Digital Signatures — JSON Whitespace Broke Our Webhooks

# io.thecodeforge: Hash-Then-Sign Pattern
# Demonstrates why hashing before signing is essential.

import hashlib
from cryptography.hazmat.primitives.asymmetric import ec, padding, rsa
from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.backends import default_backend

# ─────────────────────────────────────────────────────────────
# WHY HASH FIRST: Messages can be any size, signatures have fixed size
# ─────────────────────────────────────────────────────────────

message_short = b'OK'
message_long  = b'This is a very long contract with thousands of clauses. ' * 1000

print('=== Message Sizes ===')
print(f'Short message: {len(message_short)} bytes')
print(f'Long message:  {len(message_long)} bytes')
print()

# SHA-256 produces a fixed 32-byte digest regardless of input size
hash_short = hashlib.sha256(message_short).digest()
hash_long  = hashlib.sha256(message_long).digest()

print('=== Hash Sizes (always 32 bytes for SHA-256) ===')
print(f'Short message hash: {len(hash_short)} bytes — {hash_short.hex()[:32]}...')
print(f'Long message hash:  {len(hash_long)} bytes — {hash_long.hex()[:32]}...')
print()

# ─────────────────────────────────────────────────────────────
# AVALANCHE EFFECT: One bit change → completely different hash
# ─────────────────────────────────────────────────────────────

msg1 = b'Transfer 500 GBP to account 1234-5678'
msg2 = b'Transfer 501 GBP to account 1234-5678'  # one character different

h1 = hashlib.sha256(msg1).hexdigest()
h2 = hashlib.sha256(msg2).hexdigest()

print('=== Avalanche Effect ===')
print(f'Message 1: "{msg1.decode()}"')
print(f'Hash 1:    {h1}')
print(f'Message 2: "{msg2.decode()}"')
print(f'Hash 2:    {h2}')

# Count differing hex characters
diffs = sum(1 for a, b in zip(h1, h2) if a != b)
print(f'Differing characters: {diffs}/{len(h1)} ({diffs*100//len(h1)}%)')
print('A 1-character message change produces a ~50% different hash.')
print()

# ─────────────────────────────────────────────────────────────
# SIGN AND VERIFY: Full hash-then-sign flow
# ─────────────────────────────────────────────────────────────

private_key = ec.generate_private_key(ec.SECP256R1(), default_backend())
public_key = private_key.public_key()

message = b'Transfer 500 GBP to account 1234-5678'

# Sign (internally: hash(message) → sign the hash)
signature = private_key.sign(message, ec.ECDSA(hashes.SHA256()))

print('=== Hash-Then-Sign Flow ===')
print(f'Message:   {len(message)} bytes')
print(f'Signature: {len(signature)} bytes (fixed size, independent of message size)')
print()

# Verify (internally: hash(message) → verify signature against hash)
try:
    public_key.verify(signature, message, ec.ECDSA(hashes.SHA256()))
    print('Original message: VALID')
except Exception:
    print('Original message: INVALID')

# Tampered message — different hash → signature doesn't match
try:
    public_key.verify(signature, b'Transfer 5000 GBP to account 1234-5678', ec.ECDSA(hashes.SHA256()))
    print('Tampered message: VALID (should not happen)')
except Exception:
    print('Tampered message: INVALID (correctly rejected)')

# io.thecodeforge: RSA Signatures — PKCS#1 v1.5 vs PSS
# Demonstrates why PSS is the correct choice for new systems.

from cryptography.hazmat.primitives.asymmetric import rsa, padding
from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.backends import default_backend

# ─────────────────────────────────────────────────────────────
# KEY GENERATION
# ─────────────────────────────────────────────────────────────

private_key = rsa.generate_private_key(
    public_exponent=65537,
    key_size=2048,
    backend=default_backend()
)
public_key = private_key.public_key()

message = b'Transfer 500 GBP to account 1234-5678'

