{"action":"created","comment":{"url":"https://api.github.com/repos/sbhatore/rails/pulls/comments/36779983","id":36779983,"diff_hunk":"@@ -43,65 +50,181 @@ class InvalidMessage < StandardError; end\n     # * <tt>:digest</tt> - String of digest to use for signing. Default is +SHA1+.\n     # * <tt>:serializer</tt> - Object serializer to use. Default is +Marshal+.\n     def initialize(secret, *signature_key_or_options)\n-      options = signature_key_or_options.extract_options!\n-      sign_secret = signature_key_or_options.first\n+      @options = signature_key_or_options.extract_options!\n       @secret = secret\n-      @sign_secret = sign_secret\n-      @cipher = options[:cipher] || 'aes-256-cbc'\n-      @verifier = MessageVerifier.new(@sign_secret || @secret, digest: options[:digest] || 'SHA1', serializer: NullSerializer)\n-      @serializer = options[:serializer] || Marshal\n+      @sign_secret = signature_key_or_options.first || @secret\n+      @alg = @options[:alg] || 'dir'\n+      @enc = @options[:enc] || 'A128GCM'\n+      @serializer = @options[:serializer] || Marshal\n     end\n \n     # Encrypt and sign a message. We need to sign the message in order to avoid\n     # padding attacks. Reference: http://www.limited-entropy.com/padding-oracle-attacks.\n-    def encrypt_and_sign(value)\n-      verifier.generate(_encrypt(value))\n+    def encrypt_and_sign(value, options = {})\n+      @claims = Claims.new(payload: value, **options)\n+      _encrypt(@claims.to_h)\n     end\n \n     # Decrypt and verify a message. We need to verify the message in order to\n     # avoid padding attacks. Reference: http://www.limited-entropy.com/padding-oracle-attacks.\n-    def decrypt_and_verify(value)\n-      _decrypt(verifier.verify(value))\n+    def decrypt_and_verify(message, options = {})\n+      if message.include? '--'\n+        legacy_encryptor = LegacyMessageEncryptor.new(@secret, @sign_secret, @options)\n+        legacy_encryptor.decrypt_and_verify(message)\n+      else\n+        if message.count('.') == 4\n+          claims = _decrypt(message).symbolize_keys\n+          Claims.verify!(claims, options)\n+        else\n+          raise InvalidFormat, 'Invalid JWT Format.'\n+        end\n+      end\n     end\n \n     private\n+      def _encrypt(value)\n+        protected_header = @serializer.dump header\n+        cipher.encrypt\n+        cipher.key = content_encryption_key\n+        iv = cipher.random_iv\n+        cipher.iv = iv\n+        cipher.auth_data = to_ascii encode(protected_header)\n+\n+        ciphertext = cipher.update(@serializer.dump value) + cipher.final\n+        auth_tag = cipher.auth_tag\n+\n+        ([protected_header, jwe_encrypted_key, iv, ciphertext, auth_tag].map { |a| encode a }).join('.')\n+      end\n \n-    def _encrypt(value)\n-      cipher = new_cipher\n-      cipher.encrypt\n-      cipher.key = @secret\n+      def _decrypt(encrypted_message)\n+        protected_header, _encrypted_key, iv, ciphertext, auth_tag = encrypted_message.split('.').map { |a| decode a }\n+        valid_header?(@serializer.load protected_header)\n \n-      # Rely on OpenSSL for the initialization vector\n-      iv = cipher.random_iv\n+        cipher.decrypt\n+        cipher.key = decrypt_content_encryption_key\n+        cipher.iv = iv\n+        cipher.auth_tag = auth_tag\n+        cipher.auth_data = to_ascii encode(protected_header)\n \n-      encrypted_data = cipher.update(@serializer.dump(value))\n-      encrypted_data << cipher.final\n+        decrypted_message = cipher.update(ciphertext) + cipher.final\n \n-      \"#{::Base64.strict_encode64 encrypted_data}--#{::Base64.strict_encode64 iv}\"\n-    end\n+        @serializer.load decrypted_message\n \n-    def _decrypt(encrypted_message)\n-      cipher = new_cipher\n-      encrypted_data, iv = encrypted_message.split(\"--\").map {|v| ::Base64.strict_decode64(v)}\n+      rescue OpenSSLCipherError, TypeError, ArgumentError\n+        