encryptor 1.3.0 → 2.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (23) hide show
  1. checksums.yaml +7 -0
  2. checksums.yaml.gz.sig +0 -0
  3. data.tar.gz.sig +1 -0
  4. data/.gitignore +5 -0
  5. data/.travis.yml +19 -0
  6. data/CHANGELOG.md +24 -0
  7. data/Gemfile +3 -0
  8. data/README.md +168 -73
  9. data/Rakefile +5 -14
  10. data/certs/saghaulor.pem +21 -0
  11. data/encryptor.gemspec +41 -0
  12. data/lib/encryptor.rb +54 -19
  13. data/lib/encryptor/string.rb +3 -3
  14. data/lib/encryptor/version.rb +2 -2
  15. data/test/compatibility_test.rb +29 -25
  16. data/test/encryptor_string_test.rb +60 -0
  17. data/test/encryptor_test.rb +57 -65
  18. data/test/legacy_encryptor_string_test.rb +56 -0
  19. data/test/legacy_encryptor_test.rb +22 -63
  20. data/test/openssl_helper.rb +24 -4
  21. data/test/test_helper.rb +21 -12
  22. metadata +94 -39
  23. metadata.gz.sig +0 -0
checksums.yaml ADDED
@@ -0,0 +1,7 @@
1
+ ---
2
+ SHA1:
3
+ metadata.gz: dc166257be860dc17bd32f793762a69aa8d0bb17
4
+ data.tar.gz: 0229093567b3307695cb5cf2bdd12de1005cc32d
5
+ SHA512:
6
+ metadata.gz: 48dea5301f97036ce8198865090fb7ae13e8385ec1376332043a06ec25d9ae17dfb49d629fc962a193faa763f3cf9624252609b59149a3fba4fe6ead7230b7f1
7
+ data.tar.gz: 554b9fd4f471a8ef2131b0bce5c2fa843f0abe277f54bbe1a9d6c28e156aa56d0d23077be08c8f003a2d396f9c14347419bc41fc7026d6c2d9a46d8408977058
checksums.yaml.gz.sig ADDED
Binary file
data.tar.gz.sig ADDED
@@ -0,0 +1 @@
1
+ ��A�\D|��<�2bU� �PK���Ot#g'n7����˜���$Qu��zʎ%���W&�9ƶ�Ե�ϝv�0�m�0�HL(��PW�~sC�6e@
data/.gitignore ADDED
@@ -0,0 +1,5 @@
1
+ pkg
2
+ rdoc
3
+ .bundle
4
+ coverage
5
+ Gemfile.lock
data/.travis.yml ADDED
@@ -0,0 +1,19 @@
1
+ sudo: false
2
+ language: ruby
3
+ cache: bundler
4
+ matrix:
5
+ fast_finish: true
6
+ include:
7
+ - rvm: 2.0.0
8
+ - rvm: 2.1
9
+ - rvm: 2.2
10
+ - rvm: 2.3.0
11
+ - rvm: jruby
12
+ - rvm: rbx
13
+ allow_failures:
14
+ - rvm: jruby
15
+ exclude:
16
+ - rvm: 1.9.3
17
+ addons:
18
+ code_climate:
19
+ repo_token: 5dcb75d5b6c58e2a5f6dc850eb2c1d4e0dbf262e69981db00b765a66bfc9ef10
data/CHANGELOG.md ADDED
@@ -0,0 +1,24 @@
1
+ # Encryptor #
2
+
3
+ ## Unreleased ##
4
+
5
+ * Added support for MRI 2.1, 2.2, 2.3, and Rubinius. (@saghaulor)
6
+ * Added support for Authenticated Encryption Authentiation Data (AEAD) via aes-###-gcm. (@saghaulor)
7
+ * Changed the defaults to improve security, aes-256-gcm, IV is required. (@saghaulor)
8
+ * Added key and IV minimum length validations. (@saghaulor)
9
+ * Added insecure_mode option to allow for backwards compatibility for users who didn't use unique IV. (@saghaulor)
10
+ * Deprecated using Encryptor without an IV.
11
+ * Added hmac_iterations option to allow for adjusting the number of PKCS5 iterations when deriving a unique key. (@saghaulor)
12
+ * Removed support for MRI 1.9.3 and JRuby (until JRuby supports `auth_data=`, https://github.com/jruby/jruby/issues/3376). (@saghaulor)
13
+ * Changed tests to use Minitest. (@saghaulor)
14
+ * Changed syntax to use Ruby 1.9+ hash syntax. (@saghaulor)
15
+ * Salt may be deprecated in a future release, it remains for backwards compatibility. It's better security to have a unique key per record, however, the cost of PKCS5 is too high to force on to users by default. If users want a unique key per record they can implement it in their own way.
16
+
17
+ ## 1.3.0 ##
18
+
19
+ * Added support for unique key (via salt) and IV. (@danpal & @rcook)
20
+
21
+ ## 1.2.3 ##
22
+
23
+ * Added support for passing blocks to `encrypt` and `decrypt`. (@shuber)
24
+ * Changed raising an exception if key is missing or empty. (@shuber)
data/Gemfile ADDED
@@ -0,0 +1,3 @@
1
+ source 'https://rubygems.org'
2
+
3
+ gemspec
data/README.md CHANGED
@@ -1,8 +1,8 @@
1
- ## Encryptor [![Build Status](https://travis-ci.org/attr-encrypted/encryptor.png?branch=master)](https://travis-ci.org/attr-encrypted/encryptor)
1
+ # Encryptor
2
2
 
