Class: Moxml::Signature::Algorithms::HmacSha

Inherits:
SignatureMethodBase show all
Defined in:
lib/moxml/signature/algorithms/hmac_sha.rb

Overview

HMAC per RFC 2104, bound to a digest.

Per W3C XML Signature §4.4.2 and §6.3.1, if HMACOutputLength is specified, the output is truncated to that many bits and the truncation length MUST be at least max(hash_bits / 2, 80) bits.

Constant Summary collapse

PAIRINGS = 
{
  "http://www.w3.org/2000/09/xmldsig#hmac-sha1" => "SHA1",
  "http://www.w3.org/2001/04/xmldsig-more#hmac-sha224" => "SHA224",
  "http://www.w3.org/2001/04/xmldsig-more#hmac-sha256" => "SHA256",
  "http://www.w3.org/2001/04/xmldsig-more#hmac-sha384" => "SHA384",
  "http://www.w3.org/2001/04/xmldsig-more#hmac-sha512" => "SHA512",
}.freeze
HASH_BITS = 
{
  "SHA1" => 160,
  "SHA224" => 224,
  "SHA256" => 256,
  "SHA384" => 384,
  "SHA512" => 512,
}.freeze
MIN_TRUNCATION_BITS = 
80

Instance Method Summary collapse

Methods inherited from SignatureMethodBase

identifier, #sign, #verify

Constructor Details

#initialize(identifier_uri:, parameters: nil) ⇒ HmacSha

parameters: optional { hmac_output_length: Integer } (bits, multiple of 8)



35
36
37
38
39
40
 
# File 'lib/moxml/signature/algorithms/hmac_sha.rb', line 35

def initialize(identifier_uri:, parameters: nil)
  super(parameters)
  @identifier_uri = identifier_uri
  @truncation_bits = parameters&.dig(:hmac_output_length)
  validate_truncation! if @truncation_bits
end

Instance Method Details

#compute_signature(data, key) ⇒ Object 



42
43
44
45
46
 
# File 'lib/moxml/signature/algorithms/hmac_sha.rb', line 42

def compute_signature(data, key)
  secret = coerce_key(key)
  full = OpenSSL::HMAC.digest(digest_name, secret, data)
  truncate(full)
end

#verify_signature(data, key, signature) ⇒ Object 



48
49
50
51
 
# File 'lib/moxml/signature/algorithms/hmac_sha.rb', line 48

def verify_signature(data, key, signature)
  expected = compute_signature(data, key)
  fixed_comparison(expected, signature)
end