raise InvalidMessage\n+      end\n \n-      cipher.decrypt\n-      cipher.key = @secret\n-      cipher.iv  = iv\n+      def cipher\n+        @cipher ||= OpenSSL::Cipher.new(cipher_name)","path":"activesupport/lib/active_support/message_encryptor.rb","position":116,"original_position":116,"commit_id":"fe91f57f0b44faed9bf6567df40f4e616d916ed5","original_commit_id":"fe91f57f0b44faed9bf6567df40f4e616d916ed5","user":{"login":"kaspth","id":350807,"avatar_url":"https://avatars.githubusercontent.com/u/350807?v=3","gravatar_id":"","url":"https://api.github.com/users/kaspth","html_url":"https://github.com/kaspth","followers_url":"https://api.github.com/users/kaspth/followers","following_url":"https://api.github.com/users/kaspth/following{/other_user}","gists_url":"https://api.github.com/users/kaspth/gists{/gist_id}","starred_url":"https://api.github.com/users/kaspth/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kaspth/subscriptions","organizations_url":"https://api.github.com/users/kaspth/orgs","repos_url":"https://api.github.com/users/kaspth/repos","events_url":"https://api.github.com/users/kaspth/events{/privacy}","received_events_url":"https://api.github.com/users/kaspth/received_events","type":"User","site_admin":false},"body":"I don't know if it's safe to cache the cipher. Perhaps we should look more to what I did in Tokie with the custom cipher class: https://github.com/kaspth/tokie/blob/master/lib/tokie/encryptor/cipher.rb\r\n\r\nThat keeps all the nitty gritty encryption stuff in its own place.","created_at":"2015-08-11T18:24:32Z","updated_at":"2015-08-11T18:24:32Z","html_url":"https://github.com/sbhatore/rails/pull/4#discussion_r36779983","pull_request_url":"https://api.github.com/repos/sbhatore/rails/pulls/4","_links":{"self":{"href":"https://api.github.com/repos/sbhatore/rails/pulls/comments/36779983"},"html":{"href":"https://github.com/sbhatore/rails/pull/4#discussion_r36779983"},"pull_request":{"href":"https://api.github.com/repos/sbhatore/rails/pulls/4"}}},"pull_request":{"url":"https://api.github.com/repos/sbhatore/rails/pulls/4","id":41225532,"html_url":"https://github.com/sbhatore/rails/pull/4","diff_url":"https://github.com/sbhatore/rails/pull/4.diff","patch_url":"https://github.com/sbhatore/rails/pull/4.patch","issue_url":"https://api.github.com/repos/sbhatore/rails/issues/4","number":4,"state":"open","locked":false,"title":"Initial MessageEncryptor","user":{"login":"sbhatore","id":7404597,"avatar_url":"https://avatars.githubusercontent.com/u/7404597?v=3","gravatar_id":"","url":"https://api.github.com/users/sbhatore","html_url":"https://github.com/sbhatore","followers_url":"https://api.github.com/users/sbhatore/followers","following_url":"https://api.github.com/users/sbhatore/following{/other_user}","gists_url":"https://api.github.com/users/sbhatore/gists{/gist_id}","starred_url":"https://api.github.com/users/sbhatore/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sbhatore/subscriptions","organizations_url":"https://api.github.com/users/sbhatore/orgs","repos_url":"https://api.github.com/users/sbhatore/repos","events_url":"https://api.github.com/users/sbhatore/events{/privacy}","received_events_url":"https://api.github.com/users/sbhatore/received_events","type":"User","site_admin":false},"body":"","created_at":"2015-07-30T11:56:28Z","updated_at":"2015-08-11T18:24:32Z","closed_at":null,"merged_at":null,"merge_commit_sha":"dcefa49e5d9f82eb0538fc4d06e9e4fa1b822813","assignee":{"login":"sbhatore","id":7404597,"avatar_url":"https://avatars.githubusercontent.com/u/7404597?v=3","gravatar_id":"","url":"https://api.github.com/users/sbhatore","html_url":"https://github.com/sbhatore","followers_url":"https://api.github.com/users/sbhatore/followers","following_url":"https://api.github.com/users/sbhatore/following{/other_user}","gists_url":"https://api.github.com/users/sbhatore/gists{/gist_id}","starred_url":"https://api