3
- A simple wrapper for the standard Ruby OpenSSL library
3
+ [![Build Status](https://secure.travis-ci.org/attr-encrypted/encryptor.svg)](https://travis-ci.org/attr-encrypted/encryptor) [![Code Climate](https://codeclimate.com/github/attr-encrypted/encryptor/badges/gpa.svg)](https://codeclimate.com/github/attr-encrypted/encryptor) [![Coverage](https://codeclimate.com/github/attr-encrypted/encryptor/badges/coverage.svg)](https://codeclimate.com/github/attr-encrypted/encryptor) [![Gem Version](https://badge.fury.io/rb/encryptor.svg)](http://badge.fury.io/rb/encryptor) [![security](https://hakiri.io/github/attr-encrypted/encryptor/master.svg)](https://hakiri.io/github/attr-encrypted/encryptor/master)
4
4
 
5
- Intended to be used by a future version of `http://github.com/shuber/attr_encrypted` to easily encrypt/decrypt attributes in any Ruby class or model.
5
+ A simple wrapper for the standard Ruby OpenSSL library
6
6
 
7
7
  ### Installation
8
8
 
@@ -14,104 +14,199 @@ gem install encryptor
14
14
 
15
15
  #### Basic
16
16
 
17
- Encryptor uses the AES-256-CBC algorithm by default to encrypt strings securely. You are strongly advised to use both an initialization vector (via the `:iv` option) and a salt (via the `:salt` option) to perform this encryption as securely as possible. Specifying only an `:iv` option without `:salt` is not recommended but is supported as part of a "compatibility mode" to support clients built using older versions of this gem.
17
+ Encryptor uses the AES-256-GCM algorithm by default to encrypt strings securely.
18
18
 
19
19
  The best example is:
20
20
 
21
21
  ```ruby
22
- salt = Time.now.to_i.to_s
23
- secret_key = 'secret'
24
- iv = OpenSSL::Cipher::Cipher.new('aes-256-cbc').random_iv
25
- encrypted_value = Encryptor.encrypt('some string to encrypt', :key => secret_key, :iv => iv, :salt => salt)
26
- decrypted_value = Encryptor.decrypt(encrypted_value, :key => secret_key, :iv => iv, :salt => salt)
22
+ cipher = OpenSSL::Cipher.new('aes-256-gcm')
23
+ cipher.encrypt # Required before '#random_key' or '#random_iv' can be called. http://ruby-doc.org/stdlib-2.0.0/libdoc/openssl/rdoc/OpenSSL/Cipher.html#method-i-encrypt
24
+ secret_key = cipher.random_key # Insures that the key is the correct length respective to the algorithm used.
25
+ iv = cipher.random_iv # Insures that the IV is the correct length respective to the algorithm used.
26
+ salt = SecureRandom.random_bytes(16)
27
+ encrypted_value = Encryptor.encrypt(value: 'some string to encrypt', key: secret_key, iv: iv, salt: salt)
28
+ decrypted_value = Encryptor.decrypt(value: encrypted_value, key: secret_key, iv: iv, salt: salt)
27
29
  ```
28
30
 
29
- The value to encrypt or decrypt may also be passed as the :value option if you'd prefer.
31
+ A slightly easier example is:
32
+
33
+ ```ruby
34
+ require 'securerandom'
35
+ secret_key = SecureRandom.random_bytes(32) # The length in bytes must be equal to or greater than the algorithm bit length.
36
+ iv = SecureRandom.random_bytes(12) # Recomended length for AES-###-GCM algorithm. https://tools.ietf.org/html/rfc5084#section-3.2
37
+ encrypted_value = Encryptor.encrypt(value: 'some string to encrypt', key: secret_key, iv: iv)
38
+ decrypted_value = Encryptor.decrypt(value: encrypted_value, key: secret_key, iv: iv)
39
+ ```
40
+
41
+ **NOTE: It is imperative that you use a unique IV per each string and encryption key combo; a nonce as the IV.**
42
+ See [RFC 5084](https://tools.ietf.org/html/rfc5084#section-1.5) for more details.
43
+
44
+ The value to encrypt or decrypt may also be passed as the first option if you'd prefer.
30
45
 
31
46
  ```ruby
32
- encrypted_value = Encryptor.encrypt(:value => 'some string to encrypt', :key => secret_key, :iv => iv, :salt => salt)
33
- decrypted_value = Encryptor.decrypt(:value => encrypted_value, :key => secret_key, :iv => iv, :salt => salt)
47
+ encrypted_value = Encryptor.encrypt('some string to encrypt', key: secret_key, iv: iv)
48
+ decrypted_value = Encryptor.decrypt(encrypted_value, key: secret_key, iv: iv)
34
49
  ```
35
50
 
36
- **You may also skip the salt and the IV if you like. Do so at your own risk!**
51
+ #### Options
52
+
53
+ **Defaults:**
37
54
 
38
55
  ```ruby
39
- encrypted_value = Encryptor.encrypt(:value => 'some string to encrypt', :key => 'secret')
40
- decrypted_value = Encryptor.decrypt(:value => encrypted_value, :key => 'secret')
56
+ { algorithm: 'aes-256-gcm',
57
+ auth_data: '',
58
+ insecure_mode: false,
59
+ hmac_iterations: 2000 }
41
60
  ```
42
61
 
43
- You may also pass an `:algorithm` option, though this is not required.
62
+ Older versions of Encryptor allowed you to use it in a less secure way. Namely, you were allowed to run Encryptor without an IV, or with a key of insufficient length. Encryptor now requires a key and IV of the correct length respective to the algorithm that you use. However, to maintain backwards compatibility you can run Encryptor with the `:insecure_mode` option.
63
+
64
+ You may also pass an `:algorithm`,`:salt`, and `hmac_iterations` option, however none of these options are required. If you pass the `:salt` option, a new unique key will be derived from the key that you passed in using PKCS5 with a default of 2000 iterations. You can change the number of PKCS5 iterations with the `hmac_iterations` option. As PKCS5 is slow, it is optional behavior, but it does provide more security to use a unique IV and key for every encryption operation.
44
65
 
45
66
  ```ruby
46
- Encryptor.default_options.merge!(:algorithm => 'aes-128-cbc', :key => 'some default secret key', :iv => iv, :salt => salt)
67
+ Encryptor.default_options.merge!(algorithm: 'aes-256-cbc', key: 'some default secret key', iv: iv, salt: salt)
47
68
  ```
48
69
 
49
70
  #### Strings
50
71
 
51
- Encryptor adds `encrypt` and `decrypt` methods to `String` objects for your convenience. These two methods accept the same arguments as the associated ones in the `Encryptor` module. They're nice when you set the default options in the `Encryptor.default_options attribute.` For example:
72
+ Older versions of Encryptor added `encrypt` and `decrypt` methods to `String` objects for your convenience. However, this behavior has been removed to avoid polluting Ruby's core `String` class. The `Encryptor::String` module remains within this gem to allow users of this feature to implement it themselves. These `encrypt` and `decrypt` methods accept the same arguments as the associated ones in the `Encryptor` module. They're nice when you set the default options in the `Encryptor.default_options attribute.` For example:
52
73
 
