devise-argon2 1.0.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA1:
+  metadata.gz: 42fc4fa5bd544b54e22ab094dbf11a72eb21480e
+  data.tar.gz: 6b28b034a81876e937c9177854c3778b82fd60c8
+SHA512:
+  metadata.gz: 444b5ff3b1c5bc056e0877b07b5cd57d70d05392c3267d1e57b93a7573df522fedbcf9e618aeeda4dcb7e562ead89170e9d22370a70ca45c548da7ffc7bddf5b
+  data.tar.gz: 646887fb7b191cbb8ce0a7dcd4d8ee9bd3bbc06b21875aa5e4bc28719c21e31e9167443a14e1ae21dc792f84bf004898a9abdddfbf2ad41acd46bc2e029948c5

data/.gitignore

@@ -0,0 +1,17 @@
+*.gem
+*.rbc
+.bundle
+.config
+.yardoc
+Gemfile.lock
+InstalledFiles
+_yardoc
+coverage
+doc/
+lib/bundler/man
+pkg
+rdoc
+spec/reports
+test/tmp
+test/version_tmp
+tmp

data/.rspec

@@ -0,0 +1,2 @@
+--color
+--format documentation

data/.travis.yml

@@ -0,0 +1,18 @@
+script:
+  - bundle
+  - bundle exec rspec
+rvm:
+  - ree
+  - 1.8.7
+  - 1.9.2
+  - 1.9.3
+  - ruby-head
+  - rbx-18mode
+  - rbx-19mode
+matrix:
+  allow_failures:
+    - rvm: ruby-head
+notifications:
+  email:
+    on_success: always
+    on_failure: always

data/Gemfile

@@ -0,0 +1,10 @@
+source 'https://rubygems.org'
+
+# Specify your gem's dependencies in gvoe_auth-client.gemspec
+gemspec
+
+gem 'rspec'
+gem 'simplecov'
+gem 'activesupport'
+gem 'activemodel'
+gem 'pry'

data/LICENSE.txt

@@ -0,0 +1,22 @@
+Copyright (c) 2016 Tamas Erdos
+
+MIT License
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/README.md

@@ -0,0 +1,50 @@
+devise-argon2 [![Build Status](https://secure.travis-ci.org/erdostom/devise-argon2.png)][Continuous Integration]
+=============
+
+**A [devise-encryptable] password encryptor that uses [argon2]**
+
+  * [Continuous Integration]
+
+[Continuous Integration]: http://travis-ci.org/erdostom/devise-argon2 "Continuous integration @ travis-ci.org"
+
+[argon2]: https://github.com/technion/ruby-argon2
+[devise]: https://github.com/plataformatec/devise
+[devise-encryptable]: https://github.com/plataformatec/devise-encryptable
+
+## Why use Argon2?
+
+Argon2 won Password Hashing Competition and offers additional security compared to the default `bcrypt` by adding a memory cost. More info:
+
+- https://github.com/P-H-C/phc-winner-argon2
+- https://hynek.me/articles/storing-passwords/
+
+## Usage
+
+Assuming you have [devise] (>= 2.1) and the [devise-encryptable] plugin
+set up in your application, add `devise-argon2` to your `Gemfile` and `bundle`:
+
+    gem 'devise-argon2'
+
+Then open up your [devise] configuration,`config/initializers/devise.rb` and configure your encryptor to be `argon2`:
+
+    # config/initializers/devise.rb
+    Devise.setup do |config|
+      # ..
+      config.encryptor = :argon2
+      # ...
+    end
+
+It is also recommended to uncomment (or add) `config.pepper` with a random
+string that will be used in addition to the per-user `password_salt` when hashing.
+
+## Contributing
+
+1. Fork it
+2. Create your feature branch (`git checkout -b my-new-feature`)
+3. Commit your changes (`git commit -am 'Add some feature'`)
+4. Push to the branch (`git push origin my-new-feature`)
+5. Create new Pull Request
+
+## Copyright
+
+Released under MIT License.

data/Rakefile

@@ -0,0 +1 @@
+require "bundler/gem_tasks"

data/devise-argon2.gemspec

@@ -0,0 +1,23 @@
+# -*- encoding: utf-8 -*-
+lib = File.expand_path('../lib', __FILE__)
+$LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
+require "devise/encryptable/encryptors/argon2/version"
+
+Gem::Specification.new do |gem|
+  gem.name          = "devise-argon2"
+  gem.version       = Devise::Encryptable::Encryptors::ARGON2_VERSION
+  gem.authors       = ["Tamas Erdos"]
+  gem.email         = ["tamas at tamaserdos com"]
+  gem.description   = %q{A devise-encryptable password encryptor that uses Argon2}
+  gem.summary       = %q{A devise-encryptable password encryptor that uses Argon2}
+  gem.homepage      = "https://github.com/erdostom/devise-argon2"
+
+  gem.files         = `git ls-files`.split($/)
+  gem.executables   = gem.files.grep(%r{^bin/}).map{ |f| File.basename(f) }
+  gem.test_files    = gem.files.grep(%r{^(test|spec|features)/})
+  gem.require_paths = ["lib"]
+
+  gem.add_dependency 'devise', '>= 2.1.0'
+  gem.add_dependency 'devise-encryptable', '>= 0.2.0'
+  gem.add_dependency 'argon2', '>= 0.1.4'
+end

