block_cipher_kit 0.0.2 → 0.0.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d70126d0dac1d18bd5918e846fd0c098b812f262c7fc3f4f38a710fc0bce9d39
-  data.tar.gz: e3a30df8f291d59f78c658e13113431f9edb80a7e7b19e03bd05a89bf15041be
+  metadata.gz: 20609183e16f9958a035b581945c5d891851a85df83cbd19741b3e94efe3a676
+  data.tar.gz: bee694246cdd3eae36af264e7fb3b90dc3179c22203f82e38d028a3733ee99a5
 SHA512:
-  metadata.gz: 7dec668bbbe0be54b38e0f086bd375e698e840a6f083321d91797a6ca904a00b7b6b2845c79b05d0f4cc74d0041858a2b1151572f1fb37c38579dc2c5049c8f5
-  data.tar.gz: 75a36bdd66dc8331b119f9b2a5f520b6b0214b6ea1f45f586ff8ff6558b8e5c22f574722f99172086886572444f56b75ce2a1351e56dbd0cfde18e4bbb3e099b
+  metadata.gz: ac9365aa614c6b9f88fdad333da7577f6b2e1080430df7bafdbb15aba14f031183269407423e6ba79ba6757d9851f141bc09af7c82ed692830f95a7ca9d3ea48
+  data.tar.gz: 5620bce257285e2c18be847ce3557cc5876136562b4c5f619c6eda9c7d761de884dee493f218ae781879af17e7dd94ab7aa6fe7d1f58e884453ac1da1ab07673

data/block_cipher_kit.gemspec

@@ -10,7 +10,12 @@ Gem::Specification.new do |spec|
   spec.license = "MIT"
   spec.summary = "A thin toolkit for working with block cipher encryption."
   spec.description = "A thin toolkit for working with block cipher encryption."
+
   spec.homepage = "https://github.com/julik/block_cipher_kit"
+  # The homepage link on rubygems.org only appears if you add homepage_uri. Just spec.homepage is not enough.
+  spec.metadata["homepage_uri"] = spec.homepage
+  spec.metadata["source_code_uri"] = spec.homepage
+  spec.metadata["changelog_uri"] = "#{spec.homepage}/blob/main/CHANGELOG.md"
 
   spec.required_ruby_version = ">= 2.7.0"
 

data/lib/block_cipher_kit/aes_256_cbc_scheme.rb

@@ -8,7 +8,7 @@ class BlockCipherKit::AES256CBCScheme < BlockCipherKit::BaseScheme
   def initialize(encryption_key, iv_generator: SecureRandom)
     raise ArgumentError, "#{required_encryption_key_length} bytes of key material needed, at the minimum" unless encryption_key.bytesize >= required_encryption_key_length
     @iv_generator = iv_generator
-    @key = BlockCipherKit::KeyMaterial.new(encryption_key.byteslice(0, 32))
+    @key = encryption_key.byteslice(0, 32)
   end
 
   def required_encryption_key_length

data/lib/block_cipher_kit/aes_256_cfb_civ_scheme.rb

@@ -4,8 +4,8 @@ class BlockCipherKit::AES256CFBCIVScheme < BlockCipherKit::BaseScheme
   # @param encryption_key[String] a String in binary encoding containing the IV concatenated with the key for the cipher
   def initialize(encryption_key, **)
     raise ArgumentError, "#{required_encryption_key_length} bytes of key material needed, at the minimum" unless encryption_key.bytesize >= required_encryption_key_length
-    @iv = BlockCipherKit::KeyMaterial.new(encryption_key.byteslice(0, 16))
-    @key = BlockCipherKit::KeyMaterial.new(encryption_key.byteslice(16, 32))
+    @iv = encryption_key.byteslice(0, 16)
+    @key = encryption_key.byteslice(16, 32)
   end
 
   def required_encryption_key_length

data/lib/block_cipher_kit/aes_256_cfb_scheme.rb

@@ -4,7 +4,7 @@ class BlockCipherKit::AES256CFBScheme < BlockCipherKit::BaseScheme
   def initialize(encryption_key, iv_generator: SecureRandom)
     raise ArgumentError, "#{required_encryption_key_length} bytes of key material needed, at the minimum" unless encryption_key.bytesize >= required_encryption_key_length
     @iv_generator = iv_generator
-    @key = BlockCipherKit::KeyMaterial.new(encryption_key.byteslice(0, 32))
+    @key = encryption_key.byteslice(0, 32)
   end
 
   def required_encryption_key_length

data/lib/block_cipher_kit/aes_256_ctr_scheme.rb

@@ -7,7 +7,7 @@ class BlockCipherKit::AES256CTRScheme < BlockCipherKit::BaseScheme
   def initialize(encryption_key, iv_generator: SecureRandom)
     raise ArgumentError, "#{required_encryption_key_length} bytes of key material needed, at the minimum" unless encryption_key.bytesize >= required_encryption_key_length
     @iv_generator = iv_generator
-    @key = BlockCipherKit::KeyMaterial.new(encryption_key.byteslice(0, 32))
+    @key = encryption_key.byteslice(0, 32)
   end
 
