Class: Linzer::JWS::Key

Inherits:
Key
  • Object
show all
Defined in:
lib/linzer/jws.rb

Overview

JWS-compatible signing key implementation.

Wraps a JWT::JWK key object to provide the Linzer Key interface. This enables using JWK-format keys with HTTP Message Signatures.

See Also:

Instance Method Summary collapse

Instance Method Details

#jwk_thumbprint ⇒ String

Computes the RFC 7638 JWK SHA-256 Thumbprint for this key's public material.

Returns:

  • (String) —

    base64url-encoded (no padding) SHA-256 thumbprint

Raises:

  • (Error) —

    if this key's JWK "kty" is not supported

See Also:



124
125
126
127
128
129
130
131
132
 
# File 'lib/linzer/jws.rb', line 124

def jwk_thumbprint
  exported = material.export

  if exported[:kty] != "OKP"
    raise Error, "Unsupported JWK kty for thumbprint: #{exported[:kty]}"
  end

  material.key_digest
end

#sign(data) ⇒ String

Signs data using the JWS key.

Parameters:

  • data (String) —

    The data to sign

Returns:

  • (String) —

    The signature bytes

Raises:



98
99
100
101
102
 
# File 'lib/linzer/jws.rb', line 98

def sign(data)
  validate_signing_key
  algo = resolve_algorithm
  algo.sign(data: data, signing_key: signing_key)
end

#verify(signature, data) ⇒ Boolean

Verifies a signature using the JWS key.

Parameters:

  • signature (String) —

    The signature bytes to verify

  • data (String) —

    The data that was signed

Returns:

  • (Boolean) —

    true if valid, false otherwise

Raises:

  • (VerifyError) —

    If this key cannot be used for verification



110
111
112
113
114
 
# File 'lib/linzer/jws.rb', line 110

def verify(signature, data)
  validate_verify_key
  algo = resolve_algorithm
  algo.verify(data: data, signature: signature, verification_key: verify_key)
end