Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Drop support for old nodejs versions (req v14) #49

Open
wants to merge 6 commits into
base: master
Choose a base branch
from
Open

Drop support for old nodejs versions (req v14) #49

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
2d86e2c
Drop support for old nodejs versions
Sep 15, 2023
d709800
use crypto.timingSafeEqual and drop prefix
Sep 15, 2023
3d74137
drop more prefixes
Sep 15, 2023
8042161
remove dep on node:util
Sep 15, 2023
d174030
now also solves #45
Sep 15, 2023
f3c4499
merged some if statement
Sep 15, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 1 addition & 11 deletions .travis.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,16 +1,6 @@
language: node_js
node_js:
- 0.10
- 0.11
- 0.12
- 4
- 5
- 6
- 7
- 8
- 9
- 10
- 11
- 14
notifications:
email:
recipients:
Expand Down
127 changes: 34 additions & 93 deletions index.js
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,19 +1,13 @@
var bufferEqual = require('buffer-equal-constant-time');
var Buffer = require('safe-buffer').Buffer;
var Buffer = require('buffer').Buffer;
var crypto = require('crypto');
var formatEcdsa = require('ecdsa-sig-formatter');
Copy link

@panva panva Sep 15, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Node crypto's own dsaEncoding option valued ieee-p1363 can be used for ECDSA to completely remove the ecdsa-sig-formatter dependency. This was added in nodejs/node#29292 and is available in all nodejs versions above v13.2.0 and v12.16.0.

At the same time the node crypto now offers one-shot sign and verify methods which can be used both in both a blocking and non-blocking manner.

Copy link
Author

@jimmywarting jimmywarting Sep 15, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hmm, can you show a code example of how to solve it...
maybe just do a little diff suggestion and then i can just apply the changes ;)

```diff
+
-
```

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You would need a separate signer and verifier functions (like it is done for RSA-PSS) and instead of padding and saltLength options use the dsaEncoding option. Nothing special really.

The one-shot APIs are self-explanatory and documented

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sry, i'm too lost right now. don't work much with cryptografy. will leave this fully up to you guys to solve.

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's really just a lift and shift from the old api to the new and for ecdsa having a dedicated signer/verifier with the dsaEncoding option.

var util = require('util');

var MSG_INVALID_ALGORITHM = '"%s" is not a valid algorithm.\n Supported algorithms are:\n "HS256", "HS384", "HS512", "RS256", "RS384", "RS512", "PS256", "PS384", "PS512", "ES256", "ES384", "ES512" and "none".'
var MSG_INVALID_SECRET = 'secret must be a string or buffer';
var MSG_INVALID_VERIFIER_KEY = 'key must be a string or a buffer';
var MSG_INVALID_ALGORITHM = 'is not a valid algorithm.\n Supported algorithms are:\n "HS256", "HS384", "HS512", "RS256", "RS384", "RS512", "PS256", "PS384", "PS512", "ES256", "ES384", "ES512" and "none".'
var MSG_INVALID_SECRET = 'secret must be a string or buffer or a KeyObject';
var MSG_INVALID_VERIFIER_KEY = 'key must be a string or a buffer or a KeyObject';
var MSG_INVALID_SIGNER_KEY = 'key must be a string, a buffer or an object';

var supportsKeyObjects = typeof crypto.createPublicKey === 'function';
if (supportsKeyObjects) {
MSG_INVALID_VERIFIER_KEY += ' or a KeyObject';
MSG_INVALID_SECRET += 'or a KeyObject';
}
var timingSafeEqual = crypto.timingSafeEqual

function checkIsPublicKey(key) {
if (Buffer.isBuffer(key)) {
Expand All @@ -24,95 +18,39 @@ function checkIsPublicKey(key) {
return;
}

if (!supportsKeyObjects) {
throw typeError(MSG_INVALID_VERIFIER_KEY);
}

if (typeof key !== 'object') {
throw typeError(MSG_INVALID_VERIFIER_KEY);
throw new TypeError(MSG_INVALID_VERIFIER_KEY);
}

if (typeof key.type !== 'string') {
throw typeError(MSG_INVALID_VERIFIER_KEY);
throw new TypeError(MSG_INVALID_VERIFIER_KEY);
}

if (typeof key.asymmetricKeyType !== 'string') {
throw typeError(MSG_INVALID_VERIFIER_KEY);
throw new TypeError(MSG_INVALID_VERIFIER_KEY);
}

if (typeof key.export !== 'function') {
throw typeError(MSG_INVALID_VERIFIER_KEY);
throw new TypeError(MSG_INVALID_VERIFIER_KEY);
}
};

function checkIsPrivateKey(key) {
if (Buffer.isBuffer(key)) {
return;
}

if (typeof key === 'string') {
if (Buffer.isBuffer(key) || typeof key === 'string' || typeof key === 'object') {
return;
}

if (typeof key === 'object') {
return;
}

throw typeError(MSG_INVALID_SIGNER_KEY);
throw new TypeError(MSG_INVALID_SIGNER_KEY);
};

function checkIsSecretKey(key) {
if (Buffer.isBuffer(key)) {
if (Buffer.isBuffer(key) || typeof key === 'string' || typeof key === 'object') {
return;
}

