Module: JWE::Enc::AesCbcHs

Included in:
A128cbcHs256, A192cbcHs384, A256cbcHs512
Defined in:
lib/jwe/enc/aes_cbc_hs.rb

Overview

Abstract AES in Block cipher mode, with message signature for different key sizes.

Defined Under Namespace

Modules: ClassMethods

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Instance Attribute Details

#cek ⇒ Object

Returns the value of attribute cek.



9
10
11
 
# File 'lib/jwe/enc/aes_cbc_hs.rb', line 9

def cek
  @cek
end

#iv ⇒ Object

Returns the value of attribute iv.



10
11
12
 
# File 'lib/jwe/enc/aes_cbc_hs.rb', line 10

def iv
  @iv
end

#tag ⇒ Object

Returns the value of attribute tag.



11
12
13
 
# File 'lib/jwe/enc/aes_cbc_hs.rb', line 11

def tag
  @tag
end

Class Method Details

.included(base) ⇒ Object 



82
83
84
 
# File 'lib/jwe/enc/aes_cbc_hs.rb', line 82

def self.included(base)
  base.extend(ClassMethods)
end

Instance Method Details

#cipher ⇒ Object 



74
75
76
 
# File 'lib/jwe/enc/aes_cbc_hs.rb', line 74

def cipher
  @cipher ||= Cipher.for(cipher_name)
end

#cipher_round(direction, iv, data) ⇒ Object 



42
43
44
45
46
47
48
 
# File 'lib/jwe/enc/aes_cbc_hs.rb', line 42

def cipher_round(direction, iv, data)
  cipher.send(direction)
  cipher.key = enc_key
  cipher.iv = iv

  cipher.update(data) + cipher.final
end

#decrypt(ciphertext, authenticated_data) ⇒ Object 



29
30
31
32
33
34
35
36
37
38
39
40
 
# File 'lib/jwe/enc/aes_cbc_hs.rb', line 29

def decrypt(ciphertext, authenticated_data)
  raise JWE::BadCEK, "The supplied key is invalid. Required length: #{key_length}" if cek.length != key_length

  signature = generate_tag(authenticated_data, iv, ciphertext)
  if signature != tag
    raise JWE::InvalidData, 'Authentication tag verification failed'
  end

  cipher_round(:decrypt, iv, ciphertext)
rescue OpenSSL::Cipher::CipherError
  raise JWE::InvalidData, 'Invalid ciphertext or authentication tag'
end

#enc_key ⇒ Object 



70
71
72
 
# File 'lib/jwe/enc/aes_cbc_hs.rb', line 70

def enc_key
  cek[(key_length / 2)..-1]
end

#encrypt(cleartext, authenticated_data) ⇒ Object

Raises:



18
19
20
21
22
23
24
25
26
27
 
# File 'lib/jwe/enc/aes_cbc_hs.rb', line 18

def encrypt(cleartext, authenticated_data)
  raise JWE::BadCEK.new("The supplied key is invalid. Required length: #{key_length}") if cek.length != key_length

  ciphertext = cipher_round(:encrypt, iv, cleartext)

  signature = generate_tag(authenticated_data, iv, ciphertext)
  self.tag = signature

  ciphertext
end

#generate_tag(authenticated_data, iv, ciphertext) ⇒ Object 



50
51
52
53
54
55
56
 
# File 'lib/jwe/enc/aes_cbc_hs.rb', line 50

def generate_tag(authenticated_data, iv, ciphertext)
  length = [authenticated_data.length * 8].pack('Q>') # 64bit big endian
  to_sign = authenticated_data + iv + ciphertext + length
  signature = OpenSSL::HMAC.digest(OpenSSL::Digest.new(hash_name), mac_key, to_sign)

  signature[0...mac_key.length]
end

#initialize(cek = nil, iv = nil) ⇒ Object 



13
14
15
16
 
# File 'lib/jwe/enc/aes_cbc_hs.rb', line 13

def initialize(cek = nil, iv = nil)
  self.iv = iv
  self.cek = cek
end

#mac_key ⇒ Object 



66
67
68
 
# File 'lib/jwe/enc/aes_cbc_hs.rb', line 66

def mac_key
  cek[0...(key_length / 2)]
end