crypt_keeper 0.16.0.pre → 1.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 742dc47f65ba6f9c21e39dad6b34a25196e74978
-  data.tar.gz: 4e5eaafa1b9876217c739a4c3649fc52308dc0ff
+  metadata.gz: 78d7a7f1ea679f9a1542a65b537a446065c9cd27
+  data.tar.gz: 518d78e7d4a80e07faa80b9eac9c3b268e2db2c8
 SHA512:
-  metadata.gz: f43ec8ae9564d08e804d5539ee04fff90b072502e65128a983c4727953ad930a00cfc2f72bb50d5e6b6585c7bd43bb83199f75bd3cabffb27e317a3f56539dd6
-  data.tar.gz: 097e420adcb718391b14476dff3a8a1c00279bcd211df9cef3f163a424bd1267d5be85b1cfa15fe1773a77cd930cc9fea1c4c7ff0d4a406ca4c7146a570f5d61
+  metadata.gz: 30b9ccbea99c9ac89ee4bf4c9df73fc0b95e2ae3f65aca3e9936a95bd406d271e672e73cefa2c717a2f0c057c638ca876a238c7058da2c3ad6e3f2d2d12720cb
+  data.tar.gz: 07f33f2caca79c5be2c45f2365601e8939b5c64200fba53c00de3e70a9d6b221a68efe47aad00fc7b42003bce2c964ce68701656966149afe4b65dfc45a4e0a7

data/.gitignore

@@ -3,7 +3,7 @@
 .bundle
 .config
 .yardoc
-Gemfile.lock
+*emfile.lock
 InstalledFiles
 _yardoc
 coverage

data/.travis.yml

@@ -1,26 +1,35 @@
-branches: master
 language: ruby
+
+rvm:
+  - 2.1.10
+  - 2.2.5
+  - 2.3.1
+
 gemfile:
-  - gemfiles/activerecord_3_1.gemfile
-  - gemfiles/activerecord_3_2.gemfile
-  - gemfiles/activerecord_4_0.gemfile
-  - gemfiles/activerecord_4_1.gemfile
-before_install:
-  - bundle install
+  - gemfiles/activerecord_4_2.gemfile
+  - gemfiles/activerecord_5_1.gemfile
+
+matrix:
+  exclude:
+    - gemfile: gemfiles/activerecord_5_1.gemfile
+      rvm: 2.1.10
+
+addons:
+  postgresql: 9.3
+
+sudo: false
+
 before_script:
   - cp spec/default.database.yml spec/database.yml
   - psql -c 'CREATE DATABASE crypt_keeper_providers;' -U postgres
   - psql crypt_keeper_providers -c 'CREATE EXTENSION IF NOT EXISTS pgcrypto;' -U postgres
   - mysql -e 'CREATE DATABASE crypt_keeper_providers'
+
+branches: master
+
 notifications:
   email:
     recipients:
       jmazzi@gmail.com
     on_success: never
     on_failure: always
-rvm:
-  - 1.9.3
-  - 2.0.0
-  - 2.1.1
-addons:
-  postgresql: 9.3

data/Appraisals

@@ -1,19 +1,9 @@
-appraise "activerecord_3_1" do
-  gem 'activerecord',  '~> 3.1.10'
-  gem 'activesupport', '~> 3.1.10'
+appraise "activerecord_4_2" do
+  gem "activerecord",  "~> 4.2.0"
+  gem "activesupport", "~> 4.2.0"
 end
 
