Add support for asymmetric signatures

Author: Skn0tt

src/index.spec.ts

@@ -1,26 +1,109 @@
 import { sign, verify } from './';
 
-test('the whole flow', () => {
+function testWithKeyPair(pub: string, priv: string, expextedResult: string) {
   const input = 'hello world';
-  const secret = 'iamverysecret';
   const timestamp = 1600000000000;
-  const signature = sign(input, secret, timestamp);
-  expect(signature).toMatchInlineSnapshot(
-    `"v=1600000000000,d=3bd0b48300a7a7afc491e90ecef6805cb46813ea047434eed9cccc567f7aeecb"`
-  );
+  const signature = sign(input, priv, timestamp);
+  expect(signature).toEqual(expextedResult);
 
   // transmit input + signature over the wire
 
   const receivingTimestamp = timestamp + 60 * 1000;
 
-  const isValidIfWithinTimeout = verify(input, secret, signature, {
+  const isValidIfWithinTimeout = verify(input, pub, signature, {
     timestamp: receivingTimestamp,
   });
   expect(isValidIfWithinTimeout).toBe(true);
 
-  const isValidIfOverTimeout = verify(input, secret, signature, {
+  const isValidIfOverTimeout = verify(input, pub, signature, {
     timestamp: receivingTimestamp,
     timeout: 0.5 * 60 * 1000,
   });
   expect(isValidIfOverTimeout).toBe(false);
+}
+
+test('symmetric', () => {
+  const secret = 'iamverysecret';
+  testWithKeyPair(
+    secret,
+    secret,
+    `v=1600000000000,d=3bd0b48300a7a7afc491e90ecef6805cb46813ea047434eed9cccc567f7aeecb`
+  );
+});
+
+test('asymmetric', () => {
+  const publicKey = `
+-----BEGIN RSA PUBLIC KEY-----
+MIICCgKCAgEAqmeVACnRiy7Em4TJ2hevBQJek3ryctBaMQZKULAUg/+3Gk3CNgY/
+ZoWpFFlwnlIb60KuNAIIev8PEd63F3Ut98UaiTiZnsqMN6j7SyPoSDMP5viFZN8p
+u+xwn6VoGS0y/7fGs8kV+4i96dh2ev0t704E8l8CApVi607IN9NhaAgZrYHW4kTZ
+b1UNcVSKYiG3U4J2e6HNeSIon4Ww7tdM/6JEJWmKYybRzlGVDjZ5NYqRE+kTK1Dv
+lj525aJEVPy8AZzH53AwfIpukoz571voMKWgSypiyKPsXxs6AtaZfpWxLfz4VF0U
+lPr3Shf1CUls4llr6bFBRWub7YhQgiwF14KkdmU/g5DnqiW8jG5P+D5suV8kLUaq
+tm47IfrGhb548/lrh6f9/fFgx+YXjweMdamh5jggjFPUGM3X7glIhl29v/js8HXy
+rFyuj97rS2G3ni36CAvTmZs4FCepmJAF8EWFSUo4193mrFjuOeaWfGxqwUQ14W1T
+sHVEDWgptpO8RU3BNtP3dItY1iTbmIFG2lisGb7ynitJ1vItme0Yd6MeelQjVRTi
+9vfHQawfm5D8kW6dT/ozKFMmffIphQkgwa4xcerb9UQRMMMzgOy3HvQO2b7u0Wt/
+sm4IJlmI1/lBDYlcm4jt/69CvFw1C+3Z2ud5X92lVG0AqFzycFCMyzUCAwEAAQ==