# ─────────────────────────────────────────────────────────────
# PKCS#1 v1.5 SIGNATURES (legacy — deterministic)
# ─────────────────────────────────────────────────────────────

sig_v15_1 = private_key.sign(
    message,
    padding.PKCS1v15(),
    hashes.SHA256()
)
sig_v15_2 = private_key.sign(
    message,
    padding.PKCS1v15(),
    hashes.SHA256()
)

print('=== PKCS#1 v1.5 (Legacy) ===')
print(f'Signature 1: {sig_v15_1[:16].hex()}...')
print(f'Signature 2: {sig_v15_2[:16].hex()}...')
print(f'Same signature? {sig_v15_1 == sig_v15_2}')  # True — deterministic
print('VULNERABLE: deterministic signatures enable Bleichenbacher-style attacks')
print()

# Verify
try:
    public_key.verify(sig_v15_1, message, padding.PKCS1v15(), hashes.SHA256())
    print('PKCS#1 v1.5 verification: VALID')
except Exception:
    print('PKCS#1 v1.5 verification: INVALID')

# ─────────────────────────────────────────────────────────────
# PSS SIGNATURES (modern — probabilistic)
# ─────────────────────────────────────────────────────────────

sig_pss_1 = private_key.sign(
    message,
    padding.PSS(
        mgf=padding.MGF1(hashes.SHA256()),
        salt_length=padding.PSS.MAX_LENGTH
    ),
    hashes.SHA256()
)
sig_pss_2 = private_key.sign(
    message,
    padding.PSS(
        mgf=padding.MGF1(hashes.SHA256()),
        salt_length=padding.PSS.MAX_LENGTH
    ),
    hashes.SHA256()
)

print('=== PSS (Modern) ===')
print(f'Signature 1: {sig_pss_1[:16].hex()}...')
print(f'Signature 2: {sig_pss_2[:16].hex()}...')
print(f'Same signature? {sig_pss_1 == sig_pss_2}')  # False — probabilistic
print('SECURE: random salt makes each signature unique')
print()

# Verify
try:
    public_key.verify(
        sig_pss_1, message,
        padding.PSS(
            mgf=padding.MGF1(hashes.SHA256()),
            salt_length=padding.PSS.MAX_LENGTH
        ),
        hashes.SHA256()
    )
    print('PSS verification: VALID')
except Exception:
    print('PSS verification: INVALID')

# Tampered message
try:
    public_key.verify(
        sig_pss_1, b'Transfer 5000 GBP to account 1234-5678',
        padding.PSS(
            mgf=padding.MGF1(hashes.SHA256()),
            salt_length=padding.PSS.MAX_LENGTH
        ),
        hashes.SHA256()
    )
    print('Tampered PSS: VALID (should not happen)')
except Exception:
    print('Tampered PSS: INVALID (correctly rejected)')

# io.thecodeforge: ECDSA Signatures
# Demonstrates ECDSA signing, verification, and the k-reuse catastrophe.

from cryptography.hazmat.primitives.asymmetric import ec
from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.backends import default_backend

# ─────────────────────────────────────────────────────────────
# KEY GENERATION (P-256 / secp256r1)
# ─────────────────────────────────────────────────────────────

private_key = ec.generate_private_key(ec.SECP256R1(), default_backend())
public_key = private_key.public_key()

# Export to PEM
private_pem = private_key.private_bytes(
    encoding=serialization.Encoding.PEM,
    format=serialization.PrivateFormat.PKCS8,
    encryption_algorithm=serialization.NoEncryption()
)
public_pem = public_key.public_bytes(
    encoding=serialization.Encoding.PEM,
    format=serialization.PublicFormat.SubjectPublicKeyInfo
)

print('=== ECDSA P-256 Key Generation ===')
print(f'Private key size: 32 bytes (256 bits)')
print(f'Public key size:  {len(public_pem)} bytes (PEM encoded, uncompressed point)')
print()

# ─────────────────────────────────────────────────────────────
# SIGN AND VERIFY
# ─────────────────────────────────────────────────────────────

message = b'Transfer 500 GBP to account 1234-5678'

# Sign (Python's cryptography library uses deterministic k by default — RFC 6979)
signature = private_key.sign(message, ec.ECDSA(hashes.SHA256()))

print('=== ECDSA Signature ===')
print(f'Message:   "{message.decode()}"')
print(f'Signature: {len(signature)} bytes (DER encoded — variable length)')
print(f'Signature (hex): {signature.hex()[:32]}...')
print()