-appraise "activerecord_3_2" do
-  gem 'activerecord',  '~> 3.2.14'
-  gem 'activesupport', '~> 3.2.14'
-end
-
-appraise "activerecord_4_0" do
-  gem 'activerecord',  '~> 4.0.0'
-  gem 'activesupport', '~> 4.0.0'
-end
-
-appraise "activerecord_4_1" do
-  gem 'activerecord',  '~> 4.1.0'
-  gem 'activesupport', '~> 4.1.0'
+appraise "activerecord_5_0" do
+  gem "activerecord",  "~> 5.0.0"
+  gem "activesupport", "~> 5.0.0"
 end

data/README.md

@@ -1,4 +1,4 @@
-[![Build Status](https://secure.travis-ci.org/jmazzi/crypt_keeper.png?branch=master)](http://travis-ci.org/jmazzi/crypt_keeper)
+[![Build Status](https://secure.travis-ci.org/jmazzi/crypt_keeper.png?branch=master)](http://travis-ci.org/jmazzi/crypt_keeper) [![Gem Version](https://badge.fury.io/rb/crypt_keeper.svg)](http://badge.fury.io/rb/crypt_keeper)
 
 ![CryptKeeper](http://i.imgur.com/qf0aD.jpg)
 
@@ -15,7 +15,7 @@ is a simple class that does 3 things.
 Note: Any options defined using `crypt_keeper` will be passed to `new` as a
 hash.
 
-You can see an AES example [here](https://github.com/jmazzi/crypt_keeper/blob/master/lib/crypt_keeper/provider/aes.rb).
+You can see an AES example [here](https://github.com/jmazzi/crypt_keeper/blob/master/lib/crypt_keeper/provider/aes_new.rb).
 
 ## Why?
 
@@ -27,7 +27,7 @@ simple that *just works*.
 
 ```ruby
 class MyModel < ActiveRecord::Base
-  crypt_keeper :field, :other_field, :encryptor => :aes, :key => 'super_good_password', salt: 'salt'
+  crypt_keeper :field, :other_field, :encryptor => :aes_new, :key => 'super_good_password', salt: 'salt'
 end
 
 model = MyModel.new(field: 'sometext')
@@ -47,28 +47,49 @@ expected behavior, and has its use cases. An example would be migrating from
 one type of encryption to another. Using `update_column` would allow you to
 update the content without going through the current encryptor.
 
-## Available Encryptors
+## Encodings
 
-There are three included encryptors.
+You can force an encoding on the plaintext before encryption and after decryption by using the `encoding` option. This is useful when dealing with multibyte strings:
 
-* [AES](https://github.com/jmazzi/crypt_keeper/blob/master/lib/crypt_keeper/provider/aes_new.rb)
-  * Encryption is peformed using AES-256 via OpenSSL.
-  * Passphrases are derived using [PBKDF2](http://en.wikipedia.org/wiki/PBKDF2)
+```ruby
+class MyModel < ActiveRecord::Base
+  crypt_keeper :field, :other_field, :encryptor => :aes_new, :key => 'super_good_password', salt: 'salt', :encoding => 'UTF-8'
+end
+
+model = MyModel.new(field: 'Tromsø')
+model.save! #=> Your data is now encrypted
+model.field #=> 'Tromsø'
+model.field.encoding #=> #<Encoding:UTF-8>
+```
+
+## Adding encryption to an existing table
 
-* [AES Legacy](https://github.com/jmazzi/crypt_keeper/blob/master/lib/crypt_keeper/provider/aes.rb) *DEPRECATED*
+If you are working with an existing table you would like to encrypt, you must use the `MyExistingModel.encrypt_table!` class method.
+
+```ruby
+class MyExistingModel < ActiveRecord::Base
+  crypt_keeper :field, :other_field, :encryptor => :aes_new, :key => 'super_good_password', salt: 'salt'
+end
+
+MyExistingModel.encrypt_table!
+```
+
+Running `encrypt_table!` will encrypt all rows in the database using the encryption method specificed by the `crypt_keeper` line in your model.
+
+## Supported Available Encryptors
+
+There are four supported encryptors: `aes_new`, `mysql_aes_new`, `postgres_pgp`, `postgres_pgp_public_key`.
+
+* [AES New](https://github.com/jmazzi/crypt_keeper/blob/master/lib/crypt_keeper/provider/aes_new.rb)
   * Encryption is peformed using AES-256 via OpenSSL.
+  * Passphrases are derived using [PBKDF2](http://en.wikipedia.org/wiki/PBKDF2)
 
-* [MySQL AES](https://github.com/jmazzi/crypt_keeper/blob/master/lib/crypt_keeper/provider/mysql_aes_new.rb)
+* [MySQL AES New](https://github.com/jmazzi/crypt_keeper/blob/master/lib/crypt_keeper/provider/mysql_aes_new.rb)
   * Encryption is peformed MySQL's native AES functions.
   * ActiveRecord logs are [automatically](https://github.com/jmazzi/crypt_keeper/blob/master/lib/crypt_keeper/log_subscriber/mysql_aes.rb)
     filtered for you to protect sensitive data from being logged.
   * Passphrases are derived using [PBKDF2](http://en.wikipedia.org/wiki/PBKDF2)
 
-* [MySQL AES](https://github.com/jmazzi/crypt_keeper/blob/master/lib/crypt_keeper/provider/mysql_aes.rb) *DEPRECATED*
-  * Encryption is peformed MySQL's native AES functions.
-  * ActiveRecord logs are [automatically](https://github.com/jmazzi/crypt_keeper/blob/master/lib/crypt_keeper/log_subscriber/mysql_aes.rb)
-    filtered for you to protect senitive data from being logged.
-
 * [PostgreSQL PGP](https://github.com/jmazzi/crypt_keeper/blob/master/lib/crypt_keeper/provider/postgres_pgp.rb).
   * Encryption is performed using PostgresSQL's native [PGP functions](http://www.postgresql.org/docs/9.1/static/pgcrypto.html).
   * It requires the `pgcrypto` PostgresSQL extension:
@@ -110,12 +131,13 @@ Model.where(something: 'blah').search_by_plaintext(:field, 'searchstring')
 ## Creating your own encryptor
 
 Creating your own encryptor is easy. All you have to do is create a class
-under the `CryptKeeper::Provider` namespace, like this:
+under the `CryptKeeper::Provider` namespace, and inherit from the `Base` encryptor,
+like this:
 
