[#43120] [ruby-trunk - Bug #6124][Open] What is the purpose of "fake" gems in Ruby — Vit Ondruch <v.ondruch@...>

27 messages 2012/03/07

[#43142] Questions about thread performance (with benchmark included) — Rodrigo Rosenfeld Rosas <rr.rosas@...>

A while ago I've written an article entitled "How Nokogiri and JRuby

10 messages 2012/03/08

[#43148] [ruby-trunk - Feature #6126][Open] Introduce yes/no constants aliases for true/false — Egor Homakov <homakov@...>

16 messages 2012/03/09

[#43238] [ruby-trunk - Feature #6130][Open] inspect using to_s is pain — Thomas Sawyer <transfire@...>

21 messages 2012/03/11

[#43313] [ruby-trunk - Feature #6150][Open] add Enumerable#grep_v — Suraj Kurapati <sunaku@...>

17 messages 2012/03/15

[#43325] [ruby-trunk - Bug #6154][Open] Eliminate extending WaitReadable/Writable at runtime — Charles Nutter <headius@...>

25 messages 2012/03/16

[#43334] [ruby-trunk - Bug #6155][Open] Enumerable::Lazy#flat_map raises an exception when an element does not respond to #each — Dan Kubb <dan.kubb@...>

9 messages 2012/03/16

[#43370] [ruby-trunk - Feature #6166][Open] Enumerator::Lazy#pinch — Thomas Sawyer <transfire@...>

15 messages 2012/03/17

[#43373] [ruby-trunk - Bug #6168][Open] Segfault in OpenSSL bindings — Nguma Abojo <git.email.address@...>

14 messages 2012/03/17

[#43454] [ruby-trunk - Bug #6174][Open] Fix collision of ConditionVariable#wait timeout and #signal (+ other cosmetic changes) — "funny_falcon (Yura Sokolov)" <funny.falcon@...>

10 messages 2012/03/18

[#43497] [ruby-trunk - Bug #6179][Open] File::pos broken in Windows 1.9.3p125 — "jmthomas (Jason Thomas)" <jmthomas@...>

24 messages 2012/03/20

[#43502] [ruby-trunk - Feature #6180][Open] to_b for converting objects to a boolean value — "AaronLasseigne (Aaron Lasseigne)" <aaron.lasseigne@...>

17 messages 2012/03/20

[#43529] [ruby-trunk - Bug #6183][Open] Enumerator::Lazy performance issue — "gregolsen (Innokenty Mikhailov)" <anotheroneman@...>

36 messages 2012/03/21

[#43543] [ruby-trunk - Bug #6184][Open] [BUG] Segmentation fault ruby 1.9.3p165 (2012-03-18 revision 35078) [x86_64-darwin11.3.0] — "Gebor (Pierre-Henry Frohring)" <frohring.pierrehenry@...>

8 messages 2012/03/21

[#43672] [ruby-trunk - Feature #6201][Open] do_something then return :special_case (include "then" operator) — "rosenfeld (Rodrigo Rosenfeld Rosas)" <rr.rosas@...>

12 messages 2012/03/26

[#43678] [ruby-trunk - Bug #6203][Open] Array#values_at does not handle ranges with end index past the end of the array — "ferrous26 (Mark Rada)" <markrada26@...>

15 messages 2012/03/26

[#43794] [ruby-trunk - Feature #6216][Open] SystemStackError backtraces should not be reduced to one line — "postmodern (Hal Brodigan)" <postmodern.mod3@...>

15 messages 2012/03/28

[#43814] [ruby-trunk - Feature #6219][Open] Return value of Hash#store — "MartinBosslet (Martin Bosslet)" <Martin.Bosslet@...>

20 messages 2012/03/28

[#43858] [ruby-trunk - Feature #6222][Open] Use ++ to connect statements — "gcao (Guoliang Cao)" <gcao99@...>

12 messages 2012/03/29

[#43904] [ruby-trunk - Feature #6225][Open] Hash#+ — "trans (Thomas Sawyer)" <transfire@...>

36 messages 2012/03/29

[#43951] [ruby-trunk - Bug #6228][Open] [mingw] Errno::EBADF in ruby/test_io.rb on ruby_1_9_3 — "jonforums (Jon Forums)" <redmine@...>

28 messages 2012/03/30

[#43996] [ruby-trunk - Bug #6236][Open] WEBrick::HTTPServer swallows Exception — "regularfry (Alex Young)" <alex@...>

13 messages 2012/03/31

[ruby-core:43136] [ruby-trunk - Bug #6122] OpenSSL::PKCS7 verify

From: Martin Bosslet <Martin.Bosslet@...>
Date: 2012-03-08 09:49:23 UTC
List: ruby-core #43136
Issue #6122 has been updated by Martin Bosslet.

Category set to ext
Assignee set to Martin Bosslet
Target version set to 2.0.0


----------------------------------------
Bug #6122: OpenSSL::PKCS7 verify
https://bugs.ruby-lang.org/issues/6122

Author: Justin Peal
Status: Open
Priority: High
Assignee: Martin Bosslet
Category: ext
Target version: 2.0.0
ruby -v: ruby 1.9.3p125 (2012-02-16) [i386-mingw32]


# not_after can not later than 2038-01-19 11:14:07
# verify can pass wrong certificate

require 'OpenSSL'

class Rsa
    attr_reader :key, :cert
    @@sha = OpenSSL::Digest::SHA1.new
    @@aes = OpenSSL::Cipher.new("aes-128-ofb")

    def initialize serial, issuer=nil
      @key = OpenSSL::PKey::RSA.new(1024)
      @cert = OpenSSL::X509::Certificate.new
      @cert.version = 2   # RFC 5280 - v3
      @cert.serial = serial
      @cert.subject = OpenSSL::X509::Name.parse "CN=#{serial}"
      @cert.issuer = issuer==nil ? @cert.subject : issuer
      @cert.public_key = @key.public_key
      @cert.not_before = Time.now
      @cert.not_after = Time.mktime(2038, 1, 19, 11, 14, 7)   # second = 8 ==> Fail!
      @cert.sign(@key, @@sha) if issuer==nil
    end

    def sign key
      @cert.sign(key, @@sha)
    end

  def sign_encrypt(plain, obj_cert)
    signed = OpenSSL::PKCS7::sign(@cert, @key, plain)
    encrypted = OpenSSL::PKCS7::encrypt([obj_cert], signed.to_s, @@aes)
  end

  def decrypt_verify(received, obj_cert, ca_cert)
    encrypted = OpenSSL::PKCS7.new(received)
    decrypted = encrypted.decrypt(@key, @cert)
    signed = OpenSSL::PKCS7.new(decrypted)
    cert_store = OpenSSL::X509::Store.new.add_cert(ca_cert)
    plain = signed.data if signed.verify([obj_cert], cert_store)
  end
end

ca = Rsa.new(1)
alice = Rsa.new(11, ca.cert.issuer)
alice.sign ca.key
right = Rsa.new(12, ca.cert.issuer)
right.sign ca.key

fa = Rsa.new(3)
wrong = Rsa.new(33, fa.cert.issuer)
# wrong.sign fa.key   # Don't sign indeed!

plain = "Something's wrong."
signed_encrypted = right.sign_encrypt(plain, alice.cert)
recovered = alice.decrypt_verify(signed_encrypted, wrong.cert, ca.cert)   # wrong should be right
puts recovered==plain ? recovered : "It's okay!"



-- 
http://bugs.ruby-lang.org/

In This Thread