.github.com/users/sbhatore/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sbhatore/subscriptions","organizations_url":"https://api.github.com/users/sbhatore/orgs","repos_url":"https://api.github.com/users/sbhatore/repos","events_url":"https://api.github.com/users/sbhatore/events{/privacy}","received_events_url":"https://api.github.com/users/sbhatore/received_events","type":"User","site_admin":false},"milestone":null,"commits_url":"https://api.github.com/repos/sbhatore/rails/pulls/4/commits","review_comments_url":"https://api.github.com/repos/sbhatore/rails/pulls/4/comments","review_comment_url":"https://api.github.com/repos/sbhatore/rails/pulls/comments{/number}","comments_url":"https://api.github.com/repos/sbhatore/rails/issues/4/comments","statuses_url":"https://api.github.com/repos/sbhatore/rails/statuses/fe91f57f0b44faed9bf6567df40f4e616d916ed5","head":{"label":"sbhatore:jwe","ref":"jwe","sha":"fe91f57f0b44faed9bf6567df40f4e616d916ed5","user":{"login":"sbhatore","id":7404597,"avatar_url":"https://avatars.githubusercontent.com/u/7404597?v=3","gravatar_id":"","url":"https://api.github.com/users/sbhatore","html_url":"https://github.com/sbhatore","followers_url":"https://api.github.com/users/sbhatore/followers","following_url":"https://api.github.com/users/sbhatore/following{/other_user}","gists_url":"https://api.github.com/users/sbhatore/gists{/gist_id}","starred_url":"https://api.github.com/users/sbhatore/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sbhatore/subscriptions","organizations_url":"https://api.github.com/users/sbhatore/orgs","repos_url":"https://api.github.com/users/sbhatore/repos","events_url":"https://api.github.com/users/sbhatore/events{/privacy}","received_events_url":"https://api.github.com/users/sbhatore/received_events","type":"User","site_admin":false},"repo":{"id":32041315,"name":"rails","full_name":"sbhatore/rails","owner":{"login":"sbhatore","id":7404597,"avatar_url":"https://avatars.githubusercontent.com/u/7404597?v=3","gravatar_id":"","url":"https://api.github.com/users/sbhatore","html_url":"https://github.com/sbhatore","followers_url":"https://api.github.com/users/sbhatore/followers","following_url":"https://api.github.com/users/sbhatore/following{/other_user}","gists_url":"https://api.github.com/users/sbhatore/gists{/gist_id}","starred_url":"https://api.github.com/users/sbhatore/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sbhatore/subscriptions","organizations_url":"https://api.github.com/users/sbhatore/orgs","repos_url":"https://api.github.com/users/sbhatore/repos","events_url":"https://api.github.com/users/sbhatore/events{/privacy}","received_events_url":"https://api.github.com/users/sbhatore/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/sbhatore/rails","description":"Ruby on Rails","fork":true,"url":"https://api.github.com/repos/sbhatore/rails","forks_url":"https://api.github.com/repos/sbhatore/rails/forks","keys_url":"https://api.github.com/repos/sbhatore/rails/keys{/key_id}","collaborators_url":"https://api.github.com/repos/sbhatore/rails/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/sbhatore/rails/teams","hooks_url":"https://api.github.com/repos/sbhatore/rails/hooks","issue_events_url":"https://api.github.com/repos/sbhatore/rails/issues/events{/number}","events_url":"https://api.github.com/repos/sbhatore/rails/events","assignees_url":"https://api.github.com/repos/sbhatore/rails/assignees{/user}","branches_url":"https://api.github.com/repos/sbhatore/rails/branches{/branch}","tags_url":"https://api.github.com/repos/sbhatore/rails/tags","blobs_url":"https://api.github.com/repos/sbhatore/rails/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/sbhatore/rails/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/sbhatore/rails/git/refs{/sha}","trees_url":"https://api.github.com/repos/sbhatore/rails/git/trees{/sha}","statuses_url":"https://api.github.com/repos/sbhatore/rails/statuses/{sha}","languages_url":"https://api.github.com/repos/sbhatore/rails/languages","stargazers_url":"https://api.github.com/repos/sbhatore/rails/stargazers","contributors_url":"https://api.github.com/repos/sbhatore/rails/contributors","subscribers_url":"https://api.github.com/repos/sbhatore/rails/subscribers","subscription_url":"https://api.github.com/repos/sbhatore/rails/subscription","commits_url":"https://api.github.com/repos/sbhatore/rails/commits{/sha}","git_commits_url":"https://api.github.com/repos/sbhatore/rails/git/commits{/sha}","comments_url":"https://api.github.com/repos/sbhatore/rails/comments{/number}","issue_comment_url":"https://api.github.com/repos/sbhatore/rails/issues/comments{/number}","contents_url":"https://api.github.com/repos/sbhatore/rails/contents/{+path}","compare_url":"https://api.github.com/repos/sbhatore/rails/compare/{base}...{head}","merges_url":"https://api.github.com/repos/sbhatore/rails/merges","archive_url":"https://api.github.com/repos/sbhatore/rails/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/sbhatore/rails/downloads","issues_url":"https://api.github.com/repos/sbhatore/rails/issues{/number}","pulls_url":"https://api.github.com/repos/sbhatore/rails/pulls{/number}","milestones_url":"https://api.github.com/repos/sbhatore/rails/milestones{/number}","notifications_url":"https://api.github.com/repos/sbhatore/rails/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/sbhatore/rails/labels{/name}","releases_url":"https://api.github.com/repos/sbhatore/rails/releases{/id}","created_at":"2015-03-11T21:09:07Z","updated_at":"2015-05-28T21:21:20Z","pushed_at":"2015-08-11T17:22:09Z","git_url":"git://github.com/sbhatore/rails.git","ssh_url":"git@github.com:sbhatore/rails.git","clone_url":"https://github.com/sbhatore/rails.git","svn_url":"https://github.com/sbhatore/rails","homepage":"http://rubyonrails.org","size":144151,"stargazers_count":0,"watchers_count":0,"language":"Ruby","has_issues":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":2,"forks":0,"open_issues":2,"watchers":0,"default_branch":"master"}},"base":{"label":"sbhatore:gsoc","ref":"gsoc","sha":"bb47eafa2ccec672c6aa7635c76f36b87ecf3056","user":{"login":"sbhatore","id":7404597,"avatar_url":"https://avatars.githubusercontent.com/u/7404597?v=3","gravatar_id":"","url":"https://api.github.com/users/sbhatore","html_url":"https://github.com/sbhatore","followers_url":"https://api.github.com/users/sbhatore/followers","following_url":"https://api.github.com/users/sbhatore/following{/other_user}","gists_url":"https://api.github.com/users/sbhatore/gists{/gist_id}","starred_url":"https://api.github.com/users/sbhatore/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sbhatore/subscriptions","organizations_url":"https://api.github.com/users/sbhatore/orgs","repos_url":"https://api.github.com/users/sbhatore/repos","events_url":"https://api.github.com/users/sbhatore/events{/privacy}","received_events_url":"https://api.github.com/users/sbhatore/received_events","type":"User","site_admin":false},"repo":{"id":32041315,"name":"rails","full_name":"sbhatore/rails","owner":{"login":"sbhatore","id":7404597,"avatar_url":"https://avatars.githubusercontent.com/u/7404597?v=3","gravatar_id":"","url":"https://api.github.com/users/sbhatore","html_url":"https://github.com/sbhatore","followers_url":"https://api.github.com/users/sbhatore/followers","following_url":"https://api.github.com/users/sbhatore/following{/other_user}","gists_url":"https://api.github.com/users/sbhatore/gists{/gist_id}","starred_url":"https://api.github.com/users/sbhatore/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sbhatore/subscriptions","organizations_url":"https://api.github.com/users/sbhatore/orgs","repos_url":"https://api.github.com/users/sbhatore/repos","events_url":"https://api.github.com/users/sbhatore/events{/privacy}","received_events_url":"https://api.github.com/users/sbhatore/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/sbhatore/rails","description":"Ruby