{"action":"created","comment":{"url":"https://api.github.com/repos/chef/chef_authn/pulls/comments/45225299","id":45225299,"diff_hunk":"@@ -481,26 +534,26 @@ verify_sig_or_sigs(Plain, BodyHash, ContentHash, AuthSig, UserId, KeyData, SignV\n %% what we are repeating each step\n %%\n -spec verify_sigs(binary(), binary(), binary(), binary(), binary(),\n-                  [{key_desc(), public_key_data() | public_key:rsa_public_key()}], binary()) ->\n+                  [{key_desc(), public_key_data() | public_key:rsa_public_key()}], {binary(), binary()}) ->\n                          {name, user_id(), key_desc()}.\n \n-verify_sigs(Plain, BodyHash, ContentHash, AuthSig, UserId, [{KeyId, PubKey}], SignVersion) ->\n-    {name, UserId} = verify_sig(Plain, BodyHash, ContentHash, AuthSig, UserId, PubKey, SignVersion),\n+verify_sigs(Plain, BodyHash, ContentHash, AuthSig, UserId, [{KeyId, PubKey}], SignInfo) ->\n+    {name, UserId} = verify_sig(Plain, BodyHash, ContentHash, AuthSig, UserId, PubKey, SignInfo),\n     {name, UserId, KeyId};\n-verify_sigs(Plain, BodyHash, ContentHash, AuthSig, UserId, [{KeyId, PubKey} | Remaining], SignVersion) ->\n+verify_sigs(Plain, BodyHash, ContentHash, AuthSig, UserId, [{KeyId, PubKey} | Remaining], SignInfo) ->\n     try\n-        {name, UserId} = verify_sig(Plain, BodyHash, ContentHash, AuthSig, UserId, PubKey, SignVersion),\n+        {name, UserId} = verify_sig(Plain, BodyHash, ContentHash, AuthSig, UserId, PubKey, SignInfo),\n         {name, UserId, KeyId}\n     catch\n         error:_Any ->\n-            verify_sigs(Plain, BodyHash, ContentHash, AuthSig, UserId, Remaining, SignVersion)\n+            verify_sigs(Plain, BodyHash, ContentHash, AuthSig, UserId, Remaining, SignInfo)\n     end.\n \n -spec verify_sig(binary(), binary(), binary(), binary(), binary(),\n-                 public_key_data() | public_key:rsa_public_key(), binary()) ->\n+                 public_key_data() | public_key:rsa_public_key(), {binary(), binary()}) ->\n                         {name, user_id()}.\n \n-verify_sig(Plain, BodyHash, ContentHash, AuthSig, UserId, PublicKey, SignVersion)\n+verify_sig(Plain, BodyHash, ContentHash, AuthSig, UserId, PublicKey, {_, SignVersion})\n   when SignVersion =:= ?SIGNING_VERSION_V1_0;\n        SignVersion =:= ?SIGNING_VERSION_V1_1 ->\n     Plain = decrypt_sig(AuthSig, PublicKey),","path":"src/chef_authn.erl","position":244,"original_position":244,"commit_id":"3cbc0765422ba3185f85ee35e8653483a40b05f3","original_commit_id":"3cbc0765422ba3185f85ee35e8653483a40b05f3","user":{"login":"manderson26","id":253389,"avatar_url":"https://avatars.githubusercontent.com/u/253389?v=3","gravatar_id":"","url":"https://api.github.com/users/manderson26","html_url":"https://github.com/manderson26","followers_url":"https://api.github.com/users/manderson26/followers","following_url":"https://api.github.com/users/manderson26/following{/other_user}","gists_url":"https://api.github.com/users/manderson26/gists{/gist_id}","starred_url":"https://api.github.com/users/manderson26/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/manderson26/subscriptions","organizations_url":"https://api.github.com/users/manderson26/orgs","repos_url":"https://api.github.com/users/manderson26/repos","events_url":"https://api.github.com/users/manderson26/events{/privacy}","received_events_url":"https://api.github.com/users/manderson26/received_events","type":"User","site_admin":false},"body":"This is old code I know, but any security equality check should be constant time; e.g. the sig and hash should take the same amount of time no matter how many bits differ.","created_at":"2015-11-18T16:49:48Z","updated_at":"2015-11-18T16:49:48Z","html_url":"https://github.com/chef/chef_authn/pull/21#discussion_r45225299","pull_request_url":"https://api.github.com/repos/chef/chef_authn/pulls/21","_links":{"self":{"href":"https://api.github.com/repos/chef/chef_authn/pulls/comments/45225299"},"html":{"href":"https://github.com/chef/chef_authn/pull/21#discussion_r45225299"},"pull_request":{"href":"https://api.github.com/repos/chef/chef_authn/pulls/21"}}},"pull_request":{"url":"https://api.github.com/repos/chef/chef_authn/pulls/21","id":50190521,"html_url":"https://github.com/chef/chef_authn/pull/21","diff_url":"https://github.com/chef/chef_authn/pull/21.diff","patch_url":"https://github.com/chef/chef_authn/pull/21.patch","issue_url":"https://api.github.com/repos/chef/chef_authn/issues/21","number":21,"state":"open","locked":false,"title":"Adding signing