openbullet / OpenBullet2

OpenBullet reinvented
https://docs.openbullet.dev/
MIT License
1.8k stars 481 forks source link

Implemented RSA signing for JWT #1056

Closed GekySan closed 4 months ago

GekySan commented 4 months ago

Description

This pull request implements RSA signing support for JWT encoding. The JwtEncode method has been modified to include support for RS256, RS384, RS512, RS1024, RS2048, and RS4096 algorithms.

Type of change

Please delete options that are not relevant.

How Has This Been Tested?

GekySan commented 4 months ago

Hello and thank you for this contribution. Just leaving you a couple of comments (alongside the one in the code review):

  1. Please, in the extraInfo of the Block attribute in the JwtEncode method of RuriLib.Blocks.Functions.Crypto.Methods.cs could you add some information related to the fact that for asymmetric JWTs people need to pass a key in the PEM format as the secret? I think the exception you get is talkative enough per se, but maybe it won't hurt to specify it here as well.
  2. Could you post some LoliCode to test this? Because when I put a PEM key I get [Executing block JWT Encode] CryptographicException: Unknown error (0xc100000d)

Thanks!

Hello,

  1. Done.
  2. I believe you have used a public key instead of a private key. Please find the example lolicode below :
// string privateKey = "azerty";
/*
 * Output : 
 * [Executing block JWT Encode] ArgumentException: No supported key formats were found. Check that the input represents the contents of a PEM-encoded key file, not the path to such a file. (Parameter 'input')
 */

/*
string privateKey = @"-----BEGIN PUBLIC KEY-----
MIGeMA0GCSqGSIb3DQEBAQUAA4GMADCBiAKBgHyonfRdNbXxN+5DGk7/doCJo4LI
xkJ82LBMCGnVSZLJFRsutTT4znyCxC0AjFkom1+xhFgE0tMh4CwtqT6d1FgVXT83
R9DMMLfcY6Mfm16zGiwLUsWcmqQgfIB47q4hLHxr3lQ56Pbw/o0y3FPH4KL+7abu
f3gCDbUHC/FnoJH5AgMBAAE=
-----END PUBLIC KEY-----";*/

/*
 * Output : 
 * [Executing block JWT Encode] CryptographicException: Unknown error (0xc100000d)
 */

string privateKey = @"-----BEGIN RSA PRIVATE KEY-----
MIICXAIBAAKBgQDBu9sGR/GPoBIIndZ9gVN0OF6Hw5l67bZdlMgPb03hdDn5xthM
N6oMBatgibA1MWJLdYXUZG/m15soyV+Th9KWpTbHfowbMrPK0MZ4wuepuWk2qbBC
pdMIS6XzZa4J+WWYTnC7uliD5+zb//qabegVXdWu9DDrcujp0Oz8UI/PzQIDAQAB
AoGAEqitJ6W2NkcMdZf+GIhkKUVklV7ZYWWTst+phRMLRTOUgeIM4wpZbl79aobY
Wccv2GSxRwuFW45Ye00pz2O9fGnokzElIcO9Ew6zD24cyTulk83kv99mYPNpOTOE
kXQ29mDRnlCHIN0ebVVrYWLhhcFs78B+qIP+0lOCihQNbGECQQDqfV0i7Eeuu+xv
Hu5NfXIuxDhHLRpKEPTJyVC4yFqc+04WFeMZ7X/cu1Jm843h5v8o97wbfLbflkur
eS1V4nijAkEA04FmuBUpyXM2e1z9mEkmAMvziWzcRCSyvsW8cKNLEhi+tevqYoy0
DdFlwEImP/ZajFzD516BsI0WwFj53X7szwJAH7GWFxRMlAd+a36IwxyDhGKtIKGt
/fjQvT1ilbcu2Cz3XvDSYzzAnXsMJjIhKTlpn4XsfOKcbRgJXkHgqM0VdQJBAIw0
l5cn0E+OZGtatXEh7GNSz9olo844VZVJFyXD2Zvhc2q9PN6fTyxpxv2v3BNCh7vM
MsFJUMdsf8x6Lwi5ftkCQG9o8dohsvaHBgcACwI9Ef0rv9mZBX7T3sXZ2ejhqQDA
qW89RiLklV0jS6GceOSz2srngDLpiFG4dAwI8phZf2k=
-----END RSA PRIVATE KEY-----";

BLOCK:JwtEncode
  algorithm = RS256
  secret = @privateKey
  payload = $"{\"open\":\"bullet\"}"
  => VAR @jwtEncodeOutput
ENDBLOCK
openbullet commented 4 months ago
  1. I believe you have used a public key instead of a private key. Please find the example lolicode below :

You're right, my mistake. I was indeed using a public key 😅 it works well now. Merging, thanks again!