   def required_encryption_key_length

data/lib/block_cipher_kit/aes_256_gcm_scheme.rb

@@ -7,8 +7,8 @@ class BlockCipherKit::AES256GCMScheme < BlockCipherKit::BaseScheme
   def initialize(encryption_key, iv_generator: SecureRandom, auth_data: "")
     raise ArgumentError, "#{required_encryption_key_length} bytes of key material needed, at the minimum" unless encryption_key.bytesize >= required_encryption_key_length
     @iv_generator = iv_generator
-    @auth_data = BlockCipherKit::KeyMaterial.new(auth_data.b)
-    @key = BlockCipherKit::KeyMaterial.new(encryption_key.byteslice(0, 32))
+    @auth_data = auth_data.b
+    @key = encryption_key.byteslice(0, 32)
   end
 
   def required_encryption_key_length

data/lib/block_cipher_kit/base_scheme.rb

@@ -64,8 +64,34 @@ class BlockCipherKit::BaseScheme
     buf.string
   end
 
+  def inspect
+    # A reimplementation of #inspect based largely on
+    # https://alchemists.io/articles/ruby_object_inspection
+    pattern = +""
+    values = []
+
+    instance_variables.each do |name|
+      pattern << "#{name}=%s "
+      ivar_value = instance_variable_get(name)
+      if ivar_value.is_a?(String) && key_material_instance_variable_names.include?(name)
+        values.push("[SENSITIVE(#{ivar_value.bytesize * 8} bits)]")
+      else
+        values.push(ivar_value.inspect)
+      end
+    end
+
+    format "#<%s:%#018x #{pattern.strip}>", self.class, object_id << 1, *values
+  end
+
   private
 
+  # The names of instance variables which contain key material and need to be masked in the
+  # output of BaseScheme#inspect. This prevents us from leaking the key, while allowing each
+  # subclass to define which ivars it considers sensitive.
+  def key_material_instance_variable_names
+    [:@key, :@iv]
+  end
+
   def read_copy_stream_via_cipher(source_io:, cipher:, read_limit: nil, destination_io: nil, finalize_cipher: true, &block_accepting_byte_chunks)
     writable = BlockCipherKit::BlockWritable.new(destination_io, &block_accepting_byte_chunks)
     cipher_io = BlockCipherKit::CipherIO.new(writable, cipher)

data/lib/block_cipher_kit/version.rb

@@ -1,3 +1,3 @@
 module BlockCipherKit
-  VERSION = "0.0.2"
+  VERSION = "0.0.3"
 end

data/lib/block_cipher_kit.rb

@@ -21,13 +21,11 @@ module BlockCipherKit
   autoload :ReadWindowIO, __dir__ + "/block_cipher_kit/read_window_io.rb"
   autoload :BlockWritable, __dir__ + "/block_cipher_kit/block_writable.rb"
   autoload :CipherIO, __dir__ + "/block_cipher_kit/cipher_io.rb"
-  autoload :KeyMaterial, __dir__ + "/block_cipher_kit/key_material.rb"
 
   # private_constant :WriteWindowIO
   # private_constant :ReadWindowIO
   # private_constant :BlockWritable
   # private_constant :CipherIO
-  # private_constant :KeyMaterial
 
   autoload :BaseScheme, __dir__ + "/block_cipher_kit/base_scheme.rb"
   autoload :PassthruScheme, __dir__ + "/block_cipher_kit/passthru_scheme.rb"

data/rbi/block_cipher_kit.rbi

@@ -1,6 +1,6 @@
 # typed: strong
 module BlockCipherKit
-  VERSION = T.let("0.0.2", T.untyped)
+  VERSION = T.let("0.0.3", T.untyped)
 
   # Allows an OpenSSL::Cipher to be written through as if it were an IO. This
   # allows the cipher to be passed to things like IO.copy_stream
@@ -75,6 +75,17 @@ module BlockCipherKit
     sig { params(from_ciphertext_io: RandomReadIO, range: T::Range[T.untyped]).returns(String) }
     def decrypt_range(from_ciphertext_io:, range:); end
 
+    # sord omit - no YARD return type given, using untyped
+    sig { returns(T.untyped) }
+    def inspect; end
+
+    # sord omit - no YARD return type given, using untyped
+    # The names of instance variables which contain key material and need to be masked in the
+    # output of BaseScheme#inspect. This prevents us from leaking the key, while allowing each
+    # subclass to define which ivars it considers sensitive.
+    sig { returns(T.untyped) }
+    def key_material_instance_variable_names; end
+
     # sord omit - no YARD type given for "source_io:", using untyped
     # sord omit - no YARD type given for "cipher:", using untyped
     # sord omit - no YARD type given for "read_limit:", using untyped
@@ -110,21 +121,6 @@ module BlockCipherKit
     def write_copy_stream_via_cipher(cipher:, destination_io:, source_io: nil, read_limit: nil, &block_accepting_writable_io); end
   end
 
