easy-crypto 0.0.3 → 0.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f4ad3e00c48d1045ceb274232305aff4a182022395bbe2b610e2b348cf10e18b
-  data.tar.gz: 00adb629016b33ba4a3f905488abdbf9de0f44b4cf53a43b4d76d18d7f9d8e73
+  metadata.gz: badbe38cfba80b77b62dd33031021281163ca05fb1a59965e5a3a0e9cffea971
+  data.tar.gz: a6c9097921116ce09bca54e24acd7394ec7311448d3918f6343234ac721e8008
 SHA512:
-  metadata.gz: 0b7d604a6a3f4b50f3c4f15d687e2c3833e5116e85b4989b1c91ee0f527e8a897596078c7fb84e77c464f68f3cfbd8a44be698a399bb7a234618c361a34aae71
-  data.tar.gz: 96da1fe387f964f5a1d7a15ea3ef8ae1e81f2544a9a2a9a3c50922473c8acf23fb163bccad7e4670ecbb41b7e6181cdfcdbd2d587c580dcf991f39903c6987ca
+  metadata.gz: 3a56d205ecd4541735b72b040535d351c06710f745b30582ceed565452e52c33decc0be90db307a0d37cc83d77d0c1f4f2b98cdd86542f2c3dd8849df22a094c
+  data.tar.gz: 3ead7d75b180867defe24c13e200b385c7dd7abcda1b701a60595525d5360611ea00f9d6bb99a1c0f1ed47f3078f075dbaed8ad9453ddf56e09a5e44db35d3ad

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    easy-crypto (0.0.3)
+    easy-crypto (0.1.0)
       openssl (~> 2.1.1, >= 2.1.1)
 
 GEM

data/README.md

@@ -1,6 +1,8 @@
 # EasyCrypto [![Build Status](https://travis-ci.org/emartech/ruby-easy-crypto.svg?branch=master)](https://travis-ci.org/emartech/ruby-easy-crypto) [![Gem Version](https://badge.fury.io/rb/easy-crypto.svg)](https://badge.fury.io/rb/easy-crypto)
 
-Provides simple wrappers around the openssl crypto implementation. 
+Provides simple wrappers around the openssl crypto implementation. The library provides two interfaces: simple and advanced. Simple mode is designed for ease-of-use and advanced mode provides some performance benefits in certain use-cases. See below for more details.
+
+All the underlying crypto operations are the same.
 
 ## Installation
 
@@ -18,20 +20,42 @@ Or install it yourself as:
 
     $ gem install easy-crypto
 
-## Usage
+## Simple usage (Recommended)
+
+```ruby
+require 'easycrypto'
+
+password = 'secret password'
+plaintext = 'some data'
+
+ecrypto = EasyCrypto::Crypto.new
+
+encrypted = ecrypto.encrypt(password, plaintext)
+decrypted = ecrypto.encrypt(password, encrypted)
+
+decrypted == plaintext
+```
+
+## Advanced usage (Use for performance)
 
-### Encrypt with previously derived key
+[Key derivation](https://en.wikipedia.org/wiki/Key_derivation_function) is a resource heavy process. The simple interface abstracts this away and forces you to recompute the key before each encryption/decryption process.
+
+This interface allows you to cache the result of the key derivation. This is required if you need to encrypt/decrypt multiple times with the same derived key. Caching the key saves you the time to have to recompute it before every encryption/decryption.
 
 ```ruby
 require 'easycrypto'
 
-key_password = 'secret password'
-plain_text = 'data to encrypt ...'
+password = 'secret password'
+plaintext = 'data to encrypt ...'
 
 ecrypto = EasyCrypto::Crypto.new
 
 key = EasyCrypto::Key.generate(key_password)
-ecrypto.encrypt_with_key(key, plain_text)
+
+encrypted = ecrypto.encrypt_with_key(key, plaintext)
+decrypted = ecrypto.decrypt_with_key(key, encrypted)
+
+decrypted == plaintext
 ```
 