version 1.3","user":{"login":"jaym","id":27443,"avatar_url":"https://avatars.githubusercontent.com/u/27443?v=3","gravatar_id":"","url":"https://api.github.com/users/jaym","html_url":"https://github.com/jaym","followers_url":"https://api.github.com/users/jaym/followers","following_url":"https://api.github.com/users/jaym/following{/other_user}","gists_url":"https://api.github.com/users/jaym/gists{/gist_id}","starred_url":"https://api.github.com/users/jaym/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jaym/subscriptions","organizations_url":"https://api.github.com/users/jaym/orgs","repos_url":"https://api.github.com/users/jaym/repos","events_url":"https://api.github.com/users/jaym/events{/privacy}","received_events_url":"https://api.github.com/users/jaym/received_events","type":"User","site_admin":false},"body":"Here is the initial stab at signing version 1.3. v1.3 builds on top of v1.2 and adds support for specifying the algorithm to be used. Currently, the allowed algorithms are SHA1 and SHA256. In addition to this, there is a v1.3 of the signing format. Currently, it looks like:\r\n```\r\nMethod:POST\r\nHashed Path:Z3EsTMw/UBNY9n+q+WBWTJmeVg8hQFbdFzVWRxW4dOA=\r\nX-Ops-Content-Hash:hDlKNZhIhgso3Fs0S0pZwJ0xyBWtR1RBaeHs1DrzOho=\r\nX-Ops-Sign:algorithm=sha256;version=1.3\r\nX-Ops-Timestamp:2009-01-01T12:00:00Z\r\nX-Ops-UserId:/pNOhczwdkQGXD4YAOBVm38wgq2WI7vKRk9d8WBhyKA=\r\n```\r\nSome notable changes here are that all the hashes in the format are now calculated as a function `HASH(alg, content)` where `alg` is the algorithm specified in `X-Ops-Sign`.\r\n\r\nSome things that are still not done:\r\n- Signing format v1.3 will include `X-Ops-Server-API-Version` for signing\r\n- X-Ops-Sign will have an additional parameter `key` which will currently only allow `rsa`. While this shouldn't be necessary, it will provide a hint as to what keys to try in case we decide to implement something other than rsa.","created_at":"2015-11-09T22:55:20Z","updated_at":"2015-11-18T16:49:48Z","closed_at":null,"merged_at":null,"merge_commit_sha":"0a812135d139c439935ea810af7a0ea88d501d9f","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/chef/chef_authn/pulls/21/commits","review_comments_url":"https://api.github.com/repos/chef/chef_authn/pulls/21/comments","review_comment_url":"https://api.github.com/repos/chef/chef_authn/pulls/comments{/number}","comments_url":"https://api.github.com/repos/chef/chef_authn/issues/21/comments","statuses_url":"https://api.github.com/repos/chef/chef_authn/statuses/3cbc0765422ba3185f85ee35e8653483a40b05f3","head":{"label":"chef:jdm/sign-v1.3","ref":"jdm/sign-v1.3","sha":"3cbc0765422ba3185f85ee35e8653483a40b05f3","user":{"login":"chef","id":29740,"avatar_url":"https://avatars.githubusercontent.com/u/29740?v=3","gravatar_id":"","url":"https://api.github.com/users/chef","html_url":"https://github.com/chef","followers_url":"https://api.github.com/users/chef/followers","following_url":"https://api.github.com/users/chef/following{/other_user}","gists_url":"https://api.github.com/users/chef/gists{/gist_id}","starred_url":"https://api.github.com/users/chef/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/chef/subscriptions","organizations_url":"https://api.github.com/users/chef/orgs","repos_url":"https://api.github.com/users/chef/repos","events_url":"https://api.github.com/users/chef/events{/privacy}","received_events_url":"https://api.github.com/users/chef/received_events","type":"Organization","site_admin":false},"repo":{"id":5188193,"name":"chef_authn","full_name":"chef/chef_authn","owner":{"login":"chef","id":29740,"avatar_url":"https://avatars.githubusercontent.com/u/29740?v=3","gravatar_id":"","url":"https://api.github.com/users/chef","html_url":"https://github.com/chef","followers_url":"https://api.github.com/users/chef/followers","following_url":"https://api.github.com/users/chef/following{/other_user}","gists_url":"https://api.github.com/users/chef/gists{/gist_id}","starred_url":"https://api.github.com/users/chef/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/chef/subscriptions","organizations_url":"https://api.github.com/users/chef/orgs","repos_url":"https://api.github.com/users/chef/repos","events_url":"https://api.github.com/users/chef/events{/privacy}","received_events_url":"https://api.github.com/users/chef/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/chef/chef_authn","description":"Erlang API request authentication signing and verification for