Prepare 2.4.0 (#259)

* Add license file headers * Use timing safe compare for AES CBC auth tag check * Rename key parameter in signer and verifier inits * Fix rsa decryption error message * Enable preparation from branches * Bump version to 2.4.0 * Update changelog * Prepare 2.4.0 for release * Fix linter warning
airsidemobile · Apr 20, 2021 · 10ed3b6 · 10ed3b6
1 parent 6fa1c99
commit 10ed3b6
Show file tree

Hide file tree

Showing 17 changed files with 167 additions and 42 deletions.
diff --git a/.circleci/config.yml b/.circleci/config.yml
@@ -3,7 +3,7 @@ version: 2.1
 executors:
   mac-executor:
     macos:
-      xcode: "12.1.0"
+      xcode: "12.4.0"
     working_directory: ~/joseswift
 
 jobs:

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -4,6 +4,14 @@ All notable changes to this project will be documented in this file.
 
 Include references to issue- or pull-request numbers.
 
+## [2.4.0] - 2021-04-20
+
+- Use timing safe byte comparison for AES CBC MAC checks (#259)
+- Add support for JWS HS256, HS384, and HS512 algorithms (#258)
+- Bump kramdown from 2.3.0 to 2.3.1 (#255)
+- Update SPM installation instructions (#252)
+- Automate publishing releases on GitHub (#249)
+
 ## [2.3.1] - 2020-12-14
 
 - Stop installing SwiftLint when it's not installed (#246)

diff --git a/JOSESwift.podspec b/JOSESwift.podspec
@@ -1,6 +1,6 @@
 Pod::Spec.new do |s|
   s.name              = "JOSESwift"
-  s.version           = "2.3.1"
+  s.version           = "2.4.0"
   s.license           = "Apache License, Version 2.0"
   s.summary           = "JOSE framework for Swift"
   s.authors           = { "Daniel Egger" => "[email protected]", "Carol Capek" => "[email protected]", "Christoph Gigi Fuchs" => "[email protected]" }

diff --git a/JOSESwift/Sources/AESCBCEncryption.swift b/JOSESwift/Sources/AESCBCEncryption.swift
@@ -86,7 +86,9 @@ struct AESCBCEncryption {
             using: contentEncryptionAlgorithm.hmacAlgorithm
         )
 
-        guard authenticationTag == contentEncryptionAlgorithm.authenticationTag(for: hmacOutput) else {
+        guard
+            authenticationTag.timingSafeCompare(with: contentEncryptionAlgorithm.authenticationTag(for: hmacOutput))
+        else {
             throw JWEError.hmacNotAuthenticated
         }
 

diff --git a/JOSESwift/Sources/HMACSigner.swift b/JOSESwift/Sources/HMACSigner.swift
@@ -4,6 +4,22 @@
 //
 //  Created by Tobias Hagemann on 14.04.21.
 //
+//  ---------------------------------------------------------------------------
+//  Copyright 2021 Airside Mobile Inc.
+//
+//  Licensed under the Apache License, Version 2.0 (the "License");
+//  you may not use this file except in compliance with the License.
+//  You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+//  Unless required by applicable law or agreed to in writing, software
+//  distributed under the License is distributed on an "AS IS" BASIS,
+//  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+//  See the License for the specific language governing permissions and
+//  limitations under the License.
+//  ---------------------------------------------------------------------------
+//
 
 import Foundation
 

diff --git a/JOSESwift/Sources/HMACVerifier.swift b/JOSESwift/Sources/HMACVerifier.swift
@@ -4,6 +4,22 @@
 //
 //  Created by Tobias Hagemann on 14.04.21.
 //
+//  ---------------------------------------------------------------------------
+//  Copyright 2021 Airside Mobile Inc.
+//
+//  Licensed under the Apache License, Version 2.0 (the "License");
+//  you may not use this file except in compliance with the License.
+//  You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+//  Unless required by applicable law or agreed to in writing, software
+//  distributed under the License is distributed on an "AS IS" BASIS,
+//  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+//  See the License for the specific language governing permissions and
+//  limitations under the License.
+//  ---------------------------------------------------------------------------
+//
 