53
74
  ```ruby
54
- Encryptor.default_options.merge!(:key => 'some default secret key', :iv => iv, :salt => salt)
75
+ require 'encryptor/string'
76
+ String.include Encryptor::String
77
+ Encryptor.default_options.merge!(key: 'some default secret key', iv: iv)
55
78
  credit_card = 'xxxx xxxx xxxx 1234'
56
79
  encrypted_credit_card = credit_card.encrypt
57
80
  ```
58
81
 
59
82
  There's also `encrypt!` and `decrypt!` methods that replace the contents of a string with the encrypted or decrypted version of itself.
60
83
 
61
- ### Algorithms
62
-
63
- Run `openssl list-cipher-commands` in your terminal to view a list of all cipher algorithms that are supported on your platform. Typically, this will include the following:
64
-
65
- aes-128-cbc
66
- aes-128-ecb
67
- aes-192-cbc
68
- aes-192-ecb
69
- aes-256-cbc
70
- aes-256-ecb
71
- bf
72
- bf-cbc
73
- bf-cfb
74
- bf-ecb
75
- bf-ofb
76
- cast
77
- cast-cbc
78
- cast5-cbc
79
- cast5-cfb
80
- cast5-ecb
81
- cast5-ofb
82
- des
83
- des-cbc
84
- des-cfb
85
- des-ecb
86
- des-ede
87
- des-ede-cbc
88
- des-ede-cfb
89
- des-ede-ofb
90
- des-ede3
91
- des-ede3-cbc
92
- des-ede3-cfb
93
- des-ede3-ofb
94
- des-ofb
95
- des3
96
- desx
97
- idea
98
- idea-cbc
99
- idea-cfb
100
- idea-ecb
101
- idea-ofb
102
- rc2
103
- rc2-40-cbc
104
- rc2-64-cbc
105
- rc2-cbc
106
- rc2-cfb
107
- rc2-ecb
108
- rc2-ofb
109
- rc4
110
- rc4-40
111
-
112
- Note that some ciphers may not be supported by Ruby.
113
-
114
- ### Notes on patches/pull requests
84
+ #### Algorithms
85
+
86
+ To view a list of all cipher algorithms that are supported on your platform, run the following code in your favorite Ruby REPL:
87
+
88
+ ```ruby
89
+ require 'openssl'
90
+ puts OpenSSL::Cipher.ciphers
91
+ ```
92
+
93
+ The supported ciphers will vary depending on the version of OpenSSL that was used to compile your version of Ruby. However, the following ciphers are typically supported:
94
+
95
+ Cipher Name|Key size in bytes|IV size in bytes
96
+ ---|---|---
97
+ aes-128-cbc|16|16
98
+ aes-128-cbc-hmac-sha1|16|16
99
+ aes-128-cbc-hmac-sha256|16|16
100
+ aes-128-ccm|16|12
101
+ aes-128-cfb|16|16
102
+ aes-128-cfb1|16|16
103
+ aes-128-cfb8|16|16
104
+ aes-128-ctr|16|16
105
+ aes-128-ecb|16|0
106
+ aes-128-gcm|16|12
107
+ aes-128-ofb|16|16
108
+ aes-128-xts|32|16
109
+ aes-192-cbc|24|16
110
+ aes-192-ccm|24|12
111
+ aes-192-cfb|24|16
112
+ aes-192-cfb1|24|16
113
+ aes-192-cfb8|24|16
114
+ aes-192-ctr|24|16
115
+ aes-192-ecb|24|0
116
+ aes-192-gcm|24|12
117
+ aes-192-ofb|24|16
118
+ aes-256-cbc|32|16
119
+ aes-256-cbc-hmac-sha1|32|16
120
+ aes-256-cbc-hmac-sha256|32|16
121
+ aes-256-ccm|32|12
122
+ aes-256-cfb|32|16
123
+ aes-256-cfb1|32|16
124
+ aes-256-cfb8|32|16
125
+ aes-256-ctr|32|16
126
+ aes-256-ecb|32|0
127
+ aes-256-gcm|32|12
128
+ aes-256-ofb|32|16
129
+ aes-256-xts|64|16
130
+ aes128|16|16
131
+ aes192|24|16
132
+ aes256|32|16
133
+ bf|16|8
134
+ bf-cbc|16|8
135
+ bf-cfb|16|8
136
+ bf-ecb|16|0
137
+ bf-ofb|16|8
138
+ blowfish|16|8
139
+ camellia-128-cbc|16|16
140
+ camellia-128-cfb|16|16
141
+ camellia-128-cfb1|16|16
142
+ camellia-128-cfb8|16|16
143
+ camellia-128-ecb|16|0
144
+ camellia-128-ofb|16|16
145
+ camellia-192-cbc|24|16
146
+ camellia-192-cfb|24|16
147
+ camellia-192-cfb1|24|16
148
+ camellia-192-cfb8|24|16
149
+ camellia-192-ecb|24|0
150
+ camellia-192-ofb|24|16
151
+ camellia-256-cbc|32|16
152
+ camellia-256-cfb|32|16
153
+ camellia-256-cfb1|32|16
154
+ camellia-256-cfb8|32|16
155
+ camellia-256-ecb|32|0
156
+ camellia-256-ofb|32|16
157
+ camellia128|16|16
158
+ camellia192|24|16
159
+ camellia256|32|16
160
+ cast|16|8
161
+ cast-cbc|16|8
162
+ cast5-cbc|16|8
163
+ cast5-cfb|16|8
164
+ cast5-ecb|16|0
165
+ cast5-ofb|16|8
166
+ des|8|8
167
+ des-cbc|8|8
168
+ des-cfb|8|8
169
+ des-cfb1|8|8
170
+ des-cfb8|8|8
171
+ des-ecb|8|0
172
+ des-ede|16|0
173
+ des-ede-cbc|16|8
174
+ des-ede-cfb|16|8
175
+ des-ede-ofb|16|8
176
+ des-ede3|24|0
177
+ des-ede3-cbc|24|8
178
+ des-ede3-cfb|24|8
179
+ des-ede3-cfb1|24|8
180
+ des-ede3-cfb8|24|8
181
+ des-ede3-ofb|24|8
182
+ des-ofb|8|8
183
+ des3|24|8
184
+ desx|24|8
185
+ desx-cbc|24|8
186
+ idea|16|8
187
+ idea-cbc|16|8
188
+ idea-cfb|16|8
189
+ idea-ecb|16|0
190
+ idea-ofb|16|8
191
+ rc2|16|8
192
+ rc2-40-cbc|5|8
193
+ rc2-64-cbc|8|8
194
+ rc2-cbc|16|8
195
+ rc2-cfb|16|8
196
+ rc2-ecb|16|0
197
+ rc2-ofb|16|8
198
+ rc4|16|0
199
+ rc4-40|5|0
200
+ rc4-hmac-md5|16|0
201
+ seed|16|16
202
+ seed-cbc|16|16
203
+ seed-cfb|16|16
204
+ seed-ecb|16|0
205
+ seed-ofb|16|16
206
+
207
+ **NOTE: Some ciphers may not be supported by Ruby. Additionally, Ruby compiled with OpenSSL >= v1.0.1 will include AEAD ciphers, ie., aes-256-gcm.**
208
+
209
+ #### Notes on patches/pull requests
115
210
 