Chef","fork":false,"url":"https://api.github.com/repos/chef/chef_authn","forks_url":"https://api.github.com/repos/chef/chef_authn/forks","keys_url":"https://api.github.com/repos/chef/chef_authn/keys{/key_id}","collaborators_url":"https://api.github.com/repos/chef/chef_authn/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/chef/chef_authn/teams","hooks_url":"https://api.github.com/repos/chef/chef_authn/hooks","issue_events_url":"https://api.github.com/repos/chef/chef_authn/issues/events{/number}","events_url":"https://api.github.com/repos/chef/chef_authn/events","assignees_url":"https://api.github.com/repos/chef/chef_authn/assignees{/user}","branches_url":"https://api.github.com/repos/chef/chef_authn/branches{/branch}","tags_url":"https://api.github.com/repos/chef/chef_authn/tags","blobs_url":"https://api.github.com/repos/chef/chef_authn/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/chef/chef_authn/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/chef/chef_authn/git/refs{/sha}","trees_url":"https://api.github.com/repos/chef/chef_authn/git/trees{/sha}","statuses_url":"https://api.github.com/repos/chef/chef_authn/statuses/{sha}","languages_url":"https://api.github.com/repos/chef/chef_authn/languages","stargazers_url":"https://api.github.com/repos/chef/chef_authn/stargazers","contributors_url":"https://api.github.com/repos/chef/chef_authn/contributors","subscribers_url":"https://api.github.com/repos/chef/chef_authn/subscribers","subscription_url":"https://api.github.com/repos/chef/chef_authn/subscription","commits_url":"https://api.github.com/repos/chef/chef_authn/commits{/sha}","git_commits_url":"https://api.github.com/repos/chef/chef_authn/git/commits{/sha}","comments_url":"https://api.github.com/repos/chef/chef_authn/comments{/number}","issue_comment_url":"https://api.github.com/repos/chef/chef_authn/issues/comments{/number}","contents_url":"https://api.github.com/repos/chef/chef_authn/contents/{+path}","compare_url":"https://api.github.com/repos/chef/chef_authn/compare/{base}...{head}","merges_url":"https://api.github.com/repos/chef/chef_authn/merges","archive_url":"https://api.github.com/repos/chef/chef_authn/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/chef/chef_authn/downloads","issues_url":"https://api.github.com/repos/chef/chef_authn/issues{/number}","pulls_url":"https://api.github.com/repos/chef/chef_authn/pulls{/number}","milestones_url":"https://api.github.com/repos/chef/chef_authn/milestones{/number}","notifications_url":"https://api.github.com/repos/chef/chef_authn/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/chef/chef_authn/labels{/name}","releases_url":"https://api.github.com/repos/chef/chef_authn/releases{/id}","created_at":"2012-07-26T05:26:54Z","updated_at":"2015-09-28T14:06:27Z","pushed_at":"2015-11-17T23:34:40Z","git_url":"git://github.com/chef/chef_authn.git","ssh_url":"git@github.com:chef/chef_authn.git","clone_url":"https://github.com/chef/chef_authn.git","svn_url":"https://github.com/chef/chef_authn","homepage":null,"size":204,"stargazers_count":8,"watchers_count":8,"language":"Erlang","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":3,"mirror_url":null,"open_issues_count":2,"forks":3,"open_issues":2,"watchers":8,"default_branch":"master"}},"base":{"label":"chef:master","ref":"master","sha":"c7c6040bc5f93dcdf8182b33616c9145ab3eac25","user":{"login":"chef","id":29740,"avatar_url":"https://avatars.githubusercontent.com/u/29740?v=3","gravatar_id":"","url":"https://api.github.com/users/chef","html_url":"https://github.com/chef","followers_url":"https://api.github.com/users/chef/followers","following_url":"https://api.github.com/users/chef/following{/other_user}","gists_url":"https://api.github.com/users/chef/gists{/gist_id}","starred_url":"https://api.github.com/users/chef/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/chef/subscriptions","organizations_url":"https://api.github.com/users/chef/orgs","repos_url":"https://api.github.com/users/chef/repos","events_url":"https://api.github.com/users/chef/events{/privacy}","received_events_url":"https://api.github.com/users/chef/received_events","type":"Organization","site_admin":false},"repo":{"id":5188193,"name":"chef_authn","full_name":"chef/chef_authn","owner":{"login":"chef","id":29740,"avatar_url":"https://avatars.githubusercontent.com/u/29740?v=3","gravatar_id":"","url":"https://api.github.com/users/chef","html_url":"https://github.com/chef","followers_url":"https://api.github.com/users/chef/followers","following_url":"https://api.github.com/users/chef/following{/other_user}","gists_url":"https://api.github.com/users/chef/gists{/gist_id}","starred_url":"https://api.github.com/users/chef/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/chef/subscriptions","organizations_url":"https://api.github.com/users/chef/orgs","repos_url":"https://api.github.com/users/chef/repos","events_url":"https://api.github.com/users/chef/events{/privacy}","received_events_url":"https://api.github.com/users/chef/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/chef/chef_authn","description":"Erlang