cryptonite 0.0.2 → 0.0.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 4dac9dced35c1976a89c1cb778a1d7e596a63f87
-  data.tar.gz: c6eeae2387c3a6489131763f5fef77c030af1cd0
+  metadata.gz: ed50ff6fcf3ddaf3a95aed933e81fc266a90828f
+  data.tar.gz: 384a709f62320d39702b3957385443f57f923483
 SHA512:
-  metadata.gz: 708efe2ec46234f57701d129edcc380b1d69108ab433a33e364285a278e22d9fe46c23647f70553864575bd214e2bf5253448a295403b021de99f18cdc3bcc9c
-  data.tar.gz: fdc02dc6897557a4e4bedca75594e6d689db844de8c162bb9e6a41217b01e465c3d468cb1f5e5f9660f44111879b7804f5c74663df0d54fc81054c9e24a94450
+  metadata.gz: 7f255fe078fdbffa927b9b4fea76c1e92c29709418e7a4ee8fdfe603329241f1688a02b1eacce5285fb6faee15947b9a413f6169e932f4d1c231c4eabb0e73d0
+  data.tar.gz: a0ee50b3bb3e4dd1e4d32cd04ce63c2257b286877c94623a4686c4e88c479c8dd3eca77c996d3a115a12fb2a620d9acc94d720fbf8c06c3dac37f036be20b5d9

data/.travis.yml

@@ -1,3 +1,7 @@
 language: ruby
+cache:
+  - bundler
 rvm:
-  - 2.1.0
+  - 2.1.4
+  - 2.0.0
+  - 1.9.3

data/README.md

@@ -27,23 +27,46 @@ the attributes that will be transparently encrypted, e.g.
 
     attr_encrypted :secret, :another_secret
 
-The library operates by overriding `read_attribute` and `write_attribute`
-methods, intercepting with the encryption / decryption of the attribute value.
+The library operates by serializing the fields with a custom encoder that will
+do encryption / decryption of the attribute value.
 
 In order to encrypt the data the library should be provided with the public key
 path, and respectively in order to decrypt them it requires the private key
-path along with its password. Currently, those settings are set only in the
-environment, using the variable names `PUBLIC_KEY_FILE`, `PRIVATE_KEY_FILE` and
-`PRIVATE_KEY_PASSWORD`.
+path along with its password. Those settings can be set either in the
+environment, using the variable names `PUBLIC_KEY`, `PRIVATE_KEY` and
+`PRIVATE_KEY_PASSWORD`, or be passed as options to the `attr_encrypted` method:
 
-If an application does not need to retrieve the encrypted information it is not
-required for the private key settings to be defined. However, please note that
-during development the `inspect` method does call the `read_attribute` method
-and hence it will fail if a private key is not provided.
+    attr_encrypted :secret, public_key: File.read('public_key.pem')
+    attr_encrypted :another_secret, private_key: 'private_key.pem', private_key_password: 'test'
+    attr_encrypted :yet_another_secret, key_pair: :get_key_method
 
-Moreover, please note that ActiveRecord methods that operate massively on
-records do not use the `read_attribute` and `write_attribute` methods and so
-encryption / decryption does not take place there. This is by design.
+If an application does not need to retrieve the encrypted information it is not
+required for the private key settings to be defined. Moreover, please note that
+ActiveRecord methods that operate massively on records do not use the
+serialization features and so encryption / decryption does not take place
+there. This is by design.
+
+## Key Generation
+
+Generate a key pair:
+
+```shell
+openssl genrsa -des3 -out private.pem 2048
+Generating RSA private key, 2048 bit long modulus
+......+++
+.+++
+e is 65537 (0x10001)
+Enter pass phrase for private.pem:
+Verifying - Enter pass phrase for private.pem:
+```
+
+and extract the the public key:
+
+```shell
+openssl rsa -in private.pem -out public.pem -outform PEM -pubout
+Enter pass phrase for private.pem:
+writing RSA key
+```
 
 ## Contributing
 

data/cryptonite.gemspec

@@ -22,6 +22,6 @@ Gem::Specification.new do |spec|
   spec.add_development_dependency "rake"
   spec.add_development_dependency "rspec", "~> 3.1"
   spec.add_development_dependency "sqlite3"
-  spec.add_dependency "activerecord",  ">= 3.1", "< 4.2"
-  spec.add_dependency "activesupport", ">= 3.1", "< 4.2"
+  spec.add_dependency "activerecord",  ">= 4.0", "< 4.2"
+  spec.add_dependency "activesupport", ">= 4.0", "< 4.2"
 end

data/lib/cryptonite.rb

@@ -12,9 +12,6 @@ require 'active_support/lazy_load_hooks'
 module Cryptonite
   extend ActiveSupport::Concern
 