116
211
  * Fork the project.
117
212
  * Make your feature addition or bug fix.
data/Rakefile CHANGED
@@ -1,6 +1,8 @@
1
1
  require 'rake'
2
2
  require 'rake/testtask'
3
- require 'rake/rdoctask'
3
+ require 'rdoc/task'
4
+ require "bundler/gem_tasks"
5
+
4
6
 
5
7
  desc 'Test the encryptor gem'
6
8
  Rake::TestTask.new(:test) do |t|
@@ -18,16 +20,5 @@ Rake::RDocTask.new(:rdoc) do |rdoc|
18
20
  rdoc.rdoc_files.include('lib/**/*.rb')
19
21
  end
20
22
 
21
- if RUBY_VERSION < '1.9.3'
22
- require 'rcov/rcovtask'
23
-
24
- task :rcov do
25
- system "rcov -o coverage/rcov --exclude '^(?!lib)' " + FileList[ 'test/**/*_test.rb' ].join(' ')
26
- end
27
-
28
- desc 'Default: run unit tests under rcov.'
29
- task :default => :rcov
30
- else
31
- desc 'Default: run unit tests.'
32
- task :default => :test
33
- end
23
+ desc 'Default: run unit tests.'
24
+ task default: :test
data/certs/saghaulor.pem ADDED
@@ -0,0 +1,21 @@
1
+ -----BEGIN CERTIFICATE-----
2
+ MIIDdDCCAlygAwIBAgIBATANBgkqhkiG9w0BAQUFADBAMRIwEAYDVQQDDAlzYWdo
3
+ YXVsb3IxFTATBgoJkiaJk/IsZAEZFgVnbWFpbDETMBEGCgmSJomT8ixkARkWA2Nv
4
+ bTAeFw0xNjAxMTEyMjQyMDFaFw0xNzAxMTAyMjQyMDFaMEAxEjAQBgNVBAMMCXNh
5
+ Z2hhdWxvcjEVMBMGCgmSJomT8ixkARkWBWdtYWlsMRMwEQYKCZImiZPyLGQBGRYD
6
+ Y29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAx0xdQYk2GwCpQ1n/
7
+ n2mPVYHLYqU5TAn/82t5kbqBUWjbcj8tHAi41tJ19+fT/hH0dog8JHvho1zmOr71
8
+ ZIqreJQo60TqP6oE9a5HncUpjqbRp7tOmHo9E+mOW1yT4NiXqFf1YINExQKy2XND
9
+ WPQ+T50ZNUsGMfHFWB4NAymejRWXlOEY3bvKW0UHFeNmouP5he51TjoP8uCc9536
10
+ 4AIWVP/zzzjwrFtC7av7nRw4Y+gX2bQjrkK2k2JS0ejiGzKBIEMJejcI2B+t79zT
11
+ kUQq9SFwp2BrKSIy+4kh4CiF20RT/Hfc1MbvTxSIl/bbIxCYEOhmtHExHi0CoCWs
12
+ YCGCXQIDAQABo3kwdzAJBgNVHRMEAjAAMAsGA1UdDwQEAwIEsDAdBgNVHQ4EFgQU
13
+ SCpVzSBvYbO6B3oT3n3RCZmurG8wHgYDVR0RBBcwFYETc2FnaGF1bG9yQGdtYWls
14
+ LmNvbTAeBgNVHRIEFzAVgRNzYWdoYXVsb3JAZ21haWwuY29tMA0GCSqGSIb3DQEB
15
+ BQUAA4IBAQAeiGdC3e0WiZpm0cF/b7JC6hJYXC9Yv9VsRAWD9ROsLjFKwOhmonnc
16
+ +l/QrmoTjMakYXBCai/Ca3L+k5eRrKilgyITILsmmFxK8sqPJXUw2Jmwk/dAky6x
17
+ hHKVZAofT1OrOOPJ2USoZyhR/VI8epLaD5wUmkVDNqtZWviW+dtRa55aPYjRw5Pj
18
+ wuj9nybhZr+BbEbmZE//2nbfkM4hCuMtxxxilPrJ22aYNmeWU0wsPpDyhPYxOUgU
19
+ ZjeLmnSDiwL6doiP5IiwALH/dcHU67ck3NGf6XyqNwQrrmtPY0mv1WVVL4Uh+vYE
20
+ kHoFzE2no0BfBg78Re8fY69P5yES5ncC
21
+ -----END CERTIFICATE-----
data/encryptor.gemspec ADDED
@@ -0,0 +1,41 @@
1
+ # -*- encoding: utf-8 -*-
2
+
3
+ lib = File.expand_path('../lib/', __FILE__)
4
+ $:.unshift lib unless $:.include?(lib)
5
+
6
+ require 'encryptor/version'
7
+ require 'date'
8
+
9
+ Gem::Specification.new do |s|
10
+ s.name = 'encryptor'
11
+ s.version = Encryptor::Version
12
+ s.date = Date.today
13
+ s.platform = Gem::Platform::RUBY
14
+
15
+ s.summary = 'A simple wrapper for the standard ruby OpenSSL library'
16
+ s.description = 'A simple wrapper for the standard ruby OpenSSL library to encrypt and decrypt strings'
17
+
18
+ s.authors = ['Sean Huber', 'S. Brent Faulkner', 'William Monk', 'Stephen Aghaulor']
19
+ s.email = ['sean@shuber.io', 'sbfaulkner@gmail.com', 'billy.monk@gmail.com', 'saghaulor@gmail.com']
20
+ s.homepage = 'http://github.com/attr-encrypted/encryptor'
21
+ s.license = 'MIT'
22
+ s.rdoc_options = %w(--charset=UTF-8 --inline-source --line-numbers --main README.md)
23
+
24
+ s.require_paths = ['lib']
25
+
26
+ s.files = `git ls-files`.split("\n")
27
+ s.test_files = `git ls-files -- test/*`.split("\n")
28
+
29
+ s.required_ruby_version = '>= 2.0.0'
30
+
31
+ s.add_development_dependency('minitest', '>= 0')
32
+ s.add_development_dependency('rake', '>= 0')
33
+ s.add_development_dependency('simplecov', '>= 0')
34
+ s.add_development_dependency('simplecov-rcov', '>= 0')
35
+ s.add_development_dependency('codeclimate-test-reporter', '>= 0')
36
+
37
+ s.requirements << 'openssl, >= v1.0.1'
38
+
39
+ s.cert_chain = ['certs/saghaulor.pem']
40
+ s.signing_key = File.expand_path("~/.ssh/gem-private_key.pem") if $0 =~ /gem\z/
41
+ end
data/lib/encryptor.rb CHANGED
@@ -1,45 +1,48 @@
1
1
  require 'openssl'
2
- require 'encryptor/string'
3
-
4
- String.send(:include, Encryptor::String)
2
+ require 'encryptor/version'
5
3
 
