udo/uce
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add bounded structured crypto operations

Browse Source
This commit is contained in:
udo
2026-07-22 13:43:21 +00:00
parent 68b73343a2
commit 3d155203bd
15 changed files with 564 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
site/tests/crypto_operation.uce
+61
View File
@@ -0,0 +1,61 @@
#include "testlib.h"
RENDER(Request& context)
{
u64 passed = 0;
u64 failed = 0;
u64 skipped = 0;
auto check = [&](String name, bool ok, String detail)
{
site_tests_case(name, ok ? "pass" : "fail", detail);
if(ok) passed++; else failed++;
};
site_tests_page_start("Structured crypto operations", "Algorithm-selected P-256 JWK creation and ES256 JWT signing.");
DValue key_request;
key_request["operation"] = "key_generate";
key_request["algorithm"] = "ES256";
DValue key = crypto_operation(key_request);
DValue header;
header["alg"] = "none";
header["kid"] = key["kid"];
DValue claims;
claims["iss"] = "https://client.example";
claims["sub"] = "client.example";
DValue sign_request;
sign_request["operation"] = "jwt_sign";
sign_request["algorithm"] = "ES256";
sign_request["private_jwk"] = key["private_jwk"];
sign_request["protected_header"] = header;
sign_request["claims"] = claims;
DValue signed_result = crypto_operation(sign_request);
String jwt = signed_result["jwt"].to_string();
StringList parts = split(jwt, ".");
String header_b64 = parts.size() == 3 ? parts[0] : "";
while(header_b64.size() % 4) header_b64 += "=";
String decoded_header = base64_decode(header_b64);
DValue wrong_curve = key["private_jwk"];
wrong_curve["crv"] = "P-384";
DValue malformed = key["private_jwk"];
malformed["x"] = "not_base64url=";
DValue wrong_request = sign_request;
wrong_request["private_jwk"] = wrong_curve;
DValue malformed_request = sign_request;
malformed_request["private_jwk"] = malformed;
DValue unsupported;
unsupported["operation"] = "encrypt";
unsupported["algorithm"] = "ES256";
DValue list_header;
list_header.set_array();
DValue list_item;
list_item = "not-an-object";
list_header.push(list_item);
DValue list_request = sign_request;
list_request["protected_header"] = list_header;
DValue control_request = sign_request;
control_request["claims"]["bad"] = String("control\nbyte");
DValue oversized = key_request;
oversized["ignored"] = String(17000, 'x');
check("crypto_operation() ES256 key generation and JWT signing", key["ok"].to_bool() && signed_result["ok"].to_bool() && key["private_jwk"]["kty"].to_string() == "EC" && key["private_jwk"]["crv"].to_string() == "P-256" && key["public_jwk"]["d"].to_string() == "" && key["kid"].to_string() == key["thumbprint"].to_string() && parts.size() == 3 && parts[2].size() == 86 && decoded_header.find("ES256") != String::npos && !crypto_operation(wrong_request)["ok"].to_bool() && !crypto_operation(malformed_request)["ok"].to_bool() && crypto_operation(unsupported)["error"].to_string() == "unsupported_operation" && !crypto_operation(list_request)["ok"].to_bool() && crypto_operation(control_request)["error"].to_string() == "invalid_request" && crypto_operation(oversized)["error"].to_string() == "invalid_request", key["kid"].to_string());
site_tests_summary(passed, failed, skipped, "Structured crypto tests generate ephemeral P-256 keys and retain no key material.");
site_tests_page_end();
}