KeyProvider-style API for signature schemes (HMAC) #673

Activity

1. arlyon

   added

   feature requestA feature has been asked for or suggested by the communityA feature has been asked for or suggested by the community

   on Oct 6, 2023
2. jimmyjames commented on Nov 13, 2023

   

   jimmyjames

   on Nov 13, 2023

   Contributor

   More actions

   👋 hi @arlyon, thanks for raising the request. Could you provide some additional info such as some pseudo-code of what the ideal solution would look like from a consumer's usage? Thanks!
3. arlyon commented on Dec 1, 2023

   

   arlyon

   on Dec 1, 2023

   Last edited by arlyon

   Author

   More actions

   I ended up writing my own implementation of Algorithm that reimplements HMACAlgorithm but with my custom key provider added. I would call this low priority since you can manually implement HMAC but I'd rather roll as little of my own crypto as possible :)

   import com.auth0.jwt.algorithms.Algorithm;
   import com.auth0.jwt.exceptions.SignatureGenerationException;
   import com.auth0.jwt.exceptions.SignatureVerificationException;
   import com.auth0.jwt.interfaces.DecodedJWT;
   import java.security.InvalidKeyException;
   import java.security.NoSuchAlgorithmException;
   import java.util.Base64;
   
   /**
    * Subclass representing an Hash-based MAC signing algorithm
    *
    * <p>This class is thread-safe.
    */
   public class KeyProvidedHMACAlgorithm extends Algorithm {
   
     private final CryptoHelper crypto;
     private final HMACKeyProvider keyProvider;
   
     // Visible for testing
     KeyProvidedHMACAlgorithm(
         CryptoHelper crypto, String id, String algorithm, HMACKeyProvider provider)
         throws IllegalArgumentException {
       super(id, algorithm);
       this.crypto = crypto;
       this.keyProvider = provider;
     }
   
     KeyProvidedHMACAlgorithm(String id, String algorithm, HMACKeyProvider provider)
         throws IllegalArgumentException {
       this(new CryptoHelper(), id, algorithm, provider);
     }
   
     @Override
     public void verify(DecodedJWT jwt) throws SignatureVerificationException {
       try {
         byte[] signatureBytes = Base64.getUrlDecoder().decode(jwt.getSignature());
         var secret = keyProvider.getKeyById(jwt.getKeyId());
         boolean valid =
             crypto.verifySignatureFor(
                 toString(), secret, jwt.getHeader(), jwt.getPayload(), signatureBytes);
         if (!valid) {
           throw new SignatureVerificationException(this);
         }
       } catch (IllegalStateException
           | InvalidKeyException
           | NoSuchAlgorithmException
           | IllegalArgumentException e) {
         throw new SignatureVerificationException(this, e);
       }
     }
   
     @Override
     public byte[] sign(byte[] headerBytes, byte[] payloadBytes) throws SignatureGenerationException {
       try {
         var secret = keyProvider.getKeyById(keyProvider.getKeyId());
         return crypto.createSignatureFor(toString(), secret, headerBytes, payloadBytes);
       } catch (NoSuchAlgorithmException | InvalidKeyException e) {
         throw new SignatureGenerationException(this, e);
       }
     }
   
     @Override
     public byte[] sign(byte[] contentBytes) throws SignatureGenerationException {
       try {
         var secret = keyProvider.getKeyById(keyProvider.getKeyId());
         return crypto.createSignatureFor(toString(), secret, contentBytes);
       } catch (NoSuchAlgorithmException | InvalidKeyException e) {
         throw new SignatureGenerationException(this, e);
       }
     }
   }

   import java.util.HashMap;
   import java.util.List;
   
   class HMACKeyProvider {
   
     HashMap<Long, byte[]> keyMap = new HashMap<Long, byte[]>();
   
     HMACKeyProvider(List<Secret> secrets) {
       for (Secret secret : secrets) {
         keyMap.put(secret.getKid(), secret.getSecret().getBytes());
       }
     }
   
     byte[] getKeyById(Long keyId) {
       if (keyId == null) {
         keyId = 1L;
       }
       return keyMap.get(keyId);
     }
   
     byte[] getKeyById(String keyId) throws NumberFormatException {
       return getKeyById(keyId == null ? null : Long.parseLong(keyId));
     }
   
     Long getKeyId() {
       return keyMap.keySet().stream().max(Long::compare).get();
     }
   }

   The request is an api similar to ECDSA and RSA that supports a generic HMACKeyProvider interface rather than hardcoding the key.