Skip to content

Commit 2c33523

Browse files
lbalmacedalbalmaceda
authored
Merge pull request auth0#106 from auth0/secret-as-byte-arr
Make HMAC algorithm accept secret bytes
2 parents 2ca7c41 + 386100d commit 2c33523

File tree

4 files changed

+231
-40
lines changed

4 files changed

+231
-40
lines changed

‎lib/src/main/java/com/auth0/jwt/algorithms/Algorithm.java‎

Lines changed: 42 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
import com.auth0.jwt.exceptions.SignatureGenerationException;
44
import com.auth0.jwt.exceptions.SignatureVerificationException;
55

6+
import java.io.UnsupportedEncodingException;
67
import java.security.interfaces.ECKey;
78
import java.security.interfaces.RSAKey;
89

@@ -52,9 +53,10 @@ public static Algorithm RSA512(RSAKey key) throws IllegalArgumentException {
5253
*
5354
* @param secret the secret to use in the verify or signing instance.
5455
* @return a valid HMAC256 Algorithm.
55-
* @throws IllegalArgumentException if the provided Secret is null.
56+
* @throws IllegalArgumentException if the provided Secret is null.
57+
* @throws UnsupportedEncodingException if the current Java platform implementation doesn't support the UTF-8 character encoding.
5658
*/
57-
public static Algorithm HMAC256(String secret) throws IllegalArgumentException {
59+
public static Algorithm HMAC256(String secret) throws IllegalArgumentException, UnsupportedEncodingException {
5860
return new HMACAlgorithm("HS256", "HmacSHA256", secret);
5961
}
6062

@@ -63,9 +65,10 @@ public static Algorithm HMAC256(String secret) throws IllegalArgumentException {
6365
*
6466
* @param secret the secret to use in the verify or signing instance.
6567
* @return a valid HMAC384 Algorithm.
66-
* @throws IllegalArgumentException if the provided Secret is null.
68+
* @throws IllegalArgumentException if the provided Secret is null.
69+
* @throws UnsupportedEncodingException if the current Java platform implementation doesn't support the UTF-8 character encoding.
6770
*/
68-
public static Algorithm HMAC384(String secret) throws IllegalArgumentException {
71+
public static Algorithm HMAC384(String secret) throws IllegalArgumentException, UnsupportedEncodingException {
6972
return new HMACAlgorithm("HS384", "HmacSHA384", secret);
7073
}
7174

@@ -74,9 +77,43 @@ public static Algorithm HMAC384(String secret) throws IllegalArgumentException {
7477
*
7578
* @param secret the secret to use in the verify or signing instance.
7679
* @return a valid HMAC512 Algorithm.
80+
* @throws IllegalArgumentException if the provided Secret is null.
81+
* @throws UnsupportedEncodingException if the current Java platform implementation doesn't support the UTF-8 character encoding.
82+
*/
83+
public static Algorithm HMAC512(String secret) throws IllegalArgumentException, UnsupportedEncodingException {
84+
return new HMACAlgorithm("HS512", "HmacSHA512", secret);
85+
}
86+
87+
/**
88+
* Creates a new Algorithm instance using HmacSHA256. Tokens specify this as "HS256".
89+
*
90+
* @param secret the secret bytes to use in the verify or signing instance.
91+
* @return a valid HMAC256 Algorithm.
92+
* @throws IllegalArgumentException if the provided Secret is null.
93+
*/
94+
public static Algorithm HMAC256(byte[] secret) throws IllegalArgumentException {
95+
return new HMACAlgorithm("HS256", "HmacSHA256", secret);
96+
}
97+
98+
/**
99+
* Creates a new Algorithm instance using HmacSHA384. Tokens specify this as "HS384".
100+
*
101+
* @param secret the secret bytes to use in the verify or signing instance.
102+
* @return a valid HMAC384 Algorithm.
103+
* @throws IllegalArgumentException if the provided Secret is null.
104+
*/
105+
public static Algorithm HMAC384(byte[] secret) throws IllegalArgumentException {
106+
return new HMACAlgorithm("HS384", "HmacSHA384", secret);
107+
}
108+
109+
/**
110+
* Creates a new Algorithm instance using HmacSHA512. Tokens specify this as "HS512".
111+
*
112+
* @param secret the secret bytes to use in the verify or signing instance.
113+
* @return a valid HMAC512 Algorithm.
77114
* @throws IllegalArgumentException if the provided Secret is null.
78115
*/
79-
public static Algorithm HMAC512(String secret) throws IllegalArgumentException {
116+
public static Algorithm HMAC512(byte[] secret) throws IllegalArgumentException {
80117
return new HMACAlgorithm("HS512", "HmacSHA512", secret);
81118
}
82119

‎lib/src/main/java/com/auth0/jwt/algorithms/HMACAlgorithm.java‎

Lines changed: 22 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -2,36 +2,49 @@
22