# Verify
try:
    public_key.verify(signature, message, ec.ECDSA(hashes.SHA256()))
    print('Original message: VALID')
except Exception:
    print('Original message: INVALID')

# Tampered message
try:
    public_key.verify(signature, b'Transfer 5000 GBP to account 1234-5678', ec.ECDSA(hashes.SHA256()))
    print('Tampered message: VALID (should not happen)')
except Exception:
    print('Tampered message: INVALID (correctly rejected)')

print()

# ─────────────────────────────────────────────────────────────
# DETERMINISTIC SIGNATURES (RFC 6979)
# Same message → same signature (because k is derived from key + message)
# ─────────────────────────────────────────────────────────────

sig1 = private_key.sign(message, ec.ECDSA(hashes.SHA256()))
sig2 = private_key.sign(message, ec.ECDSA(hashes.SHA256()))

print('=== Deterministic ECDSA (RFC 6979) ===')
print(f'Signature 1: {sig1.hex()[:32]}...')
print(f'Signature 2: {sig2.hex()[:32]}...')
print(f'Same signature? {sig1 == sig2}')  # True — deterministic k
print('SAFE: k is derived from HMAC-SHA256(private_key, message_hash)')
print()

# ─────────────────────────────────────────────────────────────
# DIFFERENT MESSAGES → DIFFERENT SIGNATURES
# ─────────────────────────────────────────────────────────────

sig_a = private_key.sign(b'Message A', ec.ECDSA(hashes.SHA256()))
sig_b = private_key.sign(b'Message B', ec.ECDSA(hashes.SHA256()))

print('=== Different Messages → Different Signatures ===')
print(f'Sig A: {sig_a.hex()[:32]}...')
print(f'Sig B: {sig_b.hex()[:32]}...')
print(f'Same? {sig_a == sig_b}')  # False

# ─────────────────────────────────────────────────────────────
# K-REUSE ATTACK EXPLANATION
# ─────────────────────────────────────────────────────────────

print()
print('=== K-Reuse Attack (What broke Sony PS3) ===')
print('If k is reused for two messages:')
print('  s1 = k^(-1) * (h1 + r * d) mod n')
print('  s2 = k^(-1) * (h2 + r * d) mod n')
print('  s1 - s2 = k^(-1) * (h1 - h2) mod n')
print('  k = (h1 - h2) * (s1 - s2)^(-1) mod n')
print('  d = (s1 * k - h1) * r^(-1) mod n')
print('Result: attacker recovers the private key d.')
print('Fix: use deterministic k (RFC 6979) — derive k from private key + message hash.')

# io.thecodeforge: Ed25519 Signatures
# The modern standard — deterministic, fast, side-channel resistant.

from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
from cryptography.hazmat.primitives import serialization
from cryptography.exceptions import InvalidSignature

# ─────────────────────────────────────────────────────────────
# KEY GENERATION
# ─────────────────────────────────────────────────────────────

private_key = Ed25519PrivateKey.generate()
public_key = private_key.public_key()

# Export to PEM
private_pem = private_key.private_bytes(
    encoding=serialization.Encoding.PEM,
    format=serialization.PrivateFormat.PKCS8,
    encryption_algorithm=serialization.NoEncryption()
)
public_pem = public_key.public_bytes(
    encoding=serialization.Encoding.PEM,
    format=serialization.PublicFormat.SubjectPublicKeyInfo
)

print('=== Ed25519 Key Generation ===')
print(f'Private key (PEM):\n{private_pem.decode()}')
print(f'Public key (PEM):\n{public_pem.decode()}')
print()

# ─────────────────────────────────────────────────────────────
# SIGN AND VERIFY
# ─────────────────────────────────────────────────────────────

message = b'Deploy to production: v2.3.1'
signature = private_key.sign(message)

print('=== Ed25519 Signature ===')
print(f'Message:   "{message.decode()}"')
print(f'Signature: {signature.hex()[:32]}... ({len(signature)} bytes — always 64)')
print()