on Rails","fork":true,"url":"https://api.github.com/repos/sbhatore/rails","forks_url":"https://api.github.com/repos/sbhatore/rails/forks","keys_url":"https://api.github.com/repos/sbhatore/rails/keys{/key_id}","collaborators_url":"https://api.github.com/repos/sbhatore/rails/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/sbhatore/rails/teams","hooks_url":"https://api.github.com/repos/sbhatore/rails/hooks","issue_events_url":"https://api.github.com/repos/sbhatore/rails/issues/events{/number}","events_url":"https://api.github.com/repos/sbhatore/rails/events","assignees_url":"https://api.github.com/repos/sbhatore/rails/assignees{/user}","branches_url":"https://api.github.com/repos/sbhatore/rails/branches{/branch}","tags_url":"https://api.github.com/repos/sbhatore/rails/tags","blobs_url":"https://api.github.com/repos/sbhatore/rails/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/sbhatore/rails/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/sbhatore/rails/git/refs{/sha}","trees_url":"https://api.github.com/repos/sbhatore/rails/git/trees{/sha}","statuses_url":"https://api.github.com/repos/sbhatore/rails/statuses/{sha}","languages_url":"https://api.github.com/repos/sbhatore/rails/languages","stargazers_url":"https://api.github.com/repos/sbhatore/rails/stargazers","contributors_url":"https://api.github.com/repos/sbhatore/rails/contributors","subscribers_url":"https://api.github.com/repos/sbhatore/rails/subscribers","subscription_url":"https://api.github.com/repos/sbhatore/rails/subscription","commits_url":"https://api.github.com/repos/sbhatore/rails/commits{/sha}","git_commits_url":"https://api.github.com/repos/sbhatore/rails/git/commits{/sha}","comments_url":"https://api.github.com/repos/sbhatore/rails/comments{/number}","issue_comment_url":"https://api.github.com/repos/sbhatore/rails/issues/comments{/number}","contents_url":"https://api.github.com/repos/sbhatore/rails/contents/{+path}","compare_url":"https://api.github.com/repos/sbhatore/rails/compare/{base}...{head}","merges_url":"https://api.github.com/repos/sbhatore/rails/merges","archive_url":"https://api.github.com/repos/sbhatore/rails/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/sbhatore/rails/downloads","issues_url":"https://api.github.com/repos/sbhatore/rails/issues{/number}","pulls_url":"https://api.github.com/repos/sbhatore/rails/pulls{/number}","milestones_url":"https://api.github.com/repos/sbhatore/rails/milestones{/number}","notifications_url":"https://api.github.com/repos/sbhatore/rails/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/sbhatore/rails/labels{/name}","releases_url":"https://api.github.com/repos/sbhatore/rails/releases{/id}","created_at":"2015-03-11T21:09:07Z","updated_at":"2015-05-28T21:21:20Z","pushed_at":"2015-08-11T17:22:09Z","git_url":"git://github.com/sbhatore/rails.git","ssh_url":"git@github.com:sbhatore/rails.git","clone_url":"https://github.com/sbhatore/rails.git","svn_url":"https://github.com/sbhatore/rails","homepage":"http://rubyonrails.org","size":144151,"stargazers_count":0,"watchers_count":0,"language":"Ruby","has_issues":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":2,"forks":0,"open_issues":2,"watchers":0,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/sbhatore/rails/pulls/4"},"html":{"href":"https://github.com/sbhatore/rails/pull/4"},"issue":{"href":"https://api.github.com/repos/sbhatore/rails/issues/4"},"comments":{"href":"https://api.github.com/repos/sbhatore/rails/issues/4/comments"},"review_comments":{"href":"https://api.github.com/repos/sbhatore/rails/pulls/4/comments"},"review_comment":{"href":"https://api.github.com/repos/sbhatore/rails/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/sbhatore/rails/pulls/4/commits"},"statuses":{"href":"https://api.github.com/repos/sbhatore/rails/statuses/fe91f57f0b44faed9bf6567df40f4e616d916ed5"}}}}