+-----END RSA PUBLIC KEY-----
+`.trim();
+  const privateKey = `
+-----BEGIN RSA PRIVATE KEY-----
+MIIJKQIBAAKCAgEAqmeVACnRiy7Em4TJ2hevBQJek3ryctBaMQZKULAUg/+3Gk3C
+NgY/ZoWpFFlwnlIb60KuNAIIev8PEd63F3Ut98UaiTiZnsqMN6j7SyPoSDMP5viF
+ZN8pu+xwn6VoGS0y/7fGs8kV+4i96dh2ev0t704E8l8CApVi607IN9NhaAgZrYHW
+4kTZb1UNcVSKYiG3U4J2e6HNeSIon4Ww7tdM/6JEJWmKYybRzlGVDjZ5NYqRE+kT
+K1Dvlj525aJEVPy8AZzH53AwfIpukoz571voMKWgSypiyKPsXxs6AtaZfpWxLfz4
+VF0UlPr3Shf1CUls4llr6bFBRWub7YhQgiwF14KkdmU/g5DnqiW8jG5P+D5suV8k
+LUaqtm47IfrGhb548/lrh6f9/fFgx+YXjweMdamh5jggjFPUGM3X7glIhl29v/js
+8HXyrFyuj97rS2G3ni36CAvTmZs4FCepmJAF8EWFSUo4193mrFjuOeaWfGxqwUQ1
+4W1TsHVEDWgptpO8RU3BNtP3dItY1iTbmIFG2lisGb7ynitJ1vItme0Yd6MeelQj
+VRTi9vfHQawfm5D8kW6dT/ozKFMmffIphQkgwa4xcerb9UQRMMMzgOy3HvQO2b7u
+0Wt/sm4IJlmI1/lBDYlcm4jt/69CvFw1C+3Z2ud5X92lVG0AqFzycFCMyzUCAwEA
+AQKCAgBpiV95y2yQ4/U2UGZnYVWvJ4mFk5bGzw2c4UVzdaovGle/vbrzlKj9iPhv
+tvkNxNKvwQt9AGlaK8+chLAmohdHJdbKd7iE5PM0ob6JCgMZfC50ISUUlTYWwlf6
+OAoh1aGJSLuSq46my0i7pKm0gEtLs6lSps7q5LRwAcn08UCZmrK0h/6bAoMb9bQu
+pWpTXohY+ysAZPSJ+kLokXdEZSm2BTxpY1UnFWrJejNzqv8kzt4NU8Pghu7rwWIH
+1Ji3fhO+d+hDCXOuHlpe/1roCKbkQh/ljanCk+uX95fVHC3SfUlPryXpsgBGSKyR
+QgcrqkL6aOFxyasgIIZg9ZTPGg6/KLIWVaLrRC48yvIVXYuh8PYCTHIayjIu5HKf
+HLa0QuXQTR4tiXU2ncxFL8PoFzlq5HBcoJ9ylW5+KAQ9haaJDMIAcTnejPJmacnF
+/f1euSLG3IzybXp8fGFDnXFuNETzW7hhxaORjDlWVbeZsvaB3PKELrmN95sCrKIb
+XrGogyt+HaHkUYh+g/k1E/1vDtoZ7/oZGrU5QU0Ixv+4GqUodrheddL2CIiHkS5G
+/LBiGi4YXd1UJsYaC9pSPYsajWQ/5VNapWY1jhVxKNST4wi7xBLeafuGlaf/Ie4H
+1qCmONvehZmA+zqSdkLcZN13lw2lh/A165FUrM7unf7+GLC9fQKCAQEA2Kp6atIf
+jv3GHek8nXwFxZi5TAQTamVp60qJ7lqbWhUs47d66A/YhOeXTFMBkUuIqaLOk1cp
+2PNmyStDKXQZxcKAzs3EYU2sOQlZ8cx13Q2LUj0RxObszSuFIPB0AdSV8MeMgNYp
+H3GZQaVa1Cj88dc+WU9UnclfLB6eqOnHqST0vLXtySSgSAFt7RNdJlakSxelfr37
+nplrWm9ZwSIHu/F3RzYcju7XnC6771Yyoyax1WugiQ5Klip5op7AyStkOGoco8w+
+TbzW9K+ezNfmlCqTqb74WeLVsjbF5ZIEjlE2KM7jYvFt1aAwzNnrXWR+8m7Lsd9D
+6RtvGIShGPZRywKCAQEAyVcdeiUhaO5bOlIyVQ6OZJ7SwVAnTio8A617icbgjJqA
+3JU8QEGz2ei5peO18LQK8Nn32xppOricIRrBRycczoGX9g3xSWkHtOQZtA69datN
+tuME9RVxy9Y6qFyrf5JnKWtM2P5UJlLmJv8Bh9PJvgwnP453dccD+0RmjI8mRNCD
+IucVLRQod3CneiYZvIcKhu3GbxP+7T/bQp55hsVhLTlNqZ/j1zRsS0FH+m/Emxwj
+P7kcovmbUXIStFWHDHSo9yLhmaD/6jhGuDicCSzMlKcy4oJvqbY2QE3rNKTST46b
+tXKGkD1B8JwZ+GiKItH07tFchkxd8M2U95KfocG2/wKCAQEAiScxoxksXQoMNbcF