 ```ruby
 module CryptKeeper
   module Provider
-    class MyEncryptor
+    class MyEncryptor < Base
       def initialize(options = {})
       end
 
@@ -141,11 +163,11 @@ end
 
 ## Requirements
 
-CryptKeeper has been tested against ActiveRecord 3.1, 3.2, 4.0, 4.1 using ruby
-1.9.3, 2.0.0 and 2.1.1
+CryptKeeper has been tested against ActiveRecord 4.2 and 5.0 using Ruby
+2.1.10, 2.2.5 and 2.3.1.
 
-ActiveRecord 4.0 is supported starting with v0.11.0.
-ActiveRecord 4.1 is supported starting with v0.16.0. (unreleased, use master branch)
+ActiveRecord 4.2 is supported starting with v0.19.0.
+ActiveRecord 5.0 is supported starting with v0.23.0.
 
 ## Installation
 

data/Rakefile

@@ -1,9 +1,13 @@
 #!/usr/bin/env rake
 require "bundler/gem_tasks"
-require 'rspec/core/rake_task'
-require 'appraisal'
+require "rspec/core/rake_task"
+require "appraisal"
 
 RSpec::Core::RakeTask.new :spec
 Bundler::GemHelper.install_tasks
 
-task :default => [:spec]
+if !ENV["APPRAISAL_INITIALIZED"] && !ENV["TRAVIS"]
+  task default: :appraisal
+else
+  task default: :spec
+end

data/crypt_keeper.gemspec

@@ -4,7 +4,7 @@ require File.expand_path('../lib/crypt_keeper/version', __FILE__)
 Gem::Specification.new do |gem|
   gem.authors       = ["Justin Mazzi"]
   gem.email         = ["jmazzi@gmail.com"]
-  gem.description   = %q{Transparent encryption for ActiveRecord that isn't over-engineered}
+  gem.description   = %q{Transparent ActiveRecord encryption}
   gem.summary       = gem.description
   gem.homepage      = "http://jmazzi.github.com/crypt_keeper/"
   gem.license       = 'MIT'
@@ -16,18 +16,18 @@ Gem::Specification.new do |gem|
   gem.require_paths = ["lib"]
   gem.version       = CryptKeeper::VERSION
 
