New algorithm request - Flask session cookie

Hello, I'd like a new algorithm to be implemented in John the Ripper.

The algorithm is Flask session cookie

sample hash - eyJ1c2VybmFtZSI6ImFkbWluIn0.YjdgRQ.15feJoHISWlil2BlCIBF_0Ni9pg

The cookie is based on JWT token, and it's basically double HMAC-SHA1

We can split the cookie into three parts by "." - first one is base64 encoded payload, second one is encoded timestamp and third one is the actual hash.

message = part1 + "." + part2 // in our case message is eyJ1c2VybmFtZSI6ImFkbWluIn0.YjdgRQ

first = HMACSHA1(key=secret, message="cookie-session").digest() // "cookie-session" is a constant; digest is raw digest bytes
second = HMACSHA1(key=first, message=message).digest()

thirdpart should be base64urlsafeencode(second)

In the example secret is "1234"

Sample python code

import multiprocessing
import hashlib
import hmac
import base64

def brute(first):
    for a in charset:
        for b in charset:
            for c in charset:
                password = first + a + b + c
                firstp = hmac.new(password, "cookie-session", hashlib.sha1).digest()
                second = hmac.new(firstp, message, hashlib.sha1).digest()
                final = base64.urlsafe_b64encode(second).replace("=", "")
                if final == expected:
                    print "password", password
                    exit()

cookie = raw_input()

c = cookie.split(".")

message = c[0] + "." + c[1]

expected = c[2]

charset = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!$%&()*+-=?@[]_{|}.,#\"'/\~<>`^:; "

if __name__ == "__main__":
    p = multiprocessing.Pool(8)
    p.map(brute, [i for i in charset])

Sincerely

Start with the supplied Python reference implementation and verify the cookie split, nested HMAC-SHA1 steps, and base64url comparison using the sample secret and cookie. Then locate the corresponding John the Ripper format implementation entry point and existing tests or sample-hash conventions. Done means the new format validates the supplied example and supports password cracking with the stated algorithm.