cyphera 0.0.1.alpha.6 → 0.0.1.alpha.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fd14e187ce2efc327e01b297d3994a7bc4fdad3d403f8e0c3ad8e25454368b51
-  data.tar.gz: c43eb5a96ee6b4711d1ea7ef49f4690fb7fa1a3e513ff861ee05b7699243b5d4
+  metadata.gz: a65ed0421e315fb812c18254d76d44e8608fad0968ee2814ae08f2143d52fe1f
+  data.tar.gz: 1f365dbd3f2b4394dd86b1e6f37409a49fd346879468871625b47e537edd8a40
 SHA512:
-  metadata.gz: a786d776237f88131028b23335e0326625e8cbfa84502dde2a8fc694b9732739a6046a8e084b21c3ea97385f5821b5ea266ae5a54da23c4e6db037ddf7f15d4c
-  data.tar.gz: 2dff2617966f49bfb4f438876c942a1c30577723d4e86e68d89be3d80dcb370feaf4fb30fb34649e6d17b6d578b3606ff6079d9cc8f7523dfb8fa4b16caf9b06
+  metadata.gz: 40e5d3318a64f784bc7b36e74a0e169a249a144dd0c4367423a9f040e17c74a181436e95832754f772469988d3c7adb9b9ad12877b18afea65744ae5d94acc59
+  data.tar.gz: fc69eb1257b4841670b84ed3b7a146af687b78cdbc99463627e27b9b25183a96af1792e19f448eba70bde2e7675c5067895e1712ba3b0ca2d61b8304f55ad857

data/lib/cyphera/cyphera.rb

@@ -107,9 +107,11 @@ module Cyphera
         end
 
         @configurations[name] = {
+          'name' => name,
           'engine' => cfg.fetch('engine', 'ff1'),
           'alphabet' => resolve_alphabet(cfg['alphabet']),
           'key_ref' => cfg['key_ref'],
+          'tweak' => cfg['tweak'],
           'header' => header,
           'header_enabled' => header_enabled,
           'header_length' => cfg.fetch('header_length', 3).to_i,
@@ -176,20 +178,47 @@ module Cyphera
       $stderr.puts "WARNING: engine 'ff3' is deprecated and cryptographically weak — migrate to 'ff31' (FF3-1)."
     end
 
+    # Resolve and validate the configuration-level tweak for an FPE engine.
+    # FF3 requires exactly 8 bytes and FF3-1 requires exactly 7 — missing
+    # → hard error with the canonical spec message; no silent zero-fill.
+    # FF1 accepts an empty or arbitrary-length tweak per NIST SP 800-38G.
+    def resolve_tweak(configuration)
+      raw = configuration['tweak']
+      engine = configuration['engine']
+      name = configuration['name']
+      case engine
+      when 'ff3'
+        if raw.nil? || raw.empty?
+          raise ArgumentError, "configuration '#{name}' is missing required 'tweak' (FF3 needs 8 bytes)"
+        end
+        [raw].pack('H*')
+      when 'ff31'
+        if raw.nil? || raw.empty?
+          raise ArgumentError, "configuration '#{name}' is missing required 'tweak' (FF3-1 needs 7 bytes)"
+        end
+        [raw].pack('H*')
+      else
+        # FF1 — empty tweak is fine, but allow a configured one if supplied.
+        return '' if raw.nil? || raw.empty?
+        [raw].pack('H*')
+      end
+    end
+
     def protect_fpe(value, configuration)
       key = resolve_key(configuration['key_ref'])
       alphabet = configuration['alphabet']
       encryptable, positions, chars = extract_passthroughs(value, alphabet)
       raise ArgumentError, 'no encryptable characters in input' if encryptable.empty?
 
+      tweak = resolve_tweak(configuration)
       encrypted = case configuration['engine']
       when 'ff3'
         warn_ff3_deprecated
-        FF3.new(key, "\x00" * 8, alphabet).encrypt(encryptable)
+        FF3.new(key, tweak, alphabet).encrypt(encryptable)
       when 'ff31'
-        FF31.new(key, "\x00" * 7, alphabet).encrypt(encryptable)
+        FF31.new(key, tweak, alphabet).encrypt(encryptable)
       else
-        FF1.new(key, '', alphabet).encrypt(encryptable)
+        FF1.new(key, tweak, alphabet).encrypt(encryptable)
       end
 
       result = reinsert_passthroughs(encrypted, positions, chars)
@@ -208,14 +237,15 @@ module Cyphera
 
       encryptable, positions, chars = extract_passthroughs(protected_value, alphabet)
 
+      tweak = resolve_tweak(configuration)
       decrypted = case configuration['engine']
       when 'ff3'
         warn_ff3_deprecated
-        FF3.new(key, "\x00" * 8, alphabet).decrypt(encryptable)
+        FF3.new(key, tweak, alphabet).decrypt(encryptable)
       when 'ff31'
-        FF31.new(key, "\x00" * 7, alphabet).decrypt(encryptable)
+        FF31.new(key, tweak, alphabet).decrypt(encryptable)
       else
-        FF1.new(key, '', alphabet).decrypt(encryptable)
+        FF1.new(key, tweak, alphabet).decrypt(encryptable)
       end
 
       reinsert_passthroughs(decrypted, positions, chars)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: cyphera
 version: !ruby/object:Gem::Version
-  version: 0.0.1.alpha.6
+  version: 0.0.1.alpha.7
 platform: ruby
 authors:
 - Horizon Digital Engineering