-  gem.add_runtime_dependency 'activerecord',  '>= 3.1', '< 4.2'
-  gem.add_runtime_dependency 'activesupport', '>= 3.1', '< 4.2'
+  gem.add_runtime_dependency 'activerecord',  '>= 4.2', '< 5.2'
+  gem.add_runtime_dependency 'activesupport', '>= 4.2', '< 5.2'
   gem.add_runtime_dependency 'aes',           '~> 0.5.0'
   gem.add_runtime_dependency 'armor',         '~> 0.0.2'
 
-  gem.add_development_dependency 'rspec',       '~> 2.13.0'
-  gem.add_development_dependency 'guard',       '~> 1.8.0'
-  gem.add_development_dependency 'guard-rspec', '~> 2.5.4'
-  gem.add_development_dependency 'rake',        '~> 10.0.3'
+  gem.add_development_dependency 'rspec',       '~> 3.5.0'
+  gem.add_development_dependency 'guard',       '~> 2.6.1'
+  gem.add_development_dependency 'guard-rspec', '~> 4.2.9'
+  gem.add_development_dependency 'rake',        '~> 10.3.1'
   gem.add_development_dependency 'rb-fsevent',  '~> 0.9.1'
   gem.add_development_dependency 'coveralls'
-  gem.add_development_dependency 'appraisal',   '~> 0.5.2'
+  gem.add_development_dependency 'appraisal',   '~> 2.1.0'
 
   if RUBY_PLATFORM == 'java'
     gem.add_development_dependency 'jruby-openssl', '~> 0.7.7'
@@ -36,7 +36,7 @@ Gem::Specification.new do |gem|
     gem.add_development_dependency 'activerecord-jdbcmysql-adapter'
   else
     gem.add_development_dependency 'sqlite3'
-    gem.add_development_dependency 'pg', '~> 0.15.1'
+    gem.add_development_dependency 'pg', '~> 0.18.0'
     gem.add_development_dependency 'mysql2', '~> 0.3.11'
   end
 end

data/gemfiles/activerecord_4_2.gemfile

@@ -0,0 +1,8 @@
+# This file was generated by Appraisal
+
+source "https://rubygems.org"
+
+gem "activerecord", "~> 4.2.0"
+gem "activesupport", "~> 4.2.0"
+
+gemspec :path => "../"

data/gemfiles/activerecord_5_1.gemfile

@@ -0,0 +1,8 @@
+# This file was generated by Appraisal
+
+source "https://rubygems.org"
+
+gem "activerecord", "~> 5.1"
+gem "activesupport", "~> 5.1"
+
+gemspec :path => "../"

data/lib/crypt_keeper/helper.rb

@@ -3,10 +3,38 @@ module CryptKeeper
     module SQL
       private
 
-      # Private: Sanitize an sql query and then execute it
-      def escape_and_execute_sql(query)
+      # Private: Sanitize an sql query and then execute it.
+      #
+      # query - the sql query
+      # new_transaction - if the query should run inside a new transaction
+      #
+      # Returns the ActiveRecord response.
+      def escape_and_execute_sql(query, new_transaction: false)
         query = ::ActiveRecord::Base.send :sanitize_sql_array, query
-        ::ActiveRecord::Base.connection.execute(query).first
+
+        if CryptKeeper.silence_logs?
+          ::ActiveRecord::Base.logger.silence do
+            execute_sql(query, new_transaction: new_transaction)
+          end
+        else
+          execute_sql(query, new_transaction: new_transaction)
+        end
+      end
+
+      # Private: Executes the query.
+      #
+      # query - the sql query
+      # new_transaction - if the query should run inside a new transaction
+      #
+      # Returns an Array.
+      def execute_sql(query, new_transaction: false)
+        if new_transaction
+          ::ActiveRecord::Base.transaction(requires_new: true) do
+            ::ActiveRecord::Base.connection.execute(query).first
+          end
+        else
+          ::ActiveRecord::Base.connection.execute(query).first
+        end
       end
     end
 