 import Foundation
 

diff --git a/JOSESwift/Sources/Signer.swift b/JOSESwift/Sources/Signer.swift
@@ -41,29 +41,34 @@ public struct Signer<KeyType> {
     /// Constructs a signer used to sign a JWS.
     ///
     /// - Parameters:
-    ///   - signingAlgorithm: A desired `SignatureAlgorithm`.
-    ///   - privateKey: The private key used to sign the JWS. Currently supported key types are: `SecKey` and `Data`.
+    ///   - signingAlgorithm: The desired `SignatureAlgorithm`.
+    ///   - key: The key used to compute the JWS's signature or message authentication code (MAC).
+    ///     Currently supported key types are: `SecKey` and `Data`.
+    ///     - For _digital signature algorithms_ it is the sender's private key (`SecKey`)
+    ///       with which the JWS should be signed.
+    ///     - For _MAC algorithms_ it is the secret symmetric key (`Data`)
+    ///       shared between the sender and the recipient.
     /// - Returns: A fully initialized `Signer` or `nil` if provided key is of the wrong type.
-    public init?(signingAlgorithm: SignatureAlgorithm, privateKey: KeyType) {
+    public init?(signingAlgorithm: SignatureAlgorithm, key: KeyType) {
         switch signingAlgorithm {
         case .HS256, .HS384, .HS512:
-            guard type(of: privateKey) is HMACSigner.KeyType.Type else {
+            guard type(of: key) is HMACSigner.KeyType.Type else {
                 return nil
             }
             // swiftlint:disable:next force_cast
-            self.signer = HMACSigner(algorithm: signingAlgorithm, key: privateKey as! HMACSigner.KeyType)
+            self.signer = HMACSigner(algorithm: signingAlgorithm, key: key as! HMACSigner.KeyType)
         case .RS256, .RS384, .RS512, .PS256, .PS384, .PS512:
-            guard type(of: privateKey) is RSASigner.KeyType.Type else {
+            guard type(of: key) is RSASigner.KeyType.Type else {
                 return nil
             }
             // swiftlint:disable:next force_cast
-            self.signer = RSASigner(algorithm: signingAlgorithm, privateKey: privateKey as! RSASigner.KeyType)
+            self.signer = RSASigner(algorithm: signingAlgorithm, privateKey: key as! RSASigner.KeyType)
         case .ES256, .ES384, .ES512:
-            guard type(of: privateKey) is ECSigner.KeyType.Type else {
+            guard type(of: key) is ECSigner.KeyType.Type else {
                 return nil
             }
             // swiftlint:disable:next force_cast
-            self.signer = ECSigner(algorithm: signingAlgorithm, privateKey: privateKey as! ECSigner.KeyType)
+            self.signer = ECSigner(algorithm: signingAlgorithm, privateKey: key as! ECSigner.KeyType)
         }
     }
 
@@ -89,3 +94,12 @@ extension Array where Element == DataConvertible {
         return encoded.joined(separator: ".").data(using: .ascii)
     }
 }
+
+// MARK: - Deprecated API
+
+extension Signer {
+    @available(*, deprecated, message: "Use `init?(signingAlgorithm: SignatureAlgorithm, key: KeyType)` instead")
+    public init?(signingAlgorithm: SignatureAlgorithm, privateKey: KeyType) {
+        self.init(signingAlgorithm: signingAlgorithm, key: privateKey)
+    }
+}
diff --git a/JOSESwift/Sources/Verifier.swift b/JOSESwift/Sources/Verifier.swift
@@ -43,28 +43,33 @@ public struct Verifier {
     /// Constructs a verifyer used to verify a JWS.
     ///
     /// - Parameters:
-    ///   - signingAlgorithm: A desired `SignatureAlgorithm`.
-    ///   - privateKey: The public key used to verify the JWS's signature. Currently supported key types are: `SecKey` and `Data`.
+    ///   - verifyingAlgorithm: The desired `SignatureAlgorithm`.
+    ///   - key: The key used to verify the JWS's signature or message authentication code (MAC).
+    ///     Currently supported key types are: `SecKey` and `Data`.
+    ///     - For _digital signature algorithms_ it is the sender's public key (`SecKey`)
+    ///       with which the JWS signature should be verified.
+    ///     - For _MAC algorithms_ it is the secret symmetric key (`Data`)
+    ///       shared between the sender and the recipient.
     /// - Returns: A fully initialized `Verifier` or `nil` if provided key is of the wrong type.
-    public init?<KeyType>(verifyingAlgorithm: SignatureAlgorithm, publicKey: KeyType) {
+    public init?<KeyType>(verifyingAlgorithm: SignatureAlgorithm, key: KeyType) {
         switch verifyingAlgorithm {
         case .HS256, .HS384, .HS512:
-            guard type(of: publicKey) is HMACVerifier.KeyType.Type else {
+            guard type(of: key) is HMACVerifier.KeyType.Type else {
                 return nil
             }
             // swiftlint:disable:next force_cast
-            self.verifier = HMACVerifier(algorithm: verifyingAlgorithm, key: publicKey as! HMACVerifier.KeyType)
+            self.verifier = HMACVerifier(algorithm: verifyingAlgorithm, key: key as! HMACVerifier.KeyType)
         case .RS256, .RS384, .RS512, .PS256, .PS384, .PS512:
-            guard type(of: publicKey) is RSAVerifier.KeyType.Type else {
+            guard type(of: key) is RSAVerifier.KeyType.Type else {
                 return nil
             }
             // swiftlint:disable:next force_cast
-            self.verifier = RSAVerifier(algorithm: verifyingAlgorithm, publicKey: publicKey as! RSAVerifier.KeyType)
+            self.verifier = RSAVerifier(algorithm: verifyingAlgorithm, publicKey: key as! RSAVerifier.KeyType)
         case .ES256, .ES384, .ES512:
-            guard type(of: publicKey) is ECVerifier.KeyType.Type else {
+            guard type(of: key) is ECVerifier.KeyType.Type else {
                 return nil
             }
-            self.verifier = ECVerifier(algorithm: verifyingAlgorithm, publicKey: publicKey as! ECVerifier.KeyType)
+            self.verifier = ECVerifier(algorithm: verifyingAlgorithm, publicKey: key as! ECVerifier.KeyType)
         }
     }
 
