view release on metacpan or  search on metacpan

lib/Net/OAuth.pm  view on Meta::CPAN

=head3 RSA-SHA1 SIGNATURES

To use RSA-SHA1 signatures, pass in a Crypt::OpenSSL::RSA object (or any object that can do $o->sign($str) and/or $o->verify($str, $sig))

E.g.

Consumer:

 use Crypt::OpenSSL::RSA;
 use File::Slurp;
 $keystring = read_file('private_key.pem');
 $private_key = Crypt::OpenSSL::RSA->new_private_key($keystring);
 $request = Net::OAuth->request('request token')->new(%params);
 $request->sign($private_key);

Service Provider:

 use Crypt::OpenSSL::RSA;
 use File::Slurp;
 $keystring = read_file('public_key.pem');
 $public_key = Crypt::OpenSSL::RSA->new_public_key($keystring);
 $request = Net::OAuth->request('request token')->new(
     %params,
     allowed_signature_methods => ['RSA-SHA1'],

t/02-rsa.t  view on Meta::CPAN

}

SKIP: {

    skip "Crypt::OpenSSL::RSA not installed", 3 unless eval 'require Crypt::OpenSSL::RSA';

    my $publickey;
    my $privkey;

    eval {
    $privkey = Crypt::OpenSSL::RSA->new_private_key(slurp('t/rsakey'));
    } or die "unable to read private key";
    eval {
    $publickey = Crypt::OpenSSL::RSA->new_public_key(slurp("t/rsakey.pub"));
    } or die "unable to read public key";

    # Crypt::OpenSSL::RSA 0.35 through 0.37 disabled PKCS#1 v1.5 padding over
    # the Marvin attack; 0.38 re-enabled it (PR #103). RFC 5849 3.4.3 requires
    # it, so RSA-SHA1 simply cannot be done on those releases.
    skip "Crypt::OpenSSL::RSA $Crypt::OpenSSL::RSA::VERSION cannot do PKCS#1 "
       . "v1.5 padding, which OAuth RSA-SHA1 requires; upgrade to 0.38+", 3
        unless eval { Crypt::OpenSSL::RSA->new_private_key(slurp('t/rsakey'))
                          ->use_pkcs1_padding; 1 };

    # Deliberately left un-tuned: Net::OAuth::SignatureMethod::RSA_SHA1 must
    # pin the hash and padding itself, since callers in the wild don't.

    my $request = Net::OAuth::ProtectedResourceRequest->new(
            consumer_key => 'dpf43f3p2l4k3l03',
            consumer_secret => 'kd94hf93k423kf44',
            request_url => 'http://photos.example.net/photos',
            request_method => 'GET',