Class: JOSE::JWK::KTY_EC

Inherits:
Struct
  • Object
show all
Defined in:
lib/jose/jwk/kty_ec.rb

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Instance Attribute Details

#key ⇒ Object

Returns the value of attribute key

Returns:

  • (Object) —

    the current value of key



1
2
3
 
# File 'lib/jose/jwk/kty_ec.rb', line 1

def key
  @key
end

Class Method Details

.from_key(key) ⇒ Object

API functions



228
229
230
231
232
233
234
235
236
 
# File 'lib/jose/jwk/kty_ec.rb', line 228

def self.from_key(key)
  key = key.__getobj__ if key.is_a?(JOSE::JWK::PKeyProxy)
  case key
  when OpenSSL::PKey::EC
    return JOSE::JWK::KTY_EC.new(JOSE::JWK::PKeyProxy.new(key)), JOSE::Map[]
  else
    raise ArgumentError, "'key' must be a OpenSSL::PKey::EC"
  end
end

.from_map(fields) ⇒ Object

JOSE::JWK callbacks



5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
 
# File 'lib/jose/jwk/kty_ec.rb', line 5

def self.from_map(fields)
  if fields['kty'] == 'EC' and fields['crv'].is_a?(String) and fields['x'].is_a?(String) and fields['y'].is_a?(String)
    crv = case fields['crv']
    when 'P-256'
      'prime256v1'
    when 'P-384'
      'secp384r1'
    when 'P-521'
      'secp521r1'
    else
      raise ArgumentError, "invalid 'EC' JWK"
    end

    x = JOSE.urlsafe_decode64(fields['x'])
    y = JOSE.urlsafe_decode64(fields['y'])
    point    = OpenSSL::PKey::EC::Point.new(
      OpenSSL::PKey::EC::Group.new(crv),
      OpenSSL::BN.new([0x04, x, y].pack('Ca*a*'), 2)
    )

    sequence = if fields['d'].is_a?(String)
      OpenSSL::ASN1::Sequence([
        OpenSSL::ASN1::Integer(1),
        OpenSSL::ASN1::OctetString(OpenSSL::BN.new(JOSE.urlsafe_decode64(fields['d']), 2).to_s(2)),
        OpenSSL::ASN1::ObjectId(crv, 0, :EXPLICIT),
        OpenSSL::ASN1::BitString(point.to_octet_string(:uncompressed), 1, :EXPLICIT)
      ])
    else
      OpenSSL::ASN1::Sequence([
        OpenSSL::ASN1::Sequence([
          OpenSSL::ASN1::ObjectId("id-ecPublicKey"),
          OpenSSL::ASN1::ObjectId(crv)
        ]),
        OpenSSL::ASN1::BitString(point.to_octet_string(:uncompressed))
      ])
    end
    ec = OpenSSL::PKey::EC.new(sequence.to_der)
    return JOSE::JWK::KTY_EC.new(JOSE::JWK::PKeyProxy.new(ec)), fields.except('kty', 'crv', 'd', 'x', 'y')
  else
    raise ArgumentError, "invalid 'EC' JWK"
  end
end

.generate_key(curve_name) ⇒ Object 



135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
 
# File 'lib/jose/jwk/kty_ec.rb', line 135

def self.generate_key(curve_name)
  if curve_name.is_a?(Array) and curve_name.length == 2 and curve_name[0] == :ec
    curve_name = curve_name[1]
  end
  curve_name = case curve_name
  when 'P-256'
    'prime256v1'
  when 'P-384'
    'secp384r1'
  when 'P-521'
    'secp521r1'
  else
    curve_name
  end
  if curve_name.is_a?(String)
    return from_key(OpenSSL::PKey::EC.generate(curve_name))
  else
    raise ArgumentError, "'curve_name' must be a String"
  end
end

Instance Method Details

#block_encryptor(fields) ⇒ Object

JOSE::JWK::KTY callbacks



100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
 
# File 'lib/jose/jwk/kty_ec.rb', line 100

def block_encryptor(fields)
  if fields and fields['use'] == 'enc' and not fields['alg'].nil? and not fields['enc'].nil?
    jwe = JOSE::Map[
      'alg' => fields['alg'],
      'enc' => fields['enc']
    ]
    if not fields['apu'].nil?
      jwe = jwe.put('apu', fields['apu'])
    end
    if not fields['apv'].nil?
      jwe = jwe.put('apv', fields['apv'])
    end
    if not fields['epk'].nil?
      jwe = jwe.put('epk', fields['epk'])
    end
    return jwe
  else
    return JOSE::Map[
      'alg' => 'ECDH-ES',
      'enc' => 'A128GCM'
    ]
  end
end

#derive_key(my_private_key) ⇒ Object 



124
125
126
127
128
129
130
131
132
133
 
# File 'lib/jose/jwk/kty_ec.rb', line 124

def derive_key(my_private_key)
  if my_private_key.is_a?(JOSE::JWK)
    my_private_key = my_private_key.to_key
  end
  if my_private_key.private_key?
    return my_private_key.dh_compute_key(key.public_key)
  else
    raise ArgumentError, "derive_key requires a private key as an argument"
  end
end

#generate_key(fields) ⇒ Object 



156
157
158
159
 
# File 'lib/jose/jwk/kty_ec.rb', line 156

def generate_key(fields)
  kty, other_fields = JOSE::JWK::KTY_EC.generate_key([:ec, key.group.curve_name])
  return kty, fields.delete('kid').merge(other_fields)
end

#key_encryptor(fields, key) ⇒ Object 



161
162
163
 
# File 'lib/jose/jwk/kty_ec.rb', line 161

def key_encryptor(fields, key)
  return JOSE::JWK::KTY.key_encryptor(self, fields, key)
end

#sign(message, digest_type) ⇒ Object 



165
166
167
168
169
170
171
172
173
174
 
# File 'lib/jose/jwk/kty_ec.rb', line 165

def sign(message, digest_type)
  asn1_signature = key.dsa_sign_asn1(digest_type.digest(message))
  asn1_sequence = OpenSSL::ASN1.decode(asn1_signature)
  rbin = asn1_sequence.value[0].value.to_s(2)
  sbin = asn1_sequence.value[1].value.to_s(2)
  size = [rbin.bytesize, sbin.bytesize].max
  rpad = pad(rbin, size)
  spad = pad(sbin, size)
  return rpad.concat(spad)
end

#signer(fields = nil) ⇒ Object 



176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
 
# File 'lib/jose/jwk/kty_ec.rb', line 176

def signer(fields = nil)
  if key.private_key? and fields and fields['use'] == 'sig' and not fields['alg'].nil?
    return JOSE::Map['alg' => fields['alg']]
  elsif key.private_key?
    alg = case key.group.curve_name
    when 'prime256v1', 'secp256r1'
      'ES256'
    when 'secp384r1'
      'ES384'
    when 'secp521r1'
      'ES512'
    else
      raise ArgumentError, "unhandled EC curve name: #{key.group.curve_name.inspect}"
    end
    return JOSE::Map['alg' => alg]
  else
    raise ArgumentError, "signing not supported for public keys"
  end
end

#to_key ⇒ Object 



48
49
50
 
# File 'lib/jose/jwk/kty_ec.rb', line 48

def to_key
  return key.__getobj__
end

#to_map(fields) ⇒ Object 



52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
 
# File 'lib/jose/jwk/kty_ec.rb', line 52

def to_map(fields)
  ec_point = key.public_key.to_bn.to_s(2)
  ec_point_x, ec_point_y = case ec_point.bytesize
  when 65
    ec_point.unpack('xa32a32')
  when 97
    ec_point.unpack('xa48a48')
  when 133
    ec_point.unpack('xa66a66')
  else
    raise ArgumentError, "unhandled EC point size: #{ec_point.bytesize.inspect}"
  end
  crv = case key.group.curve_name
  when 'prime256v1', 'secp256r1'
    'P-256'
  when 'secp384r1'
    'P-384'
  when 'secp521r1'
    'P-521'
  else
    raise ArgumentError, "unhandled EC curve name: #{key.group.curve_name.inspect}"
  end
  if key.private_key?
    return fields.
      put('crv', crv).
      put('d',   JOSE.urlsafe_encode64(key.private_key.to_s(2))).
      put('kty', 'EC').
      put('x',   JOSE.urlsafe_encode64(ec_point_x)).
      put('y',   JOSE.urlsafe_encode64(ec_point_y))
  else
    return fields.
      put('crv', crv).
      put('kty', 'EC').
      put('x',   JOSE.urlsafe_encode64(ec_point_x)).
      put('y',   JOSE.urlsafe_encode64(ec_point_y))
  end
end

#to_pem(password = nil) ⇒ Object 



238
239
240
 
# File 'lib/jose/jwk/kty_ec.rb', line 238

def to_pem(password = nil)
  return JOSE::JWK::PEM.to_binary(key, password)
end

#to_public_map(fields) ⇒ Object 



90
91
92
 
# File 'lib/jose/jwk/kty_ec.rb', line 90

def to_public_map(fields)
  return to_map(fields).except('d')
end

#to_thumbprint_map(fields) ⇒ Object 



94
95
96
 
# File 'lib/jose/jwk/kty_ec.rb', line 94

def to_thumbprint_map(fields)
  return to_public_map(fields).slice('crv', 'kty', 'x', 'y')
end

#verifier(fields) ⇒ Object 



196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
 
# File 'lib/jose/jwk/kty_ec.rb', line 196

def verifier(fields)
  if fields and fields['use'] == 'sig' and not fields['alg'].nil?
    return [fields['alg']]
  else
    alg = case key.group.curve_name
    when 'prime256v1', 'secp256r1'
      'ES256'
    when 'secp384r1'
      'ES384'
    when 'secp521r1'
      'ES512'
    else
      raise ArgumentError, "unhandled EC curve name: #{key.group.curve_name.inspect}"
    end
    return [alg]
  end
end

#verify(message, digest_type, signature) ⇒ Object 



214
215
216
217
218
219
220
221
222
223
224
 
# File 'lib/jose/jwk/kty_ec.rb', line 214

def verify(message, digest_type, signature)
  n = signature.bytesize.div(2)
  r = OpenSSL::BN.new(signature[0..(n-1)], 2)
  s = OpenSSL::BN.new(signature[n..-1], 2)
  asn1_sequence = OpenSSL::ASN1::Sequence.new([
    OpenSSL::ASN1::Integer.new(r),
    OpenSSL::ASN1::Integer.new(s)
  ])
  asn1_signature = asn1_sequence.to_der
  return key.dsa_verify_asn1(digest_type.digest(message), asn1_signature)
end