@@ -80,3 +85,12 @@ public struct Verifier {
         return try verifier.verify(signingInput, against: signature)
     }
 }
+
+// MARK: - Deprecated API
+
+extension Verifier {
+    @available(*, deprecated, message: "Use `init?(verifyingAlgorithm: SignatureAlgorithm, key: KeyType)` instead")
+    public init?<KeyType>(verifyingAlgorithm: SignatureAlgorithm, publicKey: KeyType) {
+        self.init(verifyingAlgorithm: verifyingAlgorithm, key: publicKey)
+    }
+}
diff --git a/JOSESwift/Support/Info.plist b/JOSESwift/Support/Info.plist
@@ -15,7 +15,7 @@
 	<key>CFBundlePackageType</key>
 	<string>FMWK</string>
 	<key>CFBundleShortVersionString</key>
-	<string>2.3.1</string>
+	<string>2.4.0</string>
 	<key>CFBundleVersion</key>
 	<string>$(CURRENT_PROJECT_VERSION)</string>
 	<key>NSPrincipalClass</key>

diff --git a/Tests/HMACCryptoTestCase.swift b/Tests/HMACCryptoTestCase.swift
@@ -5,6 +5,22 @@
 //
 //  Created by Tobias Hagemann on 14.04.21.
 //
+//  ---------------------------------------------------------------------------
+//  Copyright 2021 Airside Mobile Inc.
+//
+//  Licensed under the Apache License, Version 2.0 (the "License");
+//  you may not use this file except in compliance with the License.
+//  You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+//  Unless required by applicable law or agreed to in writing, software
+//  distributed under the License is distributed on an "AS IS" BASIS,
+//  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+//  See the License for the specific language governing permissions and
+//  limitations under the License.
+//  ---------------------------------------------------------------------------
+//
 
 import XCTest
 

diff --git a/Tests/HMACSignerTests.swift b/Tests/HMACSignerTests.swift
@@ -4,6 +4,22 @@
 //
 //  Created by Tobias Hagemann on 14.04.21.
 //
+//  ---------------------------------------------------------------------------
+//  Copyright 2021 Airside Mobile Inc.
+//
+//  Licensed under the Apache License, Version 2.0 (the "License");
+//  you may not use this file except in compliance with the License.
+//  You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+//  Unless required by applicable law or agreed to in writing, software
+//  distributed under the License is distributed on an "AS IS" BASIS,
+//  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+//  See the License for the specific language governing permissions and
+//  limitations under the License.
+//  ---------------------------------------------------------------------------
+//
 
 import XCTest
 @testable import JOSESwift

diff --git a/Tests/HMACVerifierTests.swift b/Tests/HMACVerifierTests.swift
@@ -4,6 +4,22 @@
 //
 //  Created by Tobias Hagemann on 14.04.21.
 //
+//  ---------------------------------------------------------------------------
+//  Copyright 2021 Airside Mobile Inc.
+//
+//  Licensed under the Apache License, Version 2.0 (the "License");
+//  you may not use this file except in compliance with the License.
+//  You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+//  Unless required by applicable law or agreed to in writing, software
+//  distributed under the License is distributed on an "AS IS" BASIS,
+//  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+//  See the License for the specific language governing permissions and
+//  limitations under the License.
+//  ---------------------------------------------------------------------------
+//
 
 import XCTest
 @testable import JOSESwift

diff --git a/Tests/Info.plist b/Tests/Info.plist
@@ -15,7 +15,7 @@
 	<key>CFBundlePackageType</key>
 	<string>BNDL</string>
 	<key>CFBundleShortVersionString</key>
-	<string>2.3.1</string>
+	<string>2.4.0</string>
 	<key>CFBundleVersion</key>
 	<string>1</string>
 </dict>

