cedarcode / cose-ruby

Ruby implementation of RFC 8152 CBOR Object Signing and Encryption (COSE)
https://rubygems.org/gems/cose
MIT License
15 stars 10 forks source link

Handling COSE EC keys encoded without leading 0 bytes in coordinates. #64

Closed waltercacau closed 1 month ago

waltercacau commented 2 months ago

Should address https://github.com/cedarcode/cose-ruby/issues/63

Added a unit test to cover it and ran them locally to verify it was working:

% bundle exec rspec spec

Randomized with seed 61233
.......................................................................................

Finished in 0.3211 seconds (files took 0.12736 seconds to load)
87 examples, 0 failures

Randomized with seed 61233
santiagorodriguez96 commented 1 month ago

Hi @waltercacau! Thank you so much for the report and also taking the time to propose a fix to it!

The changes look good to me, although I wonder what make you go for a different approach that the one taken in ruby-jwt? Would it be possible for a coordinate to have more than one leading zero and thus both coordinates differing in more than one byte?

waltercacau commented 1 month ago

Hi @waltercacau! Thank you so much for the report and also taking the time to propose a fix to it!

The changes look good to me, although I wonder what make you go for a different approach that the one taken in ruby-jwt? Would it be possible for a coordinate to have more than one leading zero and thus both coordinates differing in more than one byte?

I am not expert on it by any means but my understanding is that it is possible though might be unlikely.

The approach I took here was inspired by the approach done in this java library: https://github.com/felx/nimbus-jose-jwt/blob/47d66f2775c392964788aa6389a46fac84f976cd/src/main/java/com/nimbusds/jose/jwk/ECKey.java#L595-L612

That code seemed to handle these cases more generally.

waltercacau commented 1 month ago

Alright, deleted the extra test/debug code I had and reran the tests:

% bundle exec rspec spec

Randomized with seed 4620
......................................................................................

Finished in 0.21978 seconds (files took 0.3266 seconds to load)
86 examples, 0 failures

I think this PR is now good to go