# Verify
try:
    public_key.verify(signature, message)
    print('Verification: VALID')
except InvalidSignature:
    print('Verification: INVALID')

# Tampered message
try:
    public_key.verify(signature, b'Deploy to production: v2.3.2')
    print('Tampered: VALID (should not happen)')
except InvalidSignature:
    print('Tampered: INVALID (correctly rejected)')

print()

# ─────────────────────────────────────────────────────────────
# DETERMINISTIC: same message → same signature every time
# This is SAFE because k is derived from private key + message hash.
# ─────────────────────────────────────────────────────────────

sig1 = private_key.sign(message)
sig2 = private_key.sign(message)

print('=== Ed25519 Deterministic Signatures ===')
print(f'Signature 1: {sig1[:16].hex()}...')
print(f'Signature 2: {sig2[:16].hex()}...')
print(f'Same signature? {sig1 == sig2}')  # True — deterministic
print('This is SAFE: k is derived from private key + message, not from RNG.')
print()

# ─────────────────────────────────────────────────────────────
# DIFFERENT MESSAGES → DIFFERENT SIGNATURES (even with same key)
# ─────────────────────────────────────────────────────────────

sig_a = private_key.sign(b'Message A')
sig_b = private_key.sign(b'Message B')

print('=== Different Messages → Different Signatures ===')
print(f'Sig A: {sig_a[:16].hex()}...')
print(f'Sig B: {sig_b[:16].hex()}...')
print(f'Same? {sig_a == sig_b}')  # False

# ─────────────────────────────────────────────────────────────
# RECOVER PUBLIC KEY FROM PRIVATE KEY
# ─────────────────────────────────────────────────────────────

recovered_pub = private_key.public_key()
recovered_pem = recovered_pub.public_bytes(
    encoding=serialization.Encoding.PEM,
    format=serialization.PublicFormat.SubjectPublicKeyInfo
)

print(f'\nRecovered public key matches original: {recovered_pem == public_pem}')

package io.thecodeforge.crypto;

import java.nio.charset.StandardCharsets;
import java.security.*;
import java.security.spec.ECGenParameterSpec;
import java.security.spec.NamedParameterSpec;
import java.util.Base64;

/**
 * Digital signature demo: RSA-PSS, ECDSA, and Ed25519.
 * Requires Java 15+ for Ed25519 support.
 *
 * Production context: signing webhook payloads before sending them to
 * a payment gateway. The gateway verifies the signature to ensure
 * the payload wasn't tampered with in transit.
 */
public class SignatureDemo {

    public static void main(String[] args) throws Exception {
        String message = "Transfer 500 GBP to account 1234-5678";
        byte[] messageBytes = message.getBytes(StandardCharsets.UTF_8);

        // ─────────────────────────────────────────────────────
        // 1. RSA-PSS SIGNATURES (use PSS, not PKCS#1 v1.5)
        // ─────────────────────────────────────────────────────

        KeyPairGenerator rsaGen = KeyPairGenerator.getInstance("RSA");
        rsaGen.initialize(2048);
        KeyPair rsaKeyPair = rsaGen.generateKeyPair();

        // Sign with RSA-PSS
        Signature rsaSigner = Signature.getInstance("SHA256withRSA/PSS");
        rsaSigner.initSign(rsaKeyPair.getPrivate());
        rsaSigner.update(messageBytes);
        byte[] rsaSignature = rsaSigner.sign();

        // Verify with RSA-PSS
        Signature rsaVerifier = Signature.getInstance("SHA256withRSA/PSS");
        rsaVerifier.initVerify(rsaKeyPair.getPublic());
        rsaVerifier.update(messageBytes);
        boolean rsaValid = rsaVerifier.verify(rsaSignature);

        System.out.println("=== RSA-PSS ===");
        System.out.println("Signature length: " + rsaSignature.length + " bytes");
        System.out.println("Valid: " + rsaValid);
        System.out.println();

        // ─────────────────────────────────────────────────────
        // 2. ECDSA P-256 SIGNATURES
        // ─────────────────────────────────────────────────────

        KeyPairGenerator ecGen = KeyPairGenerator.getInstance("EC");
        ecGen.initialize(new ECGenParameterSpec("secp256r1"));
        KeyPair ecKeyPair = ecGen.generateKeyPair();

        Signature ecSigner = Signature.getInstance("SHA256withECDSA");
        ecSigner.initSign(ecKeyPair.getPrivate());
        ecSigner.update(messageBytes);
        byte[] ecSignature = ecSigner.sign();

        Signature ecVerifier = Signature.getInstance("SHA256withECDSA");
        ecVerifier.initVerify(ecKeyPair.getPublic());
        ecVerifier.update(messageBytes);
        boolean ecValid = ecVerifier.verify(ecSignature);

        System.out.println("=== ECDSA P-256 ===");
        System.out.println("Signature length: " + ecSignature.length + " bytes (variable — DER encoded)");
        System.out.println("Valid: " + ecValid);
        System.out.println();

        // ─────────────────────────────────────────────────────
        // 3. Ed25519 SIGNATURES (Java 15+)
        // ─────────────────────────────────────────────────────

        KeyPairGenerator edGen = KeyPairGenerator.getInstance("Ed25519");
        KeyPair edKeyPair = edGen.generateKeyPair();

        Signature edSigner = Signature.getInstance("Ed25519");
        edSigner.initSign(edKeyPair.getPrivate());
        edSigner.update(messageBytes);
        byte[] edSignature = edSigner.sign();

        Signature edVerifier = Signature.getInstance("Ed25519");
        edVerifier.initVerify(edKeyPair.getPublic());
        edVerifier.update(messageBytes);
        boolean edValid = edVerifier.verify(edSignature);

        System.out.println("=== Ed25519 ===");
        System.out.println("Signature length: " + edSignature.length + " bytes (always 64)");
        System.out.println("Valid: " + edValid);
        System.out.println();

        // ─────────────────────────────────────────────────────
        // TAMPER DETECTION: all schemes reject modified messages
        // ─────────────────────────────────────────────────────

        byte[] tamperedBytes = "Transfer 5000 GBP to account 1234-5678".getBytes(StandardCharsets.UTF_8);

        edVerifier.initVerify(edKeyPair.getPublic());
        edVerifier.update(tamperedBytes);
        boolean tamperedValid = edVerifier.verify(edSignature);

        System.out.println("=== Tamper Detection ===");
        System.out.println("Tampered message signature valid: " + tamperedValid);
        System.out.println("All schemes correctly reject modified messages.");
    }
}

# io.thecodeforge: DSA Signatures
# DSA is legacy — use ECDSA or Ed25519 for new systems.
# This code exists for understanding and for migrating legacy systems.

from cryptography.hazmat.primitives.asymmetric import dsa
from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.backends import default_backend

# ─────────────────────────────────────────────────────────────
# DSA KEY GENERATION (slow — much slower than ECDSA)
# ─────────────────────────────────────────────────────────────

print('Generating DSA-2048 key pair (this takes a few seconds)...')
private_key = dsa.generate_private_key(
    key_size=2048,
    backend=default_backend()
)
public_key = private_key.public_key()

print(f'DSA key size: {private_key.key_size} bits')
print(f'Key generation: slow (seconds, not milliseconds like ECDSA)')
print()

# ─────────────────────────────────────────────────────────────
# SIGN AND VERIFY
# ─────────────────────────────────────────────────────────────

message = b'Legacy system auth token'

signature = private_key.sign(message, hashes.SHA256())

print('=== DSA Signature ===')
print(f'Signature length: {len(signature)} bytes')
print()

try:
    public_key.verify(signature, message, hashes.SHA256())
    print('Verification: VALID')
except Exception:
    print('Verification: INVALID')

# Tampered
try:
    public_key.verify(signature, b'Modified auth token', hashes.SHA256())
    print('Tampered: VALID (should not happen)')
except Exception:
    print('Tampered: INVALID (correctly rejected)')

print()
print('=== DSA vs ECDSA ===')
print('DSA-2048: 2048-bit key, ~112-bit security, slow key generation')
print('ECDSA P-256: 256-bit key, ~128-bit security, instant key generation')
print('Conclusion: Use ECDSA or Ed25519. DSA is legacy only.')