prosody
445f7bd6ffc4
util/jwt.lua

Find changesets by keywords by author, files, the commit message, revision number or hash, or revset expression.

Software / code / prosody

Comparison

util/jwt.lua @ 12735:445f7bd6ffc4

util.crypto, util.jwt: Generate consistent signature sizes (via padding) This fixes the signature parsing and building to work correctly. Sometimes a signature was one or two bytes too short, and needed to be padded. OpenSSL can do this for us.
author Matthew Wild <mwild1@gmail.com>
date Thu, 29 Sep 2022 23:15:39 +0100
parent 12707:f75235110045
child 12736:ad4ab01f9b11
comparison
equal deleted inserted replaced
12734:447aef5e942c 12735:445f7bd6ffc4
133 local c_verify = crypto[rsa_sign_algos[family].."_sha"..digest_bits.."_verify"]; 133 local c_verify = crypto[rsa_sign_algos[family].."_sha"..digest_bits.."_verify"];
134 return new_crypto_algorithm(name, "rsaEncryption", c_sign, c_verify); 134 return new_crypto_algorithm(name, "rsaEncryption", c_sign, c_verify);
135 end 135 end
136 136
137 -- ES*** 137 -- ES***
138 local function new_ecdsa_algorithm(name, c_sign, c_verify) 138 local function new_ecdsa_algorithm(name, c_sign, c_verify, sig_bytes)
139 local function encode_ecdsa_sig(der_sig) 139 local function encode_ecdsa_sig(der_sig)
140 local r, s = crypto.parse_ecdsa_signature(der_sig); 140 local r, s = crypto.parse_ecdsa_signature(der_sig, sig_bytes);
141 return r..s; 141 return r..s;
142 end 142 end
143 143
144 local function decode_ecdsa_sig(jwk_sig) 144 local function decode_ecdsa_sig(jwk_sig)
145 return crypto.build_ecdsa_signature(jwk_sig:sub(1, 32), jwk_sig:sub(33, 64)); 145 return crypto.build_ecdsa_signature(jwk_sig:sub(1, sig_bytes), jwk_sig:sub(sig_bytes+1, sig_bytes*2));
146 end 146 end
147 return new_crypto_algorithm(name, "id-ecPublicKey", c_sign, c_verify, encode_ecdsa_sig, decode_ecdsa_sig); 147 return new_crypto_algorithm(name, "id-ecPublicKey", c_sign, c_verify, encode_ecdsa_sig, decode_ecdsa_sig);
148 end 148 end
149 149
150 local algorithms = { 150 local algorithms = {
151 HS256 = new_hmac_algorithm("HS256"), HS384 = new_hmac_algorithm("HS384"), HS512 = new_hmac_algorithm("HS512"); 151 HS256 = new_hmac_algorithm("HS256"), HS384 = new_hmac_algorithm("HS384"), HS512 = new_hmac_algorithm("HS512");
152 ES256 = new_ecdsa_algorithm("ES256", crypto.ecdsa_sha256_sign, crypto.ecdsa_sha256_verify); 152 ES256 = new_ecdsa_algorithm("ES256", crypto.ecdsa_sha256_sign, crypto.ecdsa_sha256_verify, 32);
153 RS256 = new_rsa_algorithm("RS256"), RS384 = new_rsa_algorithm("RS384"), RS512 = new_rsa_algorithm("RS512"); 153 RS256 = new_rsa_algorithm("RS256"), RS384 = new_rsa_algorithm("RS384"), RS512 = new_rsa_algorithm("RS512");
154 PS256 = new_rsa_algorithm("PS256"), PS384 = new_rsa_algorithm("PS384"), PS512 = new_rsa_algorithm("PS512"); 154 PS256 = new_rsa_algorithm("PS256"), PS384 = new_rsa_algorithm("PS384"), PS512 = new_rsa_algorithm("PS512");
155 }; 155 };
156 156
157 local function new_signer(algorithm, key_input, options) 157 local function new_signer(algorithm, key_input, options)