cryptdoh 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA1:
+  metadata.gz: 15c9aee6732af55538874d25d581bd5da3cf6bc4
+  data.tar.gz: 2ce02dfb3f15742f778b9b1dccbf551629b557c5
+SHA512:
+  metadata.gz: 4153032d11cbce77c85122e26e6737114028f60d6afd4c8efeaaf98cc387d37eedd0ec46a1f6454f779296cfbf37e9e556d724e0568686a7bdbf9e6351228377
+  data.tar.gz: f273763c41ff1ebefa309ba22eb13806d6f35cfd89b75f778284a2c7ff9b5ae65b453b60914ee2bb7920fc4c9671f8feb9d4a94d1e8f4fd6246e884bba3da209

data/lib/cryptdoh.rb

@@ -0,0 +1,100 @@
+require 'openssl'
+require 'base64'
+require 'securerandom'
+require 'cracklib'
+
+class UserError < StandardError
+end
+
+class EvilError < StandardError
+end
+
+module Cryptdoh
+
+  MIN_PASSWORD_LENGTH = 8
+  IV_LENGTH = 16
+  SALT_LENGTH = 16
+  ITERATIONS = 100 * 1000
+  KEY_LENGTH = 32
+  DIGEST = OpenSSL::Digest::SHA256.new
+  VERSION = "1"
+
+  def self.encrypt(password, message, args = {})
+    _check_password_length(password)
+    _check_password_strength(password) unless args[:skip_strength_check]
+
+    (salt, key) = _kdf(password)
+    cipher_key = key[0..KEY_LENGTH-1]
+    hmac_key = key[KEY_LENGTH..-1]
+
+    cipher = OpenSSL::Cipher::AES.new(KEY_LENGTH * 8, :CBC)
+    cipher.encrypt
+    iv = cipher.random_iv
+    cipher.key = cipher_key
+
+    ciphertext = cipher.update(message) + cipher.final
+
+    cipher_message = [VERSION, _encode(iv), _encode(salt), _encode(ciphertext)].join('.')
+    hmac = _hmac(hmac_key, cipher_message)
+
+    [cipher_message, _encode(hmac)].join('.')
+  end
+
+  def self.decrypt(password, message)
+    (version, encoded_iv, encoded_salt, encoded_ciphertext, encoded_hmac) = message.split('.')
+
+    (salt, key) = _kdf(password, _decode(encoded_salt))
+    cipher_key = key[0..KEY_LENGTH-1]
+    hmac_key = key[KEY_LENGTH..-1]
+
+    hmac = _hmac(hmac_key, [version, encoded_iv, encoded_salt, encoded_ciphertext].join('.'))
+    raise EvilError, 'Invalid HMAC' unless _decode(encoded_hmac) == hmac
+
+    decipher = OpenSSL::Cipher::AES.new(KEY_LENGTH * 8, :CBC)
+    decipher.decrypt
+    decipher.iv = _decode(encoded_iv)
+    decipher.key = cipher_key
+
+    decipher.update(_decode(encoded_ciphertext)) + decipher.final
+  end
+
+  def self._check_password_strength(password)
+    c = CrackLib::Fascist(password)
+    raise UserError, "Crappy password: #{c.reason}" unless c.ok?
+  end
+
+  def self._check_password_length(password)
+    raise UserError, "Crappy password: too short. Must be at least 8 bytes" unless password.size >= MIN_PASSWORD_LENGTH
+  end
+
+  def self._kdf(password, salt = nil)
+    salt ||= SecureRandom.random_bytes(SALT_LENGTH)
+    raise UserError, "Salt is the wrong size" unless salt.size == SALT_LENGTH
+    key = OpenSSL::PKCS5.pbkdf2_hmac(password, salt, ITERATIONS, KEY_LENGTH * 2, DIGEST)
+    [salt, key]
+  end
+
+  def self._hmac(key, message)
+    # Only require 128 bits of security, so cut in half
+    OpenSSL::HMAC.digest(DIGEST, key, message)[0..15]
+  end
+
+  def self._encode(data)
+    Base64.encode64(data).chomp
+  end
+
+  def self._decode(data)
+    Base64.decode64(data)
+  rescue
+    raise EvilError, 'Bad base64 data'
+  end
+
+  def self._verify
+    message = 'this is a secret message'
+    password = 'dZ]av}a]i4qK2:1Z:t |Ju.'
+
+    decrypt(password, encrypt(password, message)) == message
+  rescue
+    false
+  end
+end

metadata

@@ -0,0 +1,60 @@
+--- !ruby/object:Gem::Specification
+name: cryptdoh
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- Fraser Scott
+autorequire: 
+bindir: bin
+cert_chain: []
+date: 2014-10-05 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: ruby-cracklib
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.0'
+description: |2
+    Most crypto libraries require the user to make significant usage decisions. Without understanding the concepts behind all the options, it is easy for the users to pick something inappropriate, resulting in insecure systems. Also, libraries often allow silly defaults, such as an IV set to all 0s or forgetting a salt etc. This library enforces best-practices, so if you need more control you should use a lower level library.
+email: fraser.scott@gmail.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- lib/cryptdoh.rb
+homepage: https://github.com/zeroXten/cryptdoh
+licenses:
+- MIT
+metadata: {}
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project: 
+rubygems_version: 2.2.2
+signing_key: 
+specification_version: 4
+summary: An easy to use, secure, and opinionated encryption wrapper library for Ruby.
+test_files: []
+has_rdoc: