Feature/jwe compression#71
Open
jattsson wants to merge 4 commits into
Open
Conversation
Implements RFC 7516 §4.1.3 compression for JWE payloads, honored on both sign and verify. A pluggable `compression_algs` registry is exposed via `jwt:register_compression_alg(name, handler)`; the default "DEF" (raw DEFLATE / RFC 1951) handler lazily requires `lua-zlib` so it stays an optional dependency — callers without lua-zlib installed can supply their own handler. Refs cdbattags#70
Adds tests for dir, RSA-OAEP-256 and ECDH-ES round-trips with zip=DEF, a size-shrinkage sanity check on compressible payloads, and error paths for unknown zip values on both sign and verify plus custom handler registration. Installs lua-zlib (pinned to 1.3-0 which ships a source rock, avoiding the git-only install path) and its zlib1g-dev dependency in the CI container. README documents the zip header and the new jwt:register_compression_alg API. Refs cdbattags#70
Compress-then-encrypt leaks information about the plaintext through
ciphertext length (CRIME / BREACH family), so compression should not
be active unless the operator has considered the threat model.
The compression registry is now empty by default. Callers enable the
"DEF" zip alg by passing their own lua-zlib module:
jwt:register_zlib_compression(require "zlib")
This also keeps lua-zlib as a fully caller-owned dependency — the
library does not require or reference it. register_zlib_compression
delegates to register_compression_alg so registration goes through a
single validated path, and alternate handlers (or additional zip
values) can still be registered directly.
Refs cdbattags#70
An incoming JWE with an unknown zip header (e.g. zip=FOO) was only rejected after the CEK had been unwrapped and the AEAD payload had been decrypted, letting an attacker force expensive RSA-OAEP / ECDH work with any malformed header. Validate zip against the registry right after the alg check so such tokens are rejected cheaply. Refs cdbattags#70
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes #70.
Adds RFC 7516 §4.1.3
zipheader parameter support for both sign(encrypt) and verify (decrypt), wired up to the registered
DEFvalue (raw DEFLATE per RFC 1951). Compression is opt-in —
compress-then-encrypt leaks plaintext information through ciphertext
length (CRIME / BREACH), so the registry ships empty and callers
enable the
DEFalg by injecting their ownlua-zlib:jwt:register_zlib_compression(require "zlib")A generic
jwt:register_compression_alg(name, handler)is alsoexposed so callers can bind alternate backends (pure-Lua DEFLATE,
project-specific zip values, etc.) — register_zlib_compression
is itself just a wrapper over it.
No new hard dependency is added to the rockspec; users who want DEF
install lua-zlib themselves.
Notes for reviewers
Commits
str_const entries.
size-shrinkage sanity check, error paths, custom-handler dispatch.
README + TEST 63 added.
zip isn't registered is now rejected immediately after the alg
check in parse_jwe, before any RSA-OAEP / ECDH-ES key unwrap or
AEAD decrypt, so a malformed header can't force expensive crypto.
Test coverage
family (dir, RSA-OAEP-256, ECDH-ES).
regressions where deflate degrades to a pass-through.
Security notes
— consumers accepting untrusted JWEs should bound ciphertext size
before verify.