armor 0.0.1 → 0.0.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: d38e8f64ee2202c50a7ba0112760c891afab81df
-  data.tar.gz: 6218494c71b80ec48173c37e7cd33ae5b2f0bcba
+  metadata.gz: 2d116e5cf49bf377e2dedebf1d2a1d38732d307a
+  data.tar.gz: 403a41018b14c74e855b1e3ae0de45230e4157db
 SHA512:
-  metadata.gz: bd75de939639c9bb1d5c946f8213e2f85fa8a327f0e1e6c38b31a8aa93cb47a18d605bec91fa4b5dc72ff61bc97d4c142e208b28f4700e6707c7c674c7e30316
-  data.tar.gz: 724e0ae4b2b91aec61d6405d57054f777d4da2217dd68b4db22e8d26e2a7216018a94602d934507fca65c2281c5603ae88067c1787320b77406956c3410e49b1
+  metadata.gz: cb983fca676a1998fc38edc16e3ae640c99c9052b7d9d2e2212f79b3e3c11e0bf8eca78f7438242c956cb987c4b27c3802a5a9e43e77cb4255a71f64c9e272a2
+  data.tar.gz: 3354c524a11f35d420eb5c23f06d08a5870007905ae4a1762268de53be43263e963ac306db21a2022c3114f02e0689724f2af5a068698ae8bb55951ee8a72c02

data/README.md

@@ -0,0 +1,83 @@
+Armor
+=====
+
+[Shield][shield]'s partner in crime.
+
+[shield]: http://cyx.github.io/shield/
+
+Description
+-----------
+
+Armor is a pure Ruby implementation of [PBKDF2][pbkdf2], a
+password-based key derivation function recommended for the
+protection of electronically-stored data.
+
+[pbkdf2]: http://en.wikipedia.org/wiki/PBKDF2
+
+Basic Use
+---------
+
+Simply pass in the password and salt, and you'll get
+the derived key, i.e.
+
+```ruby
+result = Armor.digest("password1", "salt")
+
+# You can now store this in your database, together with your salt.
+User.create(email: "foo@bar.com", crypted_password: result, salt: "salt")
+
+# Or you can do it shield style and compress the password into one
+# field by utilizing a constant length salt, e.g.
+salt = SecureRandom.hex(32) # 64 characters
+result = Armor.digest("password1", salt)
+
+User.create(email: "foo@bar.com", crypted_password: result + salt)
+```
+
+Advanced Usage
+--------------
+
+Armor comes with some very sane defaults, namely:
+
+1.  Number of iterations:
+
+        ENV['ARMOR_ITER'] || 5000
+
+2.  Hashing function to be used:
+
+        ENV['ARMOR_HASH'] || 'sha512'
+
+This line will run your app in a different configuration:
+
+```
+$ ARMOR_HASH=sha1 ARMOR_ITER=50_000 rackup
+```
+
+Measuring the target slowness
+-----------------------------
+
+So the main reason for PBKDF2 is to slow down the hashing function. Normally
+you would measure the desired average time delay that you want, i.e. 50ms.
+
+For this, you can use the command line tool to quickly estimate a good
+iteration value:
+
+```
+$ armor 5000
+Iterations: 5000, Time: 0.12
+
+$ armor 10000
+Iterations: 10000, Time: 0.24
+
+$ armor 20000
+Iterations: 20000, Time: 0.48
+```
+
+Installation
+------------
+
+As usual, you can install it using rubygems.
+
+```
+$ gem install armor
+```

data/lib/armor.rb

@@ -92,7 +92,22 @@ module Armor
     ret
   end
 
-private
+  # Time-attack safe comparison operator.
+  #
+  # @see http://bit.ly/WHHHz1
+  def self.compare(a, b)
+    return false unless a.length == b.length
+
+    cmp = b.bytes.to_a
+    result = 0
+
+    a.bytes.each_with_index do |char, index|
+      result |= char ^ cmp[index]
+    end
+
+    return result == 0
+  end
+
   def self.xor(a, b)
     result = "".encode("ASCII-8BIT")
 

data/tests/armor_test.rb

@@ -31,3 +31,11 @@ test "equality of identical keys" do
 
   assert_equal a, b
 end
+
+test "constant time compare helper" do
+  assert Armor.compare("monkey", "monkey")
+end
+
+test "xor" do
+  assert_equal "\0\x01\0", Armor.xor("110", "100")
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: armor
 version: !ruby/object:Gem::Version
-  version: 0.0.1
+  version: 0.0.2
 platform: ruby
 authors:
 - Cyril David
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2013-04-13 00:00:00.000000000 Z
+date: 2013-04-15 00:00:00.000000000 Z
 dependencies: []
 description: A PBKDF2 pure ruby implementation.
 email:
@@ -19,7 +19,7 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
-- README
+- README.md
 - LICENSE
 - makefile
 - lib/armor.rb
@@ -46,7 +46,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.0.0
+rubygems_version: 2.0.3
 signing_key: 
 specification_version: 4
 summary: shield's partner in crime.

data/README

@@ -1,17 +0,0 @@
-armor
-====
-
-shield's partner in crime.
-
-Description
------------
-
-A PBKDF2 pure ruby implementation.
-
-## Installation
-
-As usual, you can install it using rubygems.
-
-```
-$ gem install armor
-```