jwt.is_a? JSON::JWT self.header = hash_or_jwt.header self.signature = hash_or_jwt.signature end self end private def digest OpenSSL::Digest.new "SHA#{algorithm.to_s[2, 3]}" end def hmac? [:HS256, :HS384, :HS512].include? algorithm.try(:to_sym) end def rsa? [:RS256, :RS384, :RS512].include? algorithm.try(:to_sym) end def ecdsa? [:ES256, :ES384, :ES512].include? algorithm.try(:to_sym) end def signature_base_string @signature_base_string ||= [ header.to_json, self.to_json ].collect do |segment| UrlSafeBase64.encode64 segment end.join('.') end def sign(signature_base_string, private_key_or_secret) private_key_or_secret = with_jwk_support private_key_or_secret case when hmac? secret = private_key_or_secret OpenSSL::HMAC.digest digest, secret, signature_base_string when rsa? private_key = private_key_or_secret private_key.sign digest, signature_base_string when ecdsa? private_key = private_key_or_secret verify_ecdsa_group! private_key asn1_to_raw( private_key.dsa_sign_asn1(digest.digest signature_base_string), private_key ) else raise UnexpectedAlgorithm.new('Unknown Signature Algorithm') end end def valid?(public_key_or_secret) public_key_or_secret = with_jwk_support public_key_or_secret case when hmac? secure_compare sign(signature_base_string, public_key_or_secret), signature when rsa? public_key = public_key_or_secret public_key.verify digest, signature, signature_base_string when ecdsa? public_key = public_key_or_secret verify_ecdsa_group! public_key public_key.dsa_verify_asn1( digest.digest(signature_base_string), raw_to_asn1(signature, public_key) ) else raise UnexpectedAlgorithm.new('Unknown Signature Algorithm') end rescue TypeError => e raise UnexpectedAlgorithm.new(e.message) end def verify_ecdsa_group!(key) group_name = case digest.digest_length * 8 when 256 :prime256v1 when 384 :secp384r1 when 512 :secp521r1 end key.group = OpenSSL::PKey::EC::Group.new group_name.to_s key.check_key end def raw_to_asn1(signature, public_key) byte_size = (public_key.group.degree + 7) / 8 r = signature[0..(byte_size - 1)] s = signature[byte_size..-1] OpenSSL::ASN1::Sequence.new([r, s].map { |int| OpenSSL::ASN1::Integer.new(OpenSSL::BN.new(int, 2)) }).to_der end def asn1_to_raw(signature, private_key) byte_size = (private_key.group.degree + 7) / 8 OpenSSL::ASN1.decode(signature).value.map { |value| value.value.to_s(2).rjust(byte_size, "\x00") }.join end class << self def decode_compact_serialized(input, public_key_or_secret) unless input.count('.') + 1 == NUM_OF_SEGMENTS raise InvalidFormat.new("Invalid JWS Format. JWS should include #{NUM_OF_SEGMENTS} segments.") end header, claims, signature = input.split('.', JWS::NUM_OF_SEGMENTS).collect do |segment| UrlSafeBase64.decode64 segment.to_s end header, claims = [header, claims].collect do |json| MultiJson.load(json).with_indifferent_access end jws = new claims jws.header = header jws.signature = signature jws.signature_base_string = input.split('.')[0, JWS::NUM_OF_SEGMENTS - 1].join('.') jws.verify! public_key_or_secret unless public_key_or_secret == :skip_verification jws end def decode_json_serialized(input, public_key_or_secret) input = input.with_indifferent_access header, payload, signature = if input[:signatures].present? [ input[:signatures].first[:protected], input[:payload], input[:signatures].first[:signature] ].collect do |segment| segment end else [:protected, :payload, :signature].collect do |key| input[key] end end compact_serialized = [header, payload, signature].join('.') decode_compact_serialized compact_serialized, public_key_or_secret