+ZfOye6j380TJPZrA9+8RbU7x9I5fAi+NoAUX3Nn1jp0k6uLTuf6TofWVSf6aXFIE
+i+MwxV0gyMi8vZO7p8dhpoz1N19xiDecXfaIhEA+X+GWrenymJ7ZNF1dXsg8aa/Q
+1Wi05iqJD2QGfnOQyY8AhJCokUwRmLvZsHB8/dfZzC9r0e8axWZMnvSIqZcYvACs
+4nM2TiTGis+YOGq9FeMHmLQKDflarW0aDGh9kp2ErgqsoyvSn1uckZui/PbDY9Ug
+Qy+QiM6C9vsqn0vWVqARmgda1vRVwnNkwadvDcH/4k04jsAlFDZKv2hDxvZU10Jt
+8C1NDQKCAQBNwBJmBMiuGL2p++vr5L8gJCUG+cjz6mNamDfIsMAuC8wPYqHtvnGR
+iMmIQjMUTLKc589LERvpzTidoBNbQsNhC7J/FktDKggL1roGSlrngct1AJ39dtaG
+/KeSNJcVoJet6v22HiCo3AJ8tKUGqsaRWWgepwmCtePXuEZRqUYB9PNvGwWWbt5h
+oWNLTENMBmoOSOwEIRikzbACPeh4Huiz6hkPk+sMQ/Y96Wu+TkMCEw+ZoAZq+TD9
+dqu6b/zC1poZNaMhDIdHD4xfv5yh/mbSUO7Zgb1VMEQq+OwHXE7K4itHGn7UXJOG
+MwHkZ5pQb/vB7Z9pTTxJrVoFcN2sPX5JAoIBAQCQAskbusA+8pCvygBBEQRvfPeP
+IOC9/unkJ/5+nlEe0I4FHt8u/P9z5k9DmkoSB2Vs2x/1XRxjJbO0lwQgphtV64W+
+Q8/KLEYzZyFgaVjSmVK2yAKpiVVHA6JKjzaUQzzCU4s1Nnzyg0zPr5CbqZchbUai
+1Q1PeteIRaCM/3eb3eIeR8xLPLBF3kXM1oAMAWPfqVnQA9Vn6+BWUS1MqzIozELD
+yS6CCva4O1bQailhOWHMCXusEMvoSMCg7Xfs8bw1zEqkEGY6yvD3yDoHAOrkfJun
+3NeeW889PxxBKXltanz2j8vO86aJ7nYhqN3OZcxG//OCV3BobyvVMuHJNhfz
+-----END RSA PRIVATE KEY-----
+`.trim();
+
+  testWithKeyPair(
+    publicKey,
+    privateKey,
+    `v=1600000000000,d=3b01f67f6ccabbc0c7cc2ae514a5b7e95cce646ea19a1b4c08de6456a5f70504c59233e5edcae2e00afeca4cb49f23cd61f646f90d4a7f77e2b6157cb9fcbeab6e53642d885f284fa67cad6537caa6d9692d3dc1189d10d53331d60417ac414dda4ce5d691f97abb7137533062e527402c1fc228002ca79a4ad0034990095554b6e53a7ee8307c3ab369cb08deaee419e9f5085ad59c17dab63bdf3bce3fae52ac9ae06bd4b1ad4d23d3c521751bf367ba657a70fb47ea2cdb072d88fad18a9d09f7a2bf1b373be1c625e92fab026e8ff6cf09fb5b0c14f80a3e2ce6c8c5607b55dd17f6111ceed32708243e015c2de83b27a4d4f5f995b68844bec9c0ca535a2afdf058d611b49294d6cd791fc413356d286c2059c10094edf71f8b012a1735fce3ca700c8c53c345bae75e512ac648dce5f7ea8b209917fa817272de6292c64f6e2cb2a48d8db2b4d9718e16eb23a96f996af2098dbbe37619fc242b9ee82f42a3e2afb366e56b185450613ae05951db2613211699c82869c583bd682247eac639fa7567ac00355580ac8ba10d1913c13fda473c2adfa980f92e9ffcb031fc88b4e7fd032220ba5b46b0ac9080fa52dda222a092c4c6e89c36c722edbadb5c95cca3e82b71c57b1a18039db18b9f5b8baed134cc287d77f3a9d1ccd62916cb57308f340288616d7e864693351386b3f0aeeef84ecbb83beba62d117e845a9a`
+  );
 });