6
4
  # A simple wrapper for the standard OpenSSL library
7
5
  module Encryptor
8
- autoload :Version, 'encryptor/version'
9
6
 
10
7
  extend self
11
8
 
12
9
  # The default options to use when calling the <tt>encrypt</tt> and <tt>decrypt</tt> methods
13
10
  #
14
- # Defaults to { :algorithm => 'aes-256-cbc' }
11
+ # Defaults to { algorithm: 'aes-256-gcm',
12
+ # auth_data: '',
13
+ # insecure_mode: false,
14
+ # hmac_iterations: 2000 }
15
15
  #
16
16
  # Run 'openssl list-cipher-commands' in your terminal to view a list all cipher algorithms that are supported on your platform
17
17
  def default_options
18
- @default_options ||= { :algorithm => 'aes-256-cbc' }
18
+ @default_options ||= { algorithm: 'aes-256-gcm',
19
+ auth_data: '',
20
+ insecure_mode: false,
21
+ hmac_iterations: 2000 }
19
22
  end
20
23
 
21
- # Encrypts a <tt>:value</tt> with a specified <tt>:key</tt>
24
+ # Encrypts a <tt>:value</tt> with a specified <tt>:key</tt> and <tt>:iv</tt>.
22
25
  #
23
- # Optionally accepts <tt>:iv</tt> and <tt>:algorithm</tt> options
26
+ # Optionally accepts <tt>:salt</tt>, <tt>:auth_data</tt>, <tt>:algorithm</tt>, <tt>:hmac_iterations</tt>, and <tt>:insecure_mode</tt> options.
24
27
  #
25
28
  # Example
26
29
  #
27
- # encrypted_value = Encryptor.encrypt(:value => 'some string to encrypt', :key => 'some secret key')
30
+ # encrypted_value = Encryptor.encrypt(value: 'some string to encrypt', key: 'some secret key', iv: 'some unique value', salt: 'another unique value')
28
31
  # # or
29
- # encrypted_value = Encryptor.encrypt('some string to encrypt', :key => 'some secret key')
32
+ # encrypted_value = Encryptor.encrypt('some string to encrypt', key: 'some secret key', iv: 'some unique value', salt: 'another unique value')
30
33
  def encrypt(*args, &block)
31
34
  crypt :encrypt, *args, &block
32
35
  end
33
36
 