end end end end json-jwt-1.6.2/lib/json/jwt.rb0000644000175600017570000000646712736141241015222 0ustar pravipravirequire 'openssl' require 'url_safe_base64' require 'multi_json' require 'active_support' require 'active_support/core_ext' require 'json/jose' module JSON class JWT < ActiveSupport::HashWithIndifferentAccess attr_accessor :signature class Exception < StandardError; end class InvalidFormat < Exception; end class VerificationFailed < Exception; end class UnexpectedAlgorithm < VerificationFailed; end include JOSE def initialize(claims = {}) @content_type = 'application/jwt' self.typ = :JWT self.alg = :none [:exp, :nbf, :iat].each do |key| claims[key] = claims[key].to_i if claims[key] end update claims end def sign(private_key_or_secret, algorithm = :autodetect) if algorithm == :autodetect # NOTE: # I'd like to make :RS256 default. # However, by histrical reasons, :HS256 was default. # This code is needed to keep legacy behavior. algorithm = private_key_or_secret.is_a?(String) ? :HS256 : :RS256 end jws = JWS.new self.dup jws.kid ||= private_key_or_secret[:kid] if private_key_or_secret.is_a? JSON::JWK jws.alg = algorithm jws.sign! private_key_or_secret end def encrypt(public_key_or_secret, algorithm = :RSA1_5, encryption_method = :'A128CBC-HS256') jwe = JWE.new self jwe.kid ||= public_key_or_secret[:kid] if public_key_or_secret.is_a? JSON::JWK jwe.alg = algorithm jwe.enc = encryption_method jwe.encrypt! public_key_or_secret end def to_s [ header.to_json, self.to_json, signature ].collect do |segment| UrlSafeBase64.encode64 segment.to_s end.join('.') end def as_json(options = {}) case options[:syntax] when :general { payload: UrlSafeBase64.encode64(self.to_json), signatures: [{ protected: UrlSafeBase64.encode64(header.to_json), signature: UrlSafeBase64.encode64(signature.to_s) }] } when :flattened { protected: UrlSafeBase64.encode64(header.to_json), payload: UrlSafeBase64.encode64(self.to_json), signature: UrlSafeBase64.encode64(signature.to_s) } else super end end class << self def decode_compact_serialized(jwt_string, key_or_secret) case jwt_string.count('.') + 1 when JWS::NUM_OF_SEGMENTS JWS.decode_compact_serialized jwt_string, key_or_secret when JWE::NUM_OF_SEGMENTS JWE.decode_compact_serialized jwt_string, key_or_secret else raise InvalidFormat.new("Invalid JWT Format. JWT should include #{JWS::NUM_OF_SEGMENTS} or #{JWE::NUM_OF_SEGMENTS} segments.") end end def decode_json_serialized(input, key_or_secret) input = input.with_indifferent_access if (input[:signatures] || input[:signature]).present? JWS.decode_json_serialized input, key_or_secret elsif input[:ciphertext].present? JWE.decode_json_serialized input, key_or_secret else raise InvalidFormat.new("Unexpected JOSE JSON Serialization Format.") end end end end end require 'json/jws' require 'json/jwe' require 'json/jwk' require 'json/jwk/jwkizable' require 'json/jwk/set'json-jwt-1.6.2/lib/json/jose.rb0000644000175600017570000000253412736141241015345 0ustar pravipravirequire 'securecompare' module JSON module JOSE extend ActiveSupport::Concern included do extend ClassMethods include SecureCompare register_header_keys :alg, :jku, :jwk, :x5u, :x5t, :x5c, :kid, :typ, :cty, :crit alias_method :algorithm, :alg attr_accessor :header def header @header ||= {} end def content_type @content_type ||= 'application/jose' end end def with_jwk_support(key) case key when JSON::JWK key.to_key when JSON::JWK::Set key.detect do |jwk| jwk[:kid] && jwk[:kid] == kid end.try(:to_key) or raise JWK::Set::KidNotFound