if (typeof key === 'string') {
return key;
}

if (!supportsKeyObjects) {
throw typeError(MSG_INVALID_SECRET);
}

if (typeof key !== 'object') {
throw typeError(MSG_INVALID_SECRET);
}

if (key.type !== 'secret') {
throw typeError(MSG_INVALID_SECRET);
}

if (typeof key.export !== 'function') {
throw typeError(MSG_INVALID_SECRET);
}
}

function fromBase64(base64) {
return base64
.replace(/=/g, '')
.replace(/\+/g, '-')
.replace(/\//g, '_');
}

function toBase64(base64url) {
base64url = base64url.toString();

var padding = 4 - base64url.length % 4;
if (padding !== 4) {
for (var i = 0; i < padding; ++i) {
base64url += '=';
}
if (key.type !== 'secret' || typeof key.export !== 'function') {
throw new TypeError(MSG_INVALID_SECRET);
}

return base64url
.replace(/\-/g, '+')
.replace(/_/g, '/');
}

function typeError(template) {
var args = [].slice.call(arguments, 1);
var errMsg = util.format.bind(util, template).apply(null, args);
return new TypeError(errMsg);
}

function bufferOrString(obj) {
Expand All @@ -130,15 +68,18 @@ function createHmacSigner(bits) {
checkIsSecretKey(secret);
thing = normalizeInput(thing);
var hmac = crypto.createHmac('sha' + bits, secret);
var sig = (hmac.update(thing), hmac.digest('base64'))
return fromBase64(sig);
hmac.update(thing);
var sig = hmac.digest('base64url')
return sig;
}
}

function createHmacVerifier(bits) {
return function verify(thing, signature, secret) {
var computedSig = createHmacSigner(bits)(thing, secret);
return bufferEqual(Buffer.from(signature), Buffer.from(computedSig));
var a = Buffer.from(signature);
var b = Buffer.from(computedSig);
return a.byteLength === b.byteLength && timingSafeEqual(a, b);
}
}

Expand All @@ -148,49 +89,49 @@ function createKeySigner(bits) {
thing = normalizeInput(thing);
// Even though we are specifying "RSA" here, this works with ECDSA
// keys as well.
var signer = crypto.createSign('RSA-SHA' + bits);
var sig = (signer.update(thing), signer.sign(privateKey, 'base64'));
return fromBase64(sig);
var signer = crypto.createSign('SHA' + bits);
signer.update(thing);
var sig = signer.sign(privateKey, 'base64url');
return sig;
}
}

function createKeyVerifier(bits) {
return function verify(thing, signature, publicKey) {
checkIsPublicKey(publicKey);
thing = normalizeInput(thing);
signature = toBase64(signature);
var verifier = crypto.createVerify('RSA-SHA' + bits);
var verifier = crypto.createVerify('SHA' + bits);
verifier.update(thing);
return verifier.verify(publicKey, signature, 'base64');
return verifier.verify(publicKey, signature, 'base64url');
}
}

function createPSSKeySigner(bits) {
return function sign(thing, privateKey) {
checkIsPrivateKey(privateKey);
thing = normalizeInput(thing);
var signer = crypto.createSign('RSA-SHA' + bits);
var sig = (signer.update(thing), signer.sign({
var signer = crypto.createSign('SHA' + bits);
signer.update(thing);
var sig = signer.sign({
key: privateKey,
padding: crypto.constants.RSA_PKCS1_PSS_PADDING,
saltLength: crypto.constants.RSA_PSS_SALTLEN_DIGEST
}, 'base64'));
return fromBase64(sig);
}, 'base64url');
return sig;
}
}

function createPSSKeyVerifier(bits) {
return function verify(thing, signature, publicKey) {
checkIsPublicKey(publicKey);
thing = normalizeInput(thing);
signature = toBase64(signature);
var verifier = crypto.createVerify('RSA-SHA' + bits);
var verifier = crypto.createVerify('SHA' + bits);
verifier.update(thing);
return verifier.verify({
key: publicKey,
padding: crypto.constants.RSA_PKCS1_PSS_PADDING,
saltLength: crypto.constants.RSA_PSS_SALTLEN_DIGEST
}, signature, 'base64');
}, signature, 'base64url');
}
}

Expand Down Expand Up @@ -241,7 +182,7 @@ module.exports = function jwa(algorithm) {
}
var match = algorithm.match(/^(RS|PS|ES|HS)(256|384|512)$|^(none)$/);
if (!match)
throw typeError(MSG_INVALID_ALGORITHM, algorithm);
throw new TypeError(`"${algorithm}" ` + MSG_INVALID_ALGORITHM);
var algo = (match[1] || match[3]).toLowerCase();
var bits = match[2];

Expand Down
7 changes: 4 additions & 3 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,10 +6,11 @@
"directories": {
"test": "test"
},
"engines": {
"node": ">=14.18.0"
},
"dependencies": {
"buffer-equal-constant-time": "1.0.1",
"ecdsa-sig-formatter": "1.0.11",
"safe-buffer": "^5.0.1"
"ecdsa-sig-formatter": "1.0.11"
},
"devDependencies": {
"base64url": "^2.0.0",
Expand Down