-  # Allows a string with key material (like IV and key)
-  # to be concealed when an object holding it gets printed or show via #inspect
-  # :nodoc:
-  class KeyMaterial
-    extend Forwardable
-
-    # sord omit - no YARD type given for "str", using untyped
-    sig { params(str: T.untyped).void }
-    def initialize(str); end
-
-    # sord omit - no YARD return type given, using untyped
-    sig { returns(T.untyped) }
-    def inspect; end
-  end
-
   # :nodoc:
   # An adapter which allows a block that accepts chunks of
   # written data to be used as an IO and passed to IO.copy_stream

data/test/schemes_test.rb

@@ -25,6 +25,12 @@ class SchemesTest < Minitest::Test
     end
   end
 
+  SCHEME_NAMES_INCLUDING_PASSTHRU.each do |scheme_class_name|
+    define_method "test_scheme #{scheme_class_name} encrypts and decrypts an empty message" do
+      assert_encrypts_and_decrypts_empty_message(scheme_class_name)
+    end
+  end
+
   SCHEME_NAMES_INCLUDING_PASSTHRU.each do |scheme_class_name|
     define_method "test_scheme #{scheme_class_name} allows random access reads" do
       assert_allows_random_access(scheme_class_name)
@@ -73,6 +79,20 @@ class SchemesTest < Minitest::Test
     assert_equal ciphertexts.length, ciphertexts.uniq.length
   end
 
+  def assert_encrypts_and_decrypts_empty_message(scheme_class_name)
+    rng = Random.new(Minitest.seed)
+    key = rng.bytes(48)
+
+    scheme = resolve(scheme_class_name).new(key)
+    ciphered_io = StringIO.new
+    scheme.streaming_encrypt(from_plaintext_io: StringIO.new, into_ciphertext_io: ciphered_io)
+
+    ciphered_io.rewind
+    decrypted = StringIO.new
+    scheme.streaming_decrypt(from_ciphertext_io: ciphered_io, into_plaintext_io: decrypted)
+    assert_equal 0, decrypted.size
+  end
+
   def assert_encrypts_from_block_and_io(scheme_class_name)
     rng = Random.new(Minitest.seed)
     encryption_key = rng.bytes(64)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: block_cipher_kit
 version: !ruby/object:Gem::Version
-  version: 0.0.2
+  version: 0.0.3
 platform: ruby
 authors:
 - Julik Tarkhanov
@@ -9,7 +9,7 @@ authors:
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2025-02-17 00:00:00.000000000 Z
+date: 2025-02-26 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: minitest
@@ -133,14 +133,12 @@ files:
 - lib/block_cipher_kit/block_writable.rb
 - lib/block_cipher_kit/cipher_io.rb
 - lib/block_cipher_kit/io_types.rb
-- lib/block_cipher_kit/key_material.rb
 - lib/block_cipher_kit/passthru_scheme.rb
 - lib/block_cipher_kit/read_window_io.rb
 - lib/block_cipher_kit/version.rb
 - lib/block_cipher_kit/write_window_io.rb
 - rbi/block_cipher_kit.rbi
 - test/cipher_io_test.rb
-- test/key_material_test.rb
 - test/known_ciphertexts/AES256CBCScheme.ciphertext.bin
 - test/known_ciphertexts/AES256CFBCIVScheme.ciphertext.bin
 - test/known_ciphertexts/AES256CFBScheme.ciphertext.bin
@@ -157,6 +155,9 @@ homepage: https://github.com/julik/block_cipher_kit
 licenses:
 - MIT
 metadata:
+  homepage_uri: https://github.com/julik/block_cipher_kit
+  source_code_uri: https://github.com/julik/block_cipher_kit
+  changelog_uri: https://github.com/julik/block_cipher_kit/blob/main/CHANGELOG.md
   allowed_push_host: https://rubygems.org
 post_install_message:
 rdoc_options: []

data/lib/block_cipher_kit/key_material.rb

@@ -1,17 +0,0 @@
-require "forwardable"
-
-# Allows a string with key material (like IV and key)
-# to be concealed when an object holding it gets printed or show via #inspect
-# :nodoc:
-class BlockCipherKit::KeyMaterial
-  extend Forwardable
-  def_delegators :@str, :b, :byteslice, :to_s, :to_str
-
-  def initialize(str)
-    @str = str
-  end
-
-  def inspect
-    "[SENSITIVE(#{@str.bytesize * 8} bits)]"
-  end
-end

data/test/key_material_test.rb

@@ -1,12 +0,0 @@
-# frozen_string_literal: true
-
-require_relative "test_helper"
-
-class KeyMaterialTest < Minitest::Test
-  def test_conceals_but_provides_string_access
-    km = BlockCipherKit::KeyMaterial.new("foo")
-    assert_equal "[SENSITIVE(24 bits)]", km.inspect
-    assert_equal "foo", [km].join
-    assert_equal "foo".b, km.b
-  end
-end