else key end end module ClassMethods def register_header_keys(*keys) keys.each do |header_key| define_method header_key do self.header[header_key] end define_method "#{header_key}=" do |value| self.header[header_key] = value end end end def decode(input, key_or_secret = nil) if input.is_a? Hash decode_json_serialized input, key_or_secret else decode_compact_serialized input, key_or_secret end rescue MultiJson::DecodeError raise JWT::InvalidFormat.new("Invalid JSON Format") end end end endjson-jwt-1.6.2/lib/json/jwk/0000755000175600017570000000000012736141241014647 5ustar pravipravijson-jwt-1.6.2/lib/json/jwk/set.rb0000644000175600017570000000116212736141241015767 0ustar pravipravimodule JSON class JWK class Set < Array class KidNotFound < JWT::Exception; end def initialize(*jwks) jwks = if jwks.first.is_a?(Hash) && (keys = jwks.first.with_indifferent_access[:keys]) keys else jwks end jwks = Array(jwks).flatten.collect do |jwk| JWK.new jwk end replace jwks end def content_type 'application/jwk-set+json' end def as_json(options = {}) # NOTE: Array.new wrapper is requied to avoid CircularReferenceError {keys: Array.new(self)} end end end endjson-jwt-1.6.2/lib/json/jwk/jwkizable.rb0000644000175600017570000000357012736141241017163 0ustar pravipravimodule JSON class JWK module JWKizable module RSA def to_jwk(ex_params = {}) params = { kty: :RSA, e: UrlSafeBase64.encode64(e.to_s(2)), n: UrlSafeBase64.encode64(n.to_s(2)) }.merge ex_params if private? params.merge!( d: UrlSafeBase64.encode64(d.to_s(2)), p: UrlSafeBase64.encode64(p.to_s(2)), q: UrlSafeBase64.encode64(q.to_s(2)) ) end JWK.new params end end module EC def to_jwk(ex_params = {}) params = { kty: :EC, crv: curve_name, x: UrlSafeBase64.encode64(coordinates[:x].to_s(2)), y: UrlSafeBase64.encode64(coordinates[:y].to_s(2)) }.merge ex_params params[:d] = UrlSafeBase64.encode64(coordinates[:d].to_s(2)) if private_key? JWK.new params end private def curve_name case group.curve_name when 'prime256v1' :'P-256' when 'secp384r1' :'P-384' when 'secp521r1' :'P-521' else raise UnknownAlgorithm.new('Unknown EC Curve') end end def coordinates unless @coordinates hex = public_key.to_bn.to_s(16) data_len = hex.length - 2 hex_x = hex[2, data_len / 2] hex_y = hex[2 + data_len / 2, data_len / 2] @coordinates = { x: OpenSSL::BN.new([hex_x].pack('H*'), 2), y: OpenSSL::BN.new([hex_y].pack('H*'), 2) } @coordinates[:d] = private_key if private_key? end @coordinates end end end end end OpenSSL::PKey::RSA.send :include, JSON::JWK::JWKizable::RSA OpenSSL::PKey::EC.send :include, JSON::JWK::JWKizable::ECjson-jwt-1.6.2/lib/json/jwe.rb0000644000175600017570000002160312736141241015170 0ustar pravipravirequire 'securerandom' require 'bindata' module JSON class JWE class InvalidFormat < JWT::InvalidFormat; end class DecryptionFailed < JWT::VerificationFailed; end class UnexpectedAlgorithm < JWT::UnexpectedAlgorithm; end NUM_OF_SEGMENTS = 5 include JOSE attr_accessor( :public_key_or_secret, :private_key_or_secret, :plain_text, :cipher_text, :authentication_tag, :iv, :auth_data, :content_encryption_key, :jwe_encrypted_key, :encryption_key, :mac_key ) register_header_keys :enc, :epk, :zip, :apu, :apv alias_method :encryption_method, :enc def initialize(input = nil) self.plain_text = input.to_s end def encrypt!(public_key_or_secret) self.public_key_or_secret = with_jwk_support public_key_or_secret cipher.encrypt generate_cipher_keys! self.cipher_text = cipher.update(plain_text) + cipher.final self end def decrypt!