/**
* @param string $original_alg
* @return bool
* @throws InvalidJWKAlgorithm
* @throws JWSInvalidJWKException
* @throws JWSInvalidPayloadException
* @throws JWSNotSupportedAlgorithm
*/
public function verify($original_alg)
{
if (is_null($this->jwk)) {
throw new JWSInvalidJWKException();
}
if ($this->jwk->getKeyUse()->getString() !== JSONWebKeyPublicKeyUseValues::Signature) {
throw new JWSInvalidJWKException(sprintf('use %s not supported ', $this->jwk->getKeyUse()->getString()));
}
if (is_null($this->jwk->getAlgorithm())) {
throw new InvalidJWKAlgorithm('algorithm intended for use with the key is not set! ');
}
if (!is_null($this->jwk->getId()) && !is_null($this->header->getKeyID()) && $this->header->getKeyID()->getValue() != $this->jwk->getId()->getValue()) {
throw new JWSInvalidJWKException(sprintf('original kid %s - current kid %s', $this->header->getKeyID()->getValue(), $this->jwk->getId()->getValue()));
}
$alg = DigitalSignatures_MACs_Registry::getInstance()->get($original_alg);
if (is_null($alg)) {
throw new JWSNotSupportedAlgorithm(sprintf('algo %s', $original_alg));
}
$former_alg = $this->header->getAlgorithm()->getString();
if ($former_alg != $original_alg) {
throw new JWSNotSupportedAlgorithm(sprintf('former alg %s - original alg %s', $former_alg, $original_alg));
}
if ($this->jwk->getAlgorithm()->getValue() !== $original_alg) {
throw new InvalidJWKAlgorithm(sprintf('mismatch between algorithm intended for use with the key %s and the cryptographic algorithm used to secure the JWS %s', $this->jwk->getAlgorithm()->getValue(), $original_alg));
}
$secured_input_bytes = JOSEHeaderSerializer::serialize($this->header) . IBasicJWT::SegmentSeparator . $this->getEncodedPayload();
// use public key / secret
$key = $this->jwk->getKey(JSONWebKeyKeyOperationsValues::VerifyDigitalSignatureOrMAC);
return $alg->verify($key, $secured_input_bytes, $this->signature);
}
/**
* @param IJWK $key
* @return void
* @throws JWKInvalidIdentifierException
*/
public function addKey(IJWK $key)
{
$id = $key->getId();
if (empty($id)) {
throw new JWKInvalidIdentifierException('key id is empty!');
}
if (array_key_exists($id->getValue(), $this->keys_ids)) {
throw new JWKInvalidIdentifierException(sprintf('id %s already exists!'), $key->getId()->getValue());
}
if (!isset($this->set[JWKSetParameters::Keys])) {
$this->set[JWKSetParameters::Keys] = new JsonArray(array());
}
$keys = $this->set[JWKSetParameters::Keys];
$keys->append($key);
$this->set[JWKSetParameters::Keys] = $keys;
$this->keys_ids[$id->getValue()] = $key;
}