src/index.ts

@@ -1,26 +1,80 @@
-import { createHmac } from 'crypto';
+import { createHmac, createSign, createVerify } from 'crypto';
 
 function getHmac(secret: string) {
   return createHmac('sha256', secret);
 }
 
+function isPrivateKey(secretOrPrivateKey: string): boolean {
+  return secretOrPrivateKey.includes('PRIVATE KEY');
+}
+
+function isPublicKey(secretOrPrivateKey: string): boolean {
+  return secretOrPrivateKey.includes('PUBLIC KEY');
+}
+
+function verifyWithSecret(
+  input: string,
+  digest: string,
+  secret: string
+): boolean {
+  return (
+    getHmac(secret)
+      .update(input)
+      .digest('hex') === digest
+  );
+}
+
+function signWithSecret(input: string, secret: string) {
+  return getHmac(secret)
+    .update(input)
+    .digest('hex');
+}
+
+function getSigner(secretOrPrivateKey: string): (input: string) => string {
+  if (isPrivateKey(secretOrPrivateKey)) {
+    return v => signWithPrivate(v, secretOrPrivateKey);
+  } else {
+    return v => signWithSecret(v, secretOrPrivateKey);
+  }
+}
+
+function signWithPrivate(input: string, priv: string): string {
+  return createSign('sha256')
+    .update(input)
+    .sign(priv, 'hex');
+}
+
+function verifyWithPublic(input: string, digest: string, pub: string): boolean {
+  return createVerify('sha256')
+    .update(input)
+    .verify(pub, digest, 'hex');
+}
+
+function getVerifier(
+  secretOrPublicKey: string
+): (input: string, digest: string) => boolean {
+  if (isPublicKey(secretOrPublicKey)) {
+    return (i, d) => verifyWithPublic(i, d, secretOrPublicKey);
+  } else {
+    return (i, d) => verifyWithSecret(i, d, secretOrPublicKey);
+  }
+}
+
 export function sign(
   input: string,
-  secret: string,
+  secretOrPrivateKey: string,
   timestamp: number = Date.now()
 ) {
-  const hmac = getHmac(secret);
-
-  hmac.update(input + timestamp);
+  const signer = getSigner(secretOrPrivateKey);
 
-  return `v=${timestamp},d=${hmac.digest('hex')}`;
+  return `v=${timestamp},d=${signer(input + timestamp)}`;
 }
 
 const FIVE_MINUTES = 5 * 60 * 1000;
 
 export function verify(
   input: string,
-  secret: string,
+  secretOrPublicKey: string,
   signature: string,
   opts: { timeout?: number; timestamp?: number } = {}
 ) {
@@ -40,8 +94,7 @@ export function verify(
     return false;
   }
 
-  const hmac = getHmac(secret);
-  hmac.update(input + poststamp);
+  const verifier = getVerifier(secretOrPublicKey);
 
-  return hmac.digest('hex') === postDigest;
+  return verifier(input + poststamp, postDigest);
 }