 ## License

data/lib/easycrypto.rb

@@ -1,4 +1,6 @@
 module EasyCrypto
+  DEFAULT_SALT_LENGTH = 12
+
   require 'easycrypto/version'
   require 'easycrypto/key'
   require 'easycrypto/crypto'

data/lib/easycrypto/crypto.rb

@@ -7,6 +7,17 @@ module EasyCrypto
     KEY_BITS = 256
     AES_MODE = :GCM
     IV_LEN = 12
+    AUTH_TAG_LEN = 16
+
+    def initialize(salt_length = DEFAULT_SALT_LENGTH)
+      @salt_length = salt_length
+    end
+
+    def encrypt(password, plaintext)
+      key = EasyCrypto::Key.generate(password, @salt_length)
+
+      encrypt_with_key(key, plaintext)
+    end
 
     def encrypt_with_key(key, plaintext)
       validate_key_type(key)
@@ -20,6 +31,27 @@ module EasyCrypto
       Base64.strict_encode64(key.salt + iv + encrypted + cipher.auth_tag)
     end
 
+    def decrypt(password, ciphertext)
+      salt = get_salt_from_ciphertext(ciphertext)
+      key = EasyCrypto::Key.generate_with_salt(password, salt)
+
+      decrypt_with_key(key, ciphertext)
+    end
+
+    def decrypt_with_key(key, ciphertext)
+      validate_key_type(key)
+
+      raw_ciphertext = Base64.strict_decode64(ciphertext)
+
+      iv = raw_ciphertext[key.salt.length, IV_LEN]
+      encrypted = raw_ciphertext[(key.salt.length + IV_LEN)..-(AUTH_TAG_LEN + 1)]
+      auth_tag = raw_ciphertext[-AUTH_TAG_LEN..-1]
+
+      decipher = create_decipher(key, iv, auth_tag)
+
+      decipher.update(encrypted) + decipher.final
+    end
+
     private
 
     def validate_key_type(key)
@@ -37,5 +69,18 @@ module EasyCrypto
       cipher.iv = iv
       cipher
     end
+
+    def create_decipher(key, iv, auth_tag)
+      decipher = OpenSSL::Cipher::AES.new(Crypto::KEY_BITS, Crypto::AES_MODE).decrypt
+      decipher.key = key.key
+      decipher.iv = iv
+      decipher.auth_tag = auth_tag
+      decipher
+    end
+
+    def get_salt_from_ciphertext(ciphertext)
+      raw_ciphertext = Base64.strict_decode64(ciphertext)
+      raw_ciphertext[0, @salt_length]
+    end
   end
 end

data/lib/easycrypto/key.rb

@@ -7,7 +7,6 @@ module EasyCrypto
     ITERATION_COUNT = 10_000
     KEY_LENGTH = 32
     HASH_ALGO = 'sha256'
-    DEFAULT_SALT_LENGTH = 12
 
     attr_reader :key, :salt
 
@@ -18,6 +17,11 @@ module EasyCrypto
 
     def self.generate(password, salt_length = DEFAULT_SALT_LENGTH)
       salt = OpenSSL::Random.random_bytes(salt_length)
+
+      generate_with_salt(password, salt)
+    end
+
+    def self.generate_with_salt(password, salt)
       key = OpenSSL::KDF.pbkdf2_hmac(
         password,
         salt: salt,

data/lib/easycrypto/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module EasyCrypto
-  VERSION = '0.0.3'
+  VERSION = '0.1.0'
 end

data/spec/easycrypto/crypto_spec.rb

@@ -1,32 +1,89 @@
 require 'easycrypto'
 
 RSpec.describe EasyCrypto::Crypto do
+  let(:salt) { 'aaaaaaaaaaaa' }
+  let(:iv) { 'bbbbbbbbbbbb' }
+  let(:password) { 'some password' }
+  let(:data) { 'some data' }
+  let(:key) { EasyCrypto::Key.generate_with_salt(password, salt) }
+
   it 'has a version number' do
     expect(EasyCrypto::VERSION).not_to be nil
   end
 