@@ -17,23 +45,5 @@ module CryptKeeper
         ::Armor.digest(key, salt)
       end
     end
-
-    module Serializer
-      def dump(value)
-        if value.blank?
-          value
-        else
-          encrypt(value)
-        end
-      end
-
-      def load(value)
-        if value.blank?
-          value
-        else
-          decrypt(value)
-        end
-      end
-    end
   end
 end

data/lib/crypt_keeper/log_subscriber/mysql_aes.rb

@@ -4,26 +4,26 @@ require 'active_support/lazy_load_hooks'
 module CryptKeeper
   module LogSubscriber
     module MysqlAes
-      extend ActiveSupport::Concern
-
-      included do
-        alias_method_chain :sql, :mysql_aes
-      end
-
       # Public: Prevents sensitive data from being logged
-      def sql_with_mysql_aes(event)
-        filter = /(aes_(encrypt|decrypt))\(.*\)/i
+      #
+      # event - An ActiveSupport::Notifications::Event
+      #
+      # Returns a boolean.
+      def sql(event)
+        filter  = /(aes_(encrypt|decrypt))\(.*\)/i
+        payload = event.payload[:sql]
+          .encode('UTF-8', 'binary', invalid: :replace, undef: :replace, replace: '')
 
-        event.payload[:sql] = event.payload[:sql].gsub(filter) do |_|
+        event.payload[:sql] = payload.gsub(filter) do |_|
           "#{$1}([FILTERED])"
         end
 
-        sql_without_mysql_aes(event)
+        super(event)
       end
     end
   end
 end
 
 ActiveSupport.on_load :crypt_keeper_mysql_aes_log do
-  ActiveRecord::LogSubscriber.send :include, CryptKeeper::LogSubscriber::MysqlAes
+  ActiveRecord::LogSubscriber.prepend CryptKeeper::LogSubscriber::MysqlAes
 end

data/lib/crypt_keeper/log_subscriber/postgres_pgp.rb

@@ -4,26 +4,45 @@ require 'active_support/lazy_load_hooks'
 module CryptKeeper
   module LogSubscriber
     module PostgresPgp
-      extend ActiveSupport::Concern
+      FILTER = /(\(*)(?<operation>pgp_sym_encrypt|pgp_sym_decrypt|pgp_pub_encrypt|pgp_pub_decrypt|pgp_key_id)(\(+.*\)+)/im
 
-      included do
-        alias_method_chain :sql, :postgres_pgp
+      # Public: Prevents sensitive data from being logged
+      #
+      # event - An ActiveSupport::Notifications::Event
+      #
+      # Returns a boolean.
+      def sql(event)
+        payload = crypt_keeper_payload_parse(event.payload[:sql])
+        event.payload[:sql] = crypt_keeper_filter_postgres_log(payload)
+        super(event)
       end
 
-      # Public: Prevents sensitive data from being logged
-      def sql_with_postgres_pgp(event)
-        filter = /(\(*)pgp_(sym|pub)_(?<operation>decrypt|encrypt)(\(+.*\)+)/im
+      private
 
-        event.payload[:sql] = event.payload[:sql].gsub(filter) do |_|
+      # Private: Parses the payload to UTF.
+      #
+      # payload - the payload string
+      #
+      # Returns a string.
+      def crypt_keeper_payload_parse(payload)
+        payload.encode('UTF-8', 'binary',
+          invalid: :replace, undef: :replace, replace: '')
+      end
+
+      # Private: Filters the payload.
+      #
+      # payload - the payload string
+      #
+      # Returns a string.
+      def crypt_keeper_filter_postgres_log(payload)
+        payload.gsub(FILTER) do |_|
           "#{$~[:operation]}([FILTERED])"
         end
-
-        sql_without_postgres_pgp(event)
       end
     end
   end
 end
 