data/lib/devise-argon2.rb

@@ -0,0 +1,4 @@
+require 'devise'
+require 'devise-encryptable'
+require "devise/encryptable/encryptors/argon2/version"
+require "devise/encryptable/encryptors/argon2"

data/lib/devise/encryptable/encryptors/argon2.rb

@@ -0,0 +1,17 @@
+require 'argon2'
+
+module Devise
+  module Encryptable
+    module Encryptors
+      class Argon2 < Base
+        def self.digest(password, stretches, salt, pepper)
+          ::Argon2::Password.hash("#{password}#{salt}#{pepper}")
+        end
+
+        def self.compare(encrypted_password, password, stretches, salt, pepper)
+          ::Argon2::Password.verify_password("#{password}#{salt}#{pepper}", encrypted_password)
+        end
+      end
+    end
+  end
+end

data/lib/devise/encryptable/encryptors/argon2/version.rb

@@ -0,0 +1,7 @@
+module Devise
+  module Encryptable
+    module Encryptors
+      ARGON2_VERSION = '1.0.0'
+    end
+  end
+end

data/spec/devise-argon2_spec.rb

@@ -0,0 +1,31 @@
+# encoding: utf-8
+require 'spec_helper'
+
+describe Devise::Encryptable::Encryptors::Argon2 do
+  let(:argon2)    { Devise::Encryptable::Encryptors::Argon2 }
+  let(:salt)      { "You say you love me like salt! The simplest spice in my kingdom!" }
+  let(:pepper)    { "I don't really want to stop the show But I thought that you might like to know That the singer's going to sing a song And he wants you all to sing along" }
+  let(:password)  { 'Tr0ub4dor&3' }
+  let(:stretches) { 10 }
+
+  describe ".compare" do
+    let(:encrypted) { Argon2::Password.hash("#{password}#{salt}#{pepper}").to_s }
+
+    it "is true when comparing an encrypted password against given plaintext" do
+      expect(argon2.compare(encrypted, password, stretches, salt, pepper)).to be true
+    end
+
+    it "is false when comparing with wrong password" do
+      expect(argon2.compare(encrypted, 'hunter2', stretches, salt, pepper)).to be false
+    end
+
+    it "is false when comparing with correct password but wrong salt" do
+      expect(argon2.compare(encrypted, password, stretches, 'nacl', pepper)).to be false
+    end
+
+    it "is false when comparing with correct password but wrong pepper" do
+      expect(argon2.compare(encrypted, password, stretches, salt, 'beatles')).to be false
+    end
+  end
+
+end

data/spec/spec_helper.rb

@@ -0,0 +1,9 @@
+require 'rubygems'
+require 'simplecov'
+SimpleCov.start
+require 'pry'
+require 'bundler/setup'
+require 'devise-argon2'
+
+RSpec.configure do |config|
+end

metadata

@@ -0,0 +1,100 @@
+--- !ruby/object:Gem::Specification
+name: devise-argon2
+version: !ruby/object:Gem::Version
+  version: 1.0.0
+platform: ruby
+authors:
+- Tamas Erdos
+autorequire: 
+bindir: bin
+cert_chain: []
+date: 2016-01-15 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: devise
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.1.0
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.1.0
+- !ruby/object:Gem::Dependency
+  name: devise-encryptable
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.2.0
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.2.0
+- !ruby/object:Gem::Dependency
+  name: argon2
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.1.4
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.1.4
+description: A devise-encryptable password encryptor that uses Argon2
+email:
+- tamas at tamaserdos com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- ".gitignore"
+- ".rspec"
+- ".travis.yml"
+- Gemfile
+- LICENSE.txt
+- README.md
+- Rakefile
+- devise-argon2.gemspec
+- lib/devise-argon2.rb
+- lib/devise/encryptable/encryptors/argon2.rb
+- lib/devise/encryptable/encryptors/argon2/version.rb
+- spec/devise-argon2_spec.rb
+- spec/spec_helper.rb
+homepage: https://github.com/erdostom/devise-argon2
+licenses: []
+metadata: {}
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project: 
+rubygems_version: 2.4.5.1
+signing_key: 
+specification_version: 4
+summary: A devise-encryptable password encryptor that uses Argon2
+test_files:
+- spec/devise-argon2_spec.rb
+- spec/spec_helper.rb