(private_key_or_secret) self.private_key_or_secret = with_jwk_support private_key_or_secret cipher.decrypt restore_cipher_keys! self.plain_text = cipher.update(cipher_text) + cipher.final verify_cbc_authentication_tag! if cbc? self end def to_s [ header.to_json, jwe_encrypted_key, iv, cipher_text, authentication_tag ].collect do |segment| UrlSafeBase64.encode64 segment.to_s end.join('.') end def as_json(options = {}) case options[:syntax] when :general { protected: UrlSafeBase64.encode64(header.to_json), recipients: [{ encrypted_key: UrlSafeBase64.encode64(jwe_encrypted_key) }], iv: UrlSafeBase64.encode64(iv), ciphertext: UrlSafeBase64.encode64(cipher_text), tag: UrlSafeBase64.encode64(authentication_tag) } else { protected: UrlSafeBase64.encode64(header.to_json), encrypted_key: UrlSafeBase64.encode64(jwe_encrypted_key), iv: UrlSafeBase64.encode64(iv), ciphertext: UrlSafeBase64.encode64(cipher_text), tag: UrlSafeBase64.encode64(authentication_tag) } end end private # common def gcm_supported? RUBY_VERSION >= '2.0.0' && OpenSSL::OPENSSL_VERSION >= 'OpenSSL 1.0.1' end def gcm? [:A128GCM, :A256GCM].include? encryption_method.try(:to_sym) end def cbc? [:'A128CBC-HS256', :'A256CBC-HS512'].include? encryption_method.try(:to_sym) end def dir? :dir == algorithm.try(:to_sym) end def cipher @cipher ||= if gcm? && !gcm_supported? raise UnexpectedAlgorithm.new('AEC GCM requires Ruby 2.0+ and OpenSSL 1.0.1c+') if gcm? && !gcm_supported? else OpenSSL::Cipher.new cipher_name end end def cipher_name case encryption_method.try(:to_sym) when :A128GCM 'aes-128-gcm' when :A256GCM 'aes-256-gcm' when :'A128CBC-HS256' 'aes-128-cbc' when :'A256CBC-HS512' 'aes-256-cbc' else raise UnexpectedAlgorithm.new('Unknown Encryption Algorithm') end end def sha_size case encryption_method.try(:to_sym) when :'A128CBC-HS256' 256 when :'A256CBC-HS512' 512 else raise UnexpectedAlgorithm.new('Unknown Hash Size') end end def sha_digest OpenSSL::Digest.new "SHA#{sha_size}" end def derive_encryption_and_mac_keys_cbc! self.mac_key, self.encryption_key = content_encryption_key.unpack("a#{content_encryption_key.length / 2}" * 2) self end def derive_encryption_and_mac_keys_gcm! self.encryption_key = content_encryption_key self.mac_key = :wont_be_used self end # encryption def jwe_encrypted_key @jwe_encrypted_key ||= case algorithm.try(:to_sym) when :RSA1_5 public_key_or_secret.public_encrypt content_encryption_key when :'RSA-OAEP' public_key_or_secret.public_encrypt content_encryption_key, OpenSSL::PKey::RSA::PKCS1_OAEP_PADDING when :A128KW raise NotImplementedError.new('A128KW not supported yet') when :A256KW raise NotImplementedError.new('A256KW not supported yet') when :dir '' when :'ECDH-ES' raise NotImplementedError.new('ECDH-ES not supported yet') when :'ECDH-ES+A128KW' raise NotImplementedError.new('ECDH-ES+A128KW not supported yet') when :'ECDH-ES+A256KW' raise NotImplementedError.new('ECDH-ES+A256KW not supported yet') else raise UnexpectedAlgorithm.new('Unknown Encryption Algorithm') end end def generate_cipher_keys! case when gcm? generate_gcm_keys! when cbc? generate_cbc_keys! end cipher.key = encryption_key self.iv = cipher.random_iv self.auth_data = UrlSafeBase64.encode64 header.to_json if gcm? cipher.auth_data = self.auth_data end self end def generate_gcm_keys! self.content_encryption_key ||= if dir? public_key_or_secret else cipher.random_key end derive_encryption_and_mac_keys_gcm! self end def generate_cbc_keys! self.content_encryption_key ||= if dir? public_key_or_secret else SecureRandom.random_bytes sha_size / 8 end derive_encryption_and_mac_keys_cbc! self