33
import com.auth0.jwt.exceptions.SignatureGenerationException;
44
import com.auth0.jwt.exceptions.SignatureVerificationException;
5+
import org.apache.commons.codec.CharEncoding;
56

7+
import java.io.UnsupportedEncodingException;
68
import java.security.InvalidKeyException;
79
import java.security.NoSuchAlgorithmException;
810

911
class HMACAlgorithm extends Algorithm {
1012

1113
private final CryptoHelper crypto;
12-
private final String secret;
14+
private final byte[] secret;
1315

14-
HMACAlgorithm(CryptoHelper crypto, String id, String algorithm, String secret) throws IllegalArgumentException {
16+
HMACAlgorithm(CryptoHelper crypto, String id, String algorithm, byte[] secretBytes) throws IllegalArgumentException {
1517
super(id, algorithm);
16-
if (secret == null) {
18+
if (secretBytes == null) {
1719
throw new IllegalArgumentException("The Secret cannot be null");
1820
}
19-
this.secret = secret;
21+
this.secret = secretBytes;
2022
this.crypto = crypto;
2123
}
2224

23-
HMACAlgorithm(String id, String algorithm, String secret) throws IllegalArgumentException {
24-
this(new CryptoHelper(), id, algorithm, secret);
25+
HMACAlgorithm(String id, String algorithm, byte[] secretBytes) throws IllegalArgumentException {
26+
this(new CryptoHelper(), id, algorithm, secretBytes);
27+
}
28+
29+
HMACAlgorithm(String id, String algorithm, String secret) throws IllegalArgumentException, UnsupportedEncodingException {
30+
this(new CryptoHelper(), id, algorithm, getSecretBytes(secret));
31+
}
32+
33+
static byte[] getSecretBytes(String secret) throws IllegalArgumentException, UnsupportedEncodingException {
34+
if (secret == null) {
35+
throw new IllegalArgumentException("The Secret cannot be null");
36+
}
37+
return secret.getBytes(CharEncoding.UTF_8);
2538
}
2639

27-
String getSecret() {
40+
byte[] getSecret() {
2841
return secret;
2942
}
3043

3144
@Override
3245
public void verify(byte[] contentBytes, byte[] signatureBytes) throws SignatureVerificationException {
3346
try {
34-
boolean valid = crypto.verifySignatureFor(getDescription(), secret.getBytes(), contentBytes, signatureBytes);
47+
boolean valid = crypto.verifySignatureFor(getDescription(), secret, contentBytes, signatureBytes);
3548
if (!valid) {
3649
throw new SignatureVerificationException(this);
3750
}
@@ -43,7 +56,7 @@ public void verify(byte[] contentBytes, byte[] signatureBytes) throws SignatureV
4356
@Override
4457
public byte[] sign(byte[] contentBytes) throws SignatureGenerationException {
4558
try {
46-
return crypto.createSignatureFor(getDescription(), secret.getBytes(), contentBytes);
59+
return crypto.createSignatureFor(getDescription(), secret, contentBytes);
4760
} catch (NoSuchAlgorithmException | InvalidKeyException e) {
4861
throw new SignatureGenerationException(this, e);
4962
}

‎lib/src/test/java/com/auth0/jwt/algorithms/AlgorithmTest.java‎

Lines changed: 69 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -17,25 +17,52 @@ public class AlgorithmTest {
1717
public ExpectedException exception = ExpectedException.none();
1818

1919

20+
@Test
21+
public void shouldThrowHMAC256VerificationWithNullSecretBytes() throws Exception {
22+
exception.expect(IllegalArgumentException.class);
23+
exception.expectMessage("The Secret cannot be null");
24+
byte[] secret = null;
25+
Algorithm.HMAC256(secret);
26+
}
27+
28+
@Test
29+
public void shouldThrowHMAC384VerificationWithNullSecretBytes() throws Exception {
30+
exception.expect(IllegalArgumentException.class);
31+
exception.expectMessage("The Secret cannot be null");
32+
byte[] secret = null;
33+
Algorithm.HMAC384(secret);
34+
}
35+
36+
@Test
37+
public void shouldThrowHMAC512VerificationWithNullSecretBytes() throws Exception {
38+
exception.expect(IllegalArgumentException.class);
39+
exception.expectMessage("The Secret cannot be null");
40+
byte[] secret = null;
41+
Algorithm.HMAC512(secret);
42+
}
43+
2044
@Test
2145
public void shouldThrowHMAC256VerificationWithNullSecret() throws Exception {
2246
exception.expect(IllegalArgumentException.class);
2347
exception.expectMessage("The Secret cannot be null");
24-
Algorithm.HMAC256(null);
48+
String secret = null;
49+
Algorithm.HMAC256(secret);
2550
}
2651

2752
@Test
2853
public void shouldThrowHMAC384VerificationWithNullSecret() throws Exception {
2954
exception.expect(IllegalArgumentException.class);
3055
exception.expectMessage("The Secret cannot be null");
31-
Algorithm.HMAC384(null);
56+
String secret = null;
57+
Algorithm.HMAC384(secret);
3258
}
3359

3460
@Test
3561
public void shouldThrowHMAC512VerificationWithNullSecret() throws Exception {
3662
exception.expect(IllegalArgumentException.class);
3763
exception.expectMessage("The Secret cannot be null");
38-
Algorithm.HMAC512(null);
64+
String secret = null;
65+
Algorithm.HMAC512(secret);
3966
}
4067

4168
@Test
@@ -81,36 +108,69 @@ public void shouldThrowECDSA512VerificationWithNullPublicKey() throws Exception
81108
}
82109

83110
@Test
84-
public void shouldCreateHMAC256Algorithm() throws Exception {
111+
public void shouldCreateHMAC256AlgorithmWithBytes() throws Exception {
112+
Algorithm algorithm = Algorithm.HMAC256("secret".getBytes());
113+
114+
assertThat(algorithm, is(notNullValue()));
115+
assertThat(algorithm, is(instanceOf(HMACAlgorithm.class)));
116+
assertThat(algorithm.getDescription(), is("HmacSHA256"));
117+
assertThat(algorithm.getName(), is("HS256"));
118+
assertThat(((HMACAlgorithm) algorithm).getSecret(), is("secret".getBytes()));
119+
}
120+
121+
@Test
122+
public void shouldCreateHMAC384AlgorithmWithBytes() throws Exception {
123+
Algorithm algorithm = Algorithm.HMAC384("secret".getBytes());
124+
125+
assertThat(algorithm, is(notNullValue()));
126+
assertThat(algorithm, is(instanceOf(HMACAlgorithm.class)));
127+
assertThat(algorithm.getDescription(), is("HmacSHA384"));
128+
assertThat(algorithm.getName(), is("HS384"));
129+
assertThat(((HMACAlgorithm) algorithm).getSecret(), is("secret".getBytes()));
130+
}
131+
132+
@Test
133+
public void shouldCreateHMAC512AlgorithmWithBytes() throws Exception {
134+
Algorithm algorithm = Algorithm.HMAC512("secret".getBytes());
135+
136+
assertThat(algorithm, is(notNullValue()));
137+
assertThat(algorithm, is(instanceOf(HMACAlgorithm.class)));
138+
assertThat(algorithm.getDescription(), is("HmacSHA512"));
139+
assertThat(algorithm.getName(), is("HS512"));
140+
assertThat(((HMACAlgorithm) algorithm).getSecret(), is("secret".getBytes()));
141+
}
142+
143+
@Test
144+
public void shouldCreateHMAC256AlgorithmWithString() throws Exception {
85145
Algorithm algorithm = Algorithm.HMAC256("secret");
86146

87147
assertThat(algorithm, is(notNullValue()));
88148
assertThat(algorithm, is(instanceOf(HMACAlgorithm.class)));
89149
assertThat(algorithm.getDescription(), is("HmacSHA256"));
90150
assertThat(algorithm.getName(), is("HS256"));
91-
assertThat(((HMACAlgorithm) algorithm).getSecret(), is("secret"));
151+
assertThat(((HMACAlgorithm) algorithm).getSecret(), is("secret".getBytes()));
92152
}
93153

94154
@Test
95-
public void shouldCreateHMAC384Algorithm() throws Exception {
155+
public void shouldCreateHMAC384AlgorithmWithString() throws Exception {
96156
Algorithm algorithm = Algorithm.HMAC384("secret");
97157

98158
assertThat(algorithm, is(notNullValue()));
99159
assertThat(algorithm, is(instanceOf(HMACAlgorithm.class)));
100160
assertThat(algorithm.getDescription(), is("HmacSHA384"));
101161
assertThat(algorithm.getName(), is("HS384"));
102-
assertThat(((HMACAlgorithm) algorithm).getSecret(), is("secret"));
162+
assertThat(((HMACAlgorithm) algorithm).getSecret(), is("secret".getBytes()));
103163
}
104164

105165
@Test
106-
public void shouldCreateHMAC512Algorithm() throws Exception {
166+
public void shouldCreateHMAC512AlgorithmWithString() throws Exception {
107167
Algorithm algorithm = Algorithm.HMAC512("secret");
108168

109169
assertThat(algorithm, is(notNullValue()));
110170
assertThat(algorithm, is(instanceOf(HMACAlgorithm.class)));
111171
assertThat(algorithm.getDescription(), is("HmacSHA512"));
112172
assertThat(algorithm.getName(), is("HS512"));
113-
assertThat(((HMACAlgorithm) algorithm).getSecret(), is("secret"));
173+
assertThat(((HMACAlgorithm) algorithm).getSecret(), is("secret".getBytes()));
114174
}
115175

116176
@Test

0 commit comments

Comments
 (0)