API request authentication signing and verification for Chef","fork":false,"url":"https://api.github.com/repos/chef/chef_authn","forks_url":"https://api.github.com/repos/chef/chef_authn/forks","keys_url":"https://api.github.com/repos/chef/chef_authn/keys{/key_id}","collaborators_url":"https://api.github.com/repos/chef/chef_authn/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/chef/chef_authn/teams","hooks_url":"https://api.github.com/repos/chef/chef_authn/hooks","issue_events_url":"https://api.github.com/repos/chef/chef_authn/issues/events{/number}","events_url":"https://api.github.com/repos/chef/chef_authn/events","assignees_url":"https://api.github.com/repos/chef/chef_authn/assignees{/user}","branches_url":"https://api.github.com/repos/chef/chef_authn/branches{/branch}","tags_url":"https://api.github.com/repos/chef/chef_authn/tags","blobs_url":"https://api.github.com/repos/chef/chef_authn/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/chef/chef_authn/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/chef/chef_authn/git/refs{/sha}","trees_url":"https://api.github.com/repos/chef/chef_authn/git/trees{/sha}","statuses_url":"https://api.github.com/repos/chef/chef_authn/statuses/{sha}","languages_url":"https://api.github.com/repos/chef/chef_authn/languages","stargazers_url":"https://api.github.com/repos/chef/chef_authn/stargazers","contributors_url":"https://api.github.com/repos/chef/chef_authn/contributors","subscribers_url":"https://api.github.com/repos/chef/chef_authn/subscribers","subscription_url":"https://api.github.com/repos/chef/chef_authn/subscription","commits_url":"https://api.github.com/repos/chef/chef_authn/commits{/sha}","git_commits_url":"https://api.github.com/repos/chef/chef_authn/git/commits{/sha}","comments_url":"https://api.github.com/repos/chef/chef_authn/comments{/number}","issue_comment_url":"https://api.github.com/repos/chef/chef_authn/issues/comments{/number}","contents_url":"https://api.github.com/repos/chef/chef_authn/contents/{+path}","compare_url":"https://api.github.com/repos/chef/chef_authn/compare/{base}...{head}","merges_url":"https://api.github.com/repos/chef/chef_authn/merges","archive_url":"https://api.github.com/repos/chef/chef_authn/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/chef/chef_authn/downloads","issues_url":"https://api.github.com/repos/chef/chef_authn/issues{/number}","pulls_url":"https://api.github.com/repos/chef/chef_authn/pulls{/number}","milestones_url":"https://api.github.com/repos/chef/chef_authn/milestones{/number}","notifications_url":"https://api.github.com/repos/chef/chef_authn/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/chef/chef_authn/labels{/name}","releases_url":"https://api.github.com/repos/chef/chef_authn/releases{/id}","created_at":"2012-07-26T05:26:54Z","updated_at":"2015-09-28T14:06:27Z","pushed_at":"2015-11-17T23:34:40Z","git_url":"git://github.com/chef/chef_authn.git","ssh_url":"git@github.com:chef/chef_authn.git","clone_url":"https://github.com/chef/chef_authn.git","svn_url":"https://github.com/chef/chef_authn","homepage":null,"size":204,"stargazers_count":8,"watchers_count":8,"language":"Erlang","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":3,"mirror_url":null,"open_issues_count":2,"forks":3,"open_issues":2,"watchers":8,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/chef/chef_authn/pulls/21"},"html":{"href":"https://github.com/chef/chef_authn/pull/21"},"issue":{"href":"https://api.github.com/repos/chef/chef_authn/issues/21"},"comments":{"href":"https://api.github.com/repos/chef/chef_authn/issues/21/comments"},"review_comments":{"href":"https://api.github.com/repos/chef/chef_authn/pulls/21/comments"},"review_comment":{"href":"https://api.github.com/repos/chef/chef_authn/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/chef/chef_authn/pulls/21/commits"},"statuses":{"href":"https://api.github.com/repos/chef/chef_authn/statuses/3cbc0765422ba3185f85ee35e8653483a40b05f3"}}}}