end def authentication_tag @authentication_tag ||= case when gcm? cipher.auth_tag when cbc? secured_input = [ auth_data, iv, cipher_text, BinData::Uint64be.new(auth_data.length * 8).to_binary_s ].join OpenSSL::HMAC.digest( sha_digest, mac_key, secured_input )[0, sha_size / 2 / 8] end end # decryption def decrypt_content_encryption_key case algorithm.try(:to_sym) when :RSA1_5 private_key_or_secret.private_decrypt jwe_encrypted_key when :'RSA-OAEP' private_key_or_secret.private_decrypt jwe_encrypted_key, OpenSSL::PKey::RSA::PKCS1_OAEP_PADDING when :A128KW raise NotImplementedError.new('A128KW not supported yet') when :A256KW raise NotImplementedError.new('A256KW not supported yet') when :dir private_key_or_secret when :'ECDH-ES' raise NotImplementedError.new('ECDH-ES not supported yet') when :'ECDH-ES+A128KW' raise NotImplementedError.new('ECDH-ES+A128KW not supported yet') when :'ECDH-ES+A256KW' raise NotImplementedError.new('ECDH-ES+A256KW not supported yet') else raise UnexpectedAlgorithm.new('Unknown Encryption Algorithm') end end def restore_cipher_keys! self.content_encryption_key = decrypt_content_encryption_key case when gcm? derive_encryption_and_mac_keys_gcm! when cbc? derive_encryption_and_mac_keys_cbc! end cipher.key = encryption_key cipher.iv = iv # NOTE: 'iv' has to be set after 'key' for GCM if gcm? cipher.auth_tag = authentication_tag cipher.auth_data = auth_data end end def verify_cbc_authentication_tag! secured_input = [ auth_data, iv, cipher_text, BinData::Uint64be.new(auth_data.length * 8).to_binary_s ].join expected_authentication_tag = OpenSSL::HMAC.digest( sha_digest, mac_key, secured_input )[0, sha_size / 2 / 8] unless secure_compare(authentication_tag, expected_authentication_tag) raise DecryptionFailed.new('Invalid authentication tag') end end class << self def decode_compact_serialized(input, private_key_or_secret) unless input.count('.') + 1 == NUM_OF_SEGMENTS raise InvalidFormat.new("Invalid JWE Format. JWE should include #{NUM_OF_SEGMENTS} segments.") end jwe = new _header_json_, jwe.jwe_encrypted_key, jwe.iv, jwe.cipher_text, jwe.authentication_tag = input.split('.').collect do |segment| UrlSafeBase64.decode64 segment end jwe.auth_data = input.split('.').first jwe.header = MultiJson.load(_header_json_).with_indifferent_access jwe.decrypt! private_key_or_secret unless private_key_or_secret == :skip_decryption jwe end def decode_json_serialized(input, private_key_or_secret) input = input.with_indifferent_access jwe_encrypted_key = if input[:recipients].present? input[:recipients].first[:encrypted_key] else input[:encrypted_key] end compact_serialized = [ input[:protected], jwe_encrypted_key, input[:iv], input[:ciphertext], input[:tag] ].join('.') decode_compact_serialized compact_serialized, private_key_or_secret end end end endjson-jwt-1.6.2/Rakefile0000644000175600017570000000061712736141241014006 0ustar pravipravirequire 'bundler' Bundler::GemHelper.install_tasks require 'rspec/core/rake_task' RSpec::Core::RakeTask.new(:spec) namespace :coverage do desc "Open coverage report" task :report do require 'simplecov' `open "#{File.join SimpleCov.coverage_path, 'index.html'}"` end end task :spec do Rake::Task[:'coverage:report'].invoke unless ENV['TRAVIS_RUBY_VERSION'] end task default: :specjson-jwt-1.6.2/.gitignore0000644000175600017570000000024712736141241014330 0ustar pravipravi## MAC OS .DS_Store ## TEXTMATE *.tmproj tmtags ## EMACS *~ \#* .\#* ## VIM *.swp ## PROJECT::GENERAL coverage* rdoc pkg Gemfile.lock ## PROJECT::SPECIFIC .class