diff --git a/Tests/JWECompressionTests.swift b/Tests/JWECompressionTests.swift
@@ -123,9 +123,9 @@ class JWECompressionTests: RSACryptoTestCase {
     func testNoneCompressor() throws {
         let noneCompressor = try CompressorFactory.makeCompressor(algorithm: CompressionAlgorithm.NONE)
         XCTAssert(noneCompressor is NoneCompressor)
-        //test none compress
+        // test none compress
         XCTAssertEqual(try noneCompressor.compress(data: data), data)
-        //test none decompress
+        // test none decompress
         XCTAssertEqual(try noneCompressor.decompress(data: data), data)
     }
 

diff --git a/Tests/JWSHMACTests.swift b/Tests/JWSHMACTests.swift
@@ -5,6 +5,22 @@
 //
 //  Created by Tobias Hagemann on 15.04.21.
 //
+//  ---------------------------------------------------------------------------
+//  Copyright 2021 Airside Mobile Inc.
+//
+//  Licensed under the Apache License, Version 2.0 (the "License");
+//  you may not use this file except in compliance with the License.
+//  You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+//  Unless required by applicable law or agreed to in writing, software
+//  distributed under the License is distributed on an "AS IS" BASIS,
+//  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+//  See the License for the specific language governing permissions and
+//  limitations under the License.
+//  ---------------------------------------------------------------------------
+//
 
 import XCTest
 @testable import JOSESwift

diff --git a/Tests/RSADecryptionTests.swift b/Tests/RSADecryptionTests.swift
@@ -83,22 +83,10 @@ class RSADecryptionTests: RSACryptoTestCase {
         8GmvJ5UwA==
         """
 
-    let rsa1DecryptionError = RSAError.decryptingFailed(description: """
-        The operation couldn’t be completed. (OSStatus error -50 - RSAdecrypt wrong input (err -1))
-        """) // adjusted for RSA-OAEP-256 error having a differe 'err' number
-    let rsaOAEPDecryptionError = RSAError.decryptingFailed(description: """
+    let rsaDecryptionError = RSAError.decryptingFailed(description: """
         The operation couldn’t be completed. (OSStatus error -50 - RSAdecrypt wrong input (err -27))
         """)
 
-    /// Dictionary of decryption errors for each available Asymmetric key algorithm
-    lazy var decryptionErrors: [String: RSAError] = {
-        [
-            KeyManagementAlgorithm.RSA1_5.rawValue: self.rsa1DecryptionError,
-            KeyManagementAlgorithm.RSAOAEP256.rawValue: self.rsaOAEPDecryptionError,
-            KeyManagementAlgorithm.RSAOAEP.rawValue: self.rsaOAEPDecryptionError
-        ]
-    }()
-
     /// Dictionary of ciphertexts for each available Asymmetric key algorithm generate via openssl with Alice's public key
     lazy var aliceCipherTextDict: [String: String] = {
         [
@@ -158,7 +146,7 @@ class RSADecryptionTests: RSACryptoTestCase {
             // Decrypting with the wrong key should throw an error
             let ciphertext = Data(base64URLEncoded: aliceCipherTextDict[algorithm.rawValue]!)!
             XCTAssertThrowsError(try RSA.decrypt(ciphertext, with: privateKeyBob2048!, and: algorithm)) { (error: Error) in
-                XCTAssertEqual(error as? RSAError, decryptionErrors[algorithm.rawValue])
+                XCTAssertEqual(error as? RSAError, rsaDecryptionError)
             }
         }
     }
@@ -173,7 +161,7 @@ class RSADecryptionTests: RSACryptoTestCase {
             // Decrypting with the wrong key should throw an error
             let ciphertext = Data(base64URLEncoded: bobCipherTextDict[algorithm.rawValue]!)!
             XCTAssertThrowsError(try RSA.decrypt(ciphertext, with: privateKeyAlice2048, and: algorithm)) { (error: Error) in
-                XCTAssertEqual(error as? RSAError, decryptionErrors[algorithm.rawValue])
+                XCTAssertEqual(error as? RSAError, rsaDecryptionError)
             }
         }
     }

diff --git a/fastlane/Fastfile b/fastlane/Fastfile
@@ -84,8 +84,11 @@ end
 
 desc "Prepares a release by bumping version, formatting code, running tests, setting up a release preparation branch"
 lane :prepare do |options|
-  # Ensure we prepare from current master
-  ensure_git_branch(branch: "master")
+  unless options[:force]
+    # Ensure we prepare from current master
+    ensure_git_branch(branch: "master") 
+  end
+
   ensure_git_status_clean
 
   # Bump version