 ActiveSupport.on_load :crypt_keeper_postgres_pgp_log do
-  ActiveRecord::LogSubscriber.send :include, CryptKeeper::LogSubscriber::PostgresPgp
+  ActiveRecord::LogSubscriber.prepend CryptKeeper::LogSubscriber::PostgresPgp
 end

data/lib/crypt_keeper/model.rb

@@ -10,8 +10,9 @@ module CryptKeeper
     def ensure_valid_field!(field)
       if self.class.columns_hash["#{field}"].nil?
         raise ArgumentError, "Column :#{field} does not exist"
-      elsif self.class.columns_hash["#{field}"].type != :text
-        raise ArgumentError, "Column :#{field} must be of type 'text' to be used for encryption"
+      elsif !%i(text binary).include?(self.class.columns_hash["#{field}"].type)
+        raise ArgumentError, "Column :#{field} must be of type 'text' or 'binary' \
+to be used for encryption"
       end
     end
 
@@ -24,6 +25,15 @@ module CryptKeeper
       end
     end
 
+    # Private: Force string encodings if the option is set
+    def force_encodings_on_fields
+      crypt_keeper_fields.each do |field|
+        if attributes.has_key?(field.to_s) && send(field).respond_to?(:force_encoding)
+          send(field).force_encoding(crypt_keeper_encoding)
+        end
+      end
+    end
+
     module ClassMethods
       # Public: Setup fields for encryption
       #
@@ -42,27 +52,65 @@ module CryptKeeper
         class_attribute :crypt_keeper_fields
         class_attribute :crypt_keeper_encryptor
         class_attribute :crypt_keeper_options
+        class_attribute :crypt_keeper_encoding
 
         self.crypt_keeper_options   = args.extract_options!
         self.crypt_keeper_encryptor = crypt_keeper_options.delete(:encryptor)
+        self.crypt_keeper_encoding  = crypt_keeper_options.delete(:encoding)
         self.crypt_keeper_fields    = args
 
         ensure_valid_encryptor!
 
         before_save :enforce_column_types_callback
 
+        if self.crypt_keeper_encoding
+          after_find :force_encodings_on_fields
+          before_save :force_encodings_on_fields
+        end
+
         crypt_keeper_fields.each do |field|
-          serialize field, encryptor_klass.new(crypt_keeper_options).
-            extend(::CryptKeeper::Helper::Serializer)
+          serialize field, encryptor
         end
       end
 
       def search_by_plaintext(field, criteria)
         if crypt_keeper_fields.include?(field.to_sym)
-          encryptor = encryptor_klass.new(crypt_keeper_options)
-          encryptor.search(scoping_strategy, field.to_s, criteria)
+          encryptor.search(all, field.to_s, criteria)
         else
-          raise "#{field} is not a crypt_keeper field"
+          raise ArgumentError, "#{field} is not a crypt_keeper field"
+        end
+      end
+
+      # Public: Encrypt a table for the first time.
+      def encrypt_table!
+        tmp_table = Class.new(ActiveRecord::Base).tap do |c|
+          c.table_name = self.table_name
+          c.inheritance_column = :type_disabled
+        end
+
+        transaction do
+          tmp_table.find_each do |r|
+            crypt_keeper_fields.each do |field|
+              r.send("#{field}=", encryptor.encrypt(r[field])) if r[field].present?
+            end
+
+            r.save!
+          end
+        end
+      end
+
+      # Public: Decrypt a table (reverse of encrypt_table!)
+      def decrypt_table!
+        tmp_table = Class.new(ActiveRecord::Base).tap { |c| c.table_name = self.table_name }
+
+        transaction do
+          tmp_table.find_each do |r|
+            crypt_keeper_fields.each do |field|
+              r.send("#{field}=", encryptor.decrypt(r[field])) if r[field].present?
+            end
+
+            r.save!
+          end
         end
       end
 
@@ -73,18 +121,17 @@ module CryptKeeper
         @encryptor_klass ||= "CryptKeeper::Provider::#{crypt_keeper_encryptor.to_s.camelize}".constantize
       end
 
-      # Private: Ensure that the encryptor responds to new
-      def ensure_valid_encryptor!
-        unless defined?(encryptor_klass) && encryptor_klass.respond_to?(:new)
-          raise "You must specify a valid encryptor `crypt_keeper :encryptor => :aes`"
-        end
+      # Private: The encryptor instance.
+      def encryptor
+        @encryptor ||= encryptor_klass.new(crypt_keeper_options)
       end
 
-      def scoping_strategy
-        if ::ActiveRecord.respond_to?(:version) && ::ActiveRecord.version.segments[0] == 4
-          all
-        else
-          scoped
+      # Private: Ensure we have a valid encryptor.
+      def ensure_valid_encryptor!
+        unless defined?(encryptor_klass) && encryptor_klass.respond_to?(:new) &&
+          %i(load dump).all? { |m| encryptor.respond_to?(m) }
+          raise ArgumentError, "You must specify a valid encryptor that implements " \
+            "the `load` and `dump` methods (you can inherit from CryptKeeper::Provider::Base). Example: `crypt_keeper :encryptor => :aes`"
         end
       end
     end

data/lib/crypt_keeper/provider/aes_new.rb

@@ -3,7 +3,7 @@ require 'armor'
 
 module CryptKeeper
   module Provider
-    class AesNew
+    class AesNew < Base
       include CryptKeeper::Helper::DigestPassphrase
 
       # Public: The encryption key

data/lib/crypt_keeper/provider/base.rb

@@ -0,0 +1,21 @@
+module CryptKeeper
+  module Provider
+    class Base
+      def dump(value)
+        if value.blank? || CryptKeeper.stub_encryption?
+          value
+        else
+          encrypt(value.to_s)
+        end
+      end
+
+      def load(value)
+        if value.blank? || CryptKeeper.stub_encryption?
+          value
+        else
+          decrypt(value)
+        end
+      end
+    end
+  end
+end

data/lib/crypt_keeper/provider/mysql_aes_new.rb

@@ -2,7 +2,7 @@ require 'crypt_keeper/log_subscriber/mysql_aes'
 
 module CryptKeeper
   module Provider
-    class MysqlAesNew
+    class MysqlAesNew < Base
       include CryptKeeper::Helper::SQL
       include CryptKeeper::Helper::DigestPassphrase
 
@@ -36,7 +36,7 @@ module CryptKeeper
       #
       # Returns an Enumerable
       def search(records, field, criteria)
-        records.where(field.to_sym => encrypt(criteria))
+        records.where("#{field} = ?", encrypt(criteria))
       end
     end
   end

data/lib/crypt_keeper/provider/postgres_base.rb

@@ -0,0 +1,28 @@
+require 'crypt_keeper/log_subscriber/postgres_pgp'
+
+module CryptKeeper
+  module Provider
+    class PostgresBase < Base
+      include CryptKeeper::Helper::SQL
+      include CryptKeeper::LogSubscriber::PostgresPgp
+
+      INVALID_DATA_ERROR = "Wrong key or corrupt data".freeze
+
+      # Public: Checks if value is already encrypted.
+      #
+      # Returns boolean
+      def encrypted?(value)
+        begin
+          escape_and_execute_sql(["SELECT pgp_key_id(?)", value.to_s],
+            new_transaction: true)['pgp_key_id'].present?
+        rescue ActiveRecord::StatementInvalid => e
+          if e.message.include?(INVALID_DATA_ERROR)
+            false
+          else
+            raise
+          end
+        end
+      end
+    end
+  end
+end