-  context 'encrypt' do
-    it 'returns encrypted text in a single line' do
-      ecrypto = EasyCrypto::Crypto.new
-      key = EasyCrypto::Key.generate('key password', 12)
-      encrypted = ecrypto.encrypt_with_key(key, 'plain text')
-      expect(encrypted).not_to include("\n")
+  it 'can encrypt and decrypt data' do
+    ciphertext = subject.encrypt(password, data)
+    plaintext = subject.decrypt(password, ciphertext)
+
+    expect(plaintext).to eq data
+  end
+
+  it 'can encrypt and decrypt data with given key' do
+    key = EasyCrypto::Key.generate(password)
+
+    ciphertext = subject.encrypt_with_key(key, data)
+    plaintext = subject.decrypt_with_key(key, ciphertext)
+
+    expect(plaintext).to eq data
+  end
+
+  describe '#encrypt' do
+    before do
+      allow(OpenSSL::Random).to receive(:random_bytes).and_return(iv)
+      allow(EasyCrypto::Key).to receive(:generate).and_return(key)
+    end
+
+    it 'can encrypt data' do
+      result = subject.encrypt(password, data)
+      raw_result = Base64.strict_decode64(result)
+
+      expect(raw_result[0,12]).to eq salt
+      expect(raw_result[12,12]).to eq iv
+    end
+  end
+
+  describe '#encrypt_with_key' do
+    before do
+      allow(OpenSSL::Random).to receive(:random_bytes).and_return(iv)
+    end
+
+    it 'returns encrypted text as a single line' do
+      ciphertext = subject.encrypt_with_key(key, data)
+
+      expect(ciphertext).not_to include("\n")
     end
 
     it 'raise error if the encryptable data is not a string' do
-      ecrypto = EasyCrypto::Crypto.new
-      key = EasyCrypto::Key.generate('key password', 12)
       expect{
-        ecrypto.encrypt_with_key(key, 1234)
+        subject.encrypt_with_key(key, 1234)
       }.to raise_error(TypeError, 'Encryptable data must be a string')
     end
 
     it 'raise error if the encryptable data is empty' do
-      ecrypto = EasyCrypto::Crypto.new
-      key = EasyCrypto::Key.generate('key password', 12)
       expect{
-        ecrypto.encrypt_with_key(key, '')
+        subject.encrypt_with_key(key, '')
       }.to raise_error(ArgumentError, 'Encryptable data must not be empty')
     end
+
+    it 'can encrypt data with given key' do
+      expected_ciphertext = 'YWFhYWFhYWFhYWFhYmJiYmJiYmJiYmJifAUY9TEdvoOQ79sxKd3zv1dT67K1GM36mQ=='
+      expect(subject.encrypt_with_key(key, data)).to eq expected_ciphertext
+    end
+  end
+
+  describe '#decrypt' do
+    it 'can decrypt encrypted data' do
+      ciphertext = 'FPXj2e2DZrFYRVUhqoBWXhVVVGUO2ZJgayU2F1f6duLtBjYOINvAZPWIXjIVHHslgg=='
+
+      expect(subject.decrypt(password, ciphertext)).to eq data
+    end
+  end
+
+  describe '#decrypt_with_key' do
+    it 'can decrypt encrypted data' do
+      ciphertext = 'YWFhYWFhYWFhYWFhzs8I/ks+nAy2V+Q7xIrJAnOHefyfO4zYwwmz1F2y1mf1wfXDqA=='
+
+      expect(subject.decrypt_with_key(key, ciphertext)).to eq data
+    end
   end
 end

data/spec/easycrypto/key_spec.rb

@@ -1,8 +1,7 @@
 require 'easycrypto'
 
 RSpec.describe EasyCrypto::Key do
-
-  context 'generate' do
+  describe '#generate' do
     it 'returns key with a salt of the specified length' do
       key = EasyCrypto::Key.generate('key password', 24)
 
@@ -15,4 +14,21 @@ RSpec.describe EasyCrypto::Key do
       expect(key.salt.length).to be 12
     end
   end
+
+  describe '#generate_with_salt' do
+    let(:salt) { 'aaaaaaaaaaaa' }
+
+    it 'generates key with the given salt' do
+      key = EasyCrypto::Key.generate_with_salt('key password', salt)
+
+      expect(key.salt).to eq salt
+    end
+
+    it 'generates the same key with the same password and salt' do
+      key_1 = EasyCrypto::Key.generate_with_salt('key password', salt)
+      key_2 = EasyCrypto::Key.generate_with_salt('key password', salt)
+
+      expect(key_1.key).to eq key_2.key
+    end
+  end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: easy-crypto
 version: !ruby/object:Gem::Version
-  version: 0.0.3
+  version: 0.1.0
 platform: ruby
 authors:
 - Emarsys Security
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-06-26 00:00:00.000000000 Z
+date: 2018-06-27 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler