OpenSSL, Webpush, Vapid Keys, Oh My!

wyhaines · September 10, 2024, 4:09pm

I have been making an attempt to port this code, and everything to support it from Ruby to Crystal:

zaru/webpush/blob/master/lib/webpush/encryption.rb

# frozen_string_literal: true

module Webpush
  module Encryption
    extend self

    # rubocop:disable Metrics/AbcSize, Metrics/MethodLength
    def encrypt(message, p256dh, auth)
      assert_arguments(message, p256dh, auth)

      group_name = 'prime256v1'
      salt = Random.new.bytes(16)

      server = OpenSSL::PKey::EC.new(group_name)
      server.generate_key
      server_public_key_bn = server.public_key.to_bn

      group = OpenSSL::PKey::EC::Group.new(group_name)
      client_public_key_bn = OpenSSL::BN.new(Webpush.decode64(p256dh), 2)
      client_public_key = OpenSSL::PKey::EC::Point.new(group, client_public_key_bn)

This file has been truncated. show original

It’s a Ruby library to handle webpush. What I have encountered, however, is a lot more challenging than it initially appeared to be.

I’m leveraging the Spider-Gazelle project’s GitHub - spider-gazelle/openssl_ext: Crystal bindings for OpenSSL RSA and GitHub - spider-gazelle/HKDF: HMAC-based Extract-and-Expand Key Derivation Function (HKDF) for crystal lang shards to help fill in the openssl gaps for this port.

What I have encountered, though, are a considerable number of places where openssl_ext is just different enough in implementation, or where openssl_ext is completely missing equivalencies to the Ruby version of the same, that porting this code has been an exercise in two steps forwards, three steps backwards.

I’ve concluded that in order for me to have success with this approach, I will really have to step back into openssl_ext, and start just filling in the gaps there methodically, as hacks and partial measures aren’t working.

What I am wondering, though, is if there is maybe some other shard that already exists that I am unaware of already implement the web push protocol in Crystal. Has someone already done this, and I just haven’t found it?

jgaskins · September 11, 2024, 4:04am

I ran into the same roadblocks trying to implement WebAuthn. I’d really like to get more of the OpenSSL APIs added to the stdlib eventually.