34
- # Decrypts a <tt>:value</tt> with a specified <tt>:key</tt>
37
+ # Decrypts a <tt>:value</tt> with a specified <tt>:key</tt> and <tt>:iv</tt>.
35
38
  #
36
- # Optionally accepts <tt>:iv</tt> and <tt>:algorithm</tt> options
39
+ # Optionally accepts <tt>:salt</tt>, <tt>:auth_data</tt>, <tt>:algorithm</tt>, <tt>:hmac_iterations</tt>, and <tt>:insecure_mode</tt> options.
37
40
  #
38
41
  # Example
39
42
  #
40
- # decrypted_value = Encryptor.decrypt(:value => 'some encrypted string', :key => 'some secret key')
43
+ # decrypted_value = Encryptor.decrypt(value: 'some encrypted string', key: 'some secret key', iv: 'some unique value', salt: 'another unique value')
41
44
  # # or
42
- # decrypted_value = Encryptor.decrypt('some encrypted string', :key => 'some secret key')
45
+ # decrypted_value = Encryptor.decrypt('some encrypted string', key: 'some secret key', iv: 'some unique value', salt: 'another unique value')
43
46
  def decrypt(*args, &block)
44
47
  crypt :decrypt, *args, &block
45
48
  end
@@ -47,10 +50,15 @@ module Encryptor
47
50
  protected
48
51
 
49
52
  def crypt(cipher_method, *args) #:nodoc:
50
- options = default_options.merge(:value => args.first).merge(args.last.is_a?(Hash) ? args.last : {})
51
- raise ArgumentError.new('must specify a :key') if options[:key].to_s.empty?
52
- cipher = OpenSSL::Cipher::Cipher.new(options[:algorithm])
53
+ options = default_options.merge(value: args.first).merge(args.last.is_a?(Hash) ? args.last : {})
54
+ raise ArgumentError.new('must specify a key') if options[:key].to_s.empty?
55
+ cipher = OpenSSL::Cipher.new(options[:algorithm])
53
56
  cipher.send(cipher_method)
57
+ unless options[:insecure_mode]
58
+ raise ArgumentError.new("key must be #{cipher.key_len} bytes or longer") if options[:key].bytesize < cipher.key_len
59
+ raise ArgumentError.new('must specify an iv') if options[:iv].to_s.empty?
60
+ raise ArgumentError.new("iv must be #{cipher.iv_len} bytes or longer") if options[:iv].bytesize < cipher.iv_len
61
+ end
54
62
  if options[:iv]
55
63
  cipher.iv = options[:iv]
56
64
  if options[:salt].nil?
@@ -63,13 +71,40 @@ module Encryptor
63
71
  # Use an explicit salt (which can be persisted into a database on a
64
72
  # per-column basis, for example). This is the preferred (and more
65
73
  # secure) mode of operation.
66
- cipher.key = OpenSSL::PKCS5.pbkdf2_hmac_sha1(options[:key], options[:salt], 2000, cipher.key_len)
74
+ cipher.key = OpenSSL::PKCS5.pbkdf2_hmac_sha1(options[:key], options[:salt], options[:hmac_iterations], cipher.key_len)
67
75
  end
68
76
  else
77
+ # This is deprecated and needs to be changed.
69
78
  cipher.pkcs5_keyivgen(options[:key])
70
79
  end
71
80
  yield cipher, options if block_given?
72
- result = cipher.update(options[:value])
81
+ value = options[:value]
82
+ if cipher.authenticated?
83
+ if encryption?(cipher_method)
84
+ cipher.auth_data = options[:auth_data]
85
+ else
86
+ value = extract_cipher_text(options[:value])
87
+ cipher.auth_tag = extract_auth_tag(options[:value])
88
+ # auth_data must be set after auth_tag has been set when decrypting
89
+ # See http://ruby-doc.org/stdlib-2.0.0/libdoc/openssl/rdoc/OpenSSL/Cipher.html#method-i-auth_data-3D
90
+ cipher.auth_data = options[:auth_data]
91
+ end
92
+ end
93
+ result = cipher.update(value)
73
94
  result << cipher.final
95
+ result << cipher.auth_tag if cipher.authenticated? && encryption?(cipher_method)
96
+ result
97
+ end
98
+
99
+ def encryption?(cipher_method)
100
+ cipher_method == :encrypt
101
+ end
102
+
103
+ def extract_cipher_text(value)
104
+ value[0..-17]
105
+ end
106
+
107
+ def extract_auth_tag(value)
108
+ value[-16..-1]
74
109
  end
75
110
  end