-  PUBLIC_KEY = OpenSSL::PKey::RSA.new(File.read(ENV['PUBLIC_KEY_FILE'])) rescue nil
-  PRIVATE_KEY = OpenSSL::PKey::RSA.new(File.read(ENV['PRIVATE_KEY_FILE']), ENV['PRIVATE_KEY_PASSWORD']) rescue nil
-
   included do
     class_attribute :_attr_encrypted, instance_accessor: false
     self._attr_encrypted = []
@@ -24,6 +21,15 @@ module Cryptonite
     # Attributes listed as encrypted will be transparently encrypted and
     # decrypted in database operations.
     def attr_encrypted(*attributes)
+      options = attributes.extract_options!
+
+      @public_key = get_rsa_key(options[:public_key] || options[:key_pair] || ENV['PUBLIC_KEY'])
+      @private_key = get_rsa_key(options[:private_key] || options[:key_pair] || ENV['PRIVATE_KEY'], options[:private_key_password] || ENV['PRIVATE_KEY_PASSWORD'])
+
+      for attribute in attributes do
+        serialize attribute, Coder.new(@private_key || @public_key)
+      end
+
       self._attr_encrypted = Set.new(attributes.map { |a| a.to_s }) + (self._attr_encrypted || [])
     end
 
@@ -31,47 +37,56 @@ module Cryptonite
     def encrypted_attributes
       self._attr_encrypted
     end
-  end
-
-  # Wrap write_attribute to encrypt value.
-  def write_attribute(attr_name, value)
-    attr_name = attr_name.to_s
 
-    if self.class.encrypted_attributes.include?(attr_name)
-      value = encrypt(value)
-    end unless value.nil?
-
-    super(attr_name, value)
+  private
+    # Retrives an RSA key with multiple ways.
+    def get_rsa_key(key, password = nil)
+      return nil unless key
+
+      if key.is_a?(Proc)
+        key = key.call
+      end
+
+      if key.is_a?(Symbol)
+        key = @instance.send(key)
+      end
+
+      return key if key.is_a?(::OpenSSL::PKey::RSA)
+
+      if key.respond_to?(:read)
+        key = key.read
+      elsif key !~ /^-+BEGIN .* KEY-+$/
+        key = File.read(key)
+      end
+
+      if password.nil?
+        ::OpenSSL::PKey::RSA.new(key)
+      else
+        ::OpenSSL::PKey::RSA.new(key, password.to_s)
+      end
+    end
   end
 
-  # Wrap read_attribute to encrypt value.
-  def read_attribute(attr_name)
-    attr_name = attr_name.to_s
-
-    if self.class.encrypted_attributes.include?(attr_name)
-      value = super(attr_name)
-      decrypt(value) unless value.nil?
-    else
-      super(attr_name)
+  class Coder # :nodoc:
+    def initialize(key)
+      raise ArgumentError unless key.is_a?(::OpenSSL::PKey::RSA)
+      @key = key
     end
-  end
 
-  private
     # Encrypts a value with public key encryption. Keys should be defined in
     # environment.
     def encrypt(value)
-      raise ActiveRecord::ActiveRecordError.new("Undefined public key for encrypted attribute") if PUBLIC_KEY.nil?
-
-      Base64.encode64(PUBLIC_KEY.public_encrypt(value))
+      Base64.encode64(@key.public_encrypt(value))
     end
+    alias :dump :encrypt
 
     # Decrypts a value with public key encryption. Keys should be defined in
     # environment.
     def decrypt(value)
-      raise ActiveRecord::ActiveRecordError.new("Undefined private key for encrypted attribute") if PRIVATE_KEY.nil?
-
-      PRIVATE_KEY.private_decrypt(Base64.decode64(value))
+      @key.private_decrypt(Base64.decode64(value))
     end
+    alias :load :decrypt
+  end
 end
 
 ActiveSupport.on_load :active_record do

data/lib/cryptonite/version.rb

@@ -1,3 +1,3 @@
 module Cryptonite
-  VERSION = "0.0.2"
+  VERSION = "0.0.3"
 end

data/spec/cryptonite_spec.rb

@@ -23,12 +23,12 @@ describe Cryptonite do
       def self.table_name
         "sensitive_data"
       end    
-    end.tap { |obj| obj.attr_encrypted :secret }
+    end
   }
 
-  context "with public key only" do
+  context "with both keys" do
     before do
-      stub_const('Cryptonite::PRIVATE_KEY', nil)
+      subject.tap { |obj| obj.attr_encrypted :secret, key_pair: PRIVATE_FIXTURE_KEY }
     end
 
     it 'encrypts field in database' do
@@ -36,24 +36,56 @@ describe Cryptonite do
 
       subject.new(secret: secret).tap do |instance|
         expect(
-          instance.instance_variable_get(:@attributes).send(:fetch, 'secret')
+          instance.instance_variable_get(:@attributes).send(:fetch, 'secret').serialized_value
+        ).not_to eq(secret)
+      end
+    end
+
+    it 'decrypts field in database' do
+      secret = SecureRandom.hex(16)
+
+      subject.new.tap do |instance|
+        instance.instance_variable_get(:@attributes).send(:fetch, 'secret').value = Base64.encode64(PUBLIC_FIXTURE_KEY.public_encrypt(secret))
+
+        expect(instance.secret).to eq(secret)
+      end
+    end
+
+    it 'encrypts and decrypts field in database' do
+      secret = SecureRandom.hex(16)
+
+      subject.create(secret: secret).reload.tap do |instance|
+        expect(
+          instance.instance_variable_get(:@attributes).send(:fetch, 'secret').serialized_value
         ).not_to eq(secret)
+
+        expect(instance.secret).to eq(secret)
       end
     end
   end
 
-  context "with private key only" do
+  context "with public key only" do
     before do
-      stub_const('Cryptonite::PUBLIC_KEY', nil)
+      subject.tap { |obj| obj.attr_encrypted :secret, public_key: PUBLIC_FIXTURE_KEY }
     end
 
-    it 'decrypts field in database' do
+    it 'encrypts field in database' do
+      secret = SecureRandom.hex(16)
+
+      subject.new(secret: secret).tap do |instance|
+        expect(
+          instance.instance_variable_get(:@attributes).send(:fetch, 'secret').serialized_value
+        ).not_to eq(secret)
+      end
+    end
+
+    it 'cannot decrypt field in database' do
       secret = SecureRandom.hex(16)
 
       subject.new.tap do |instance|
-        instance.instance_variable_get(:@attributes).send(:store, 'secret', Base64.encode64(PUBLIC_FIXTURE_KEY.public_encrypt(secret)))
+        instance.instance_variable_get(:@attributes).send(:fetch, 'secret').value = Base64.encode64(PUBLIC_FIXTURE_KEY.public_encrypt(secret))
 
-        expect(instance.secret).to eq(secret)
+        expect{ instance.secret }.to raise_error OpenSSL::PKey::RSAError
       end
     end
   end

data/spec/spec_helper.rb

@@ -87,11 +87,7 @@ RSpec.configure do |config|
   Kernel.srand config.seed
 =end
 
-  # Configure public key encryption for the EncryptedAttributes concern.
+  # Configure public key encryption for the Cryptonite concern.
   ::PUBLIC_FIXTURE_KEY = OpenSSL::PKey::RSA.new(File.read(File.expand_path('../fixtures/keys/public.pem', __FILE__)))
   ::PRIVATE_FIXTURE_KEY = OpenSSL::PKey::RSA.new(File.read(File.expand_path('../fixtures/keys/private.pem', __FILE__)), 'test')
-  config.before do
-    stub_const('Cryptonite::PUBLIC_KEY', PUBLIC_FIXTURE_KEY)
-    stub_const('Cryptonite::PRIVATE_KEY', PRIVATE_FIXTURE_KEY)
-  end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: cryptonite
 version: !ruby/object:Gem::Version
-  version: 0.0.2
+  version: 0.0.3
 platform: ruby
 authors:
 - GaggleAMP
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2014-10-17 00:00:00.000000000 Z
+date: 2014-11-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -72,7 +72,7 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '3.1'
+        version: '4.0'
     - - "<"
       - !ruby/object:Gem::Version
         version: '4.2'
@@ -82,7 +82,7 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '3.1'
+        version: '4.0'
     - - "<"
       - !ruby/object:Gem::Version
         version: '4.2'
@@ -92,7 +92,7 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '3.1'
+        version: '4.0'
     - - "<"
       - !ruby/object:Gem::Version
         version: '4.2'
@@ -102,7 +102,7 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '3.1'
+        version: '4.0'
     - - "<"
       - !ruby/object:Gem::Version
         version: '4.2'
@@ -147,7 +147,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.4.2
+rubygems_version: 2.2.2
 signing_key: 
 specification_version: 4
 summary: Enables the encryption of specific ActiveRecord attributes.
@@ -156,3 +156,4 @@ test_files:
 - spec/fixtures/keys/private.pem
 - spec/fixtures/keys/public.pem
 - spec/spec_helper.rb
+has_rdoc: