epithet 0.1.0 → 1.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c8d4c22a2ee0f83df400b54761a8e5c0a03df04390c6c9cdbb486a8c907f1812
-  data.tar.gz: a8507f28f992f524284262d498b107cfb566f9fefb66c5d97e2f29322d7a9fe4
+  metadata.gz: 100d3ac2b640a77419d9d6f45228ed67251285ed6f0bf390b9249573d20db887
+  data.tar.gz: 5350064afb6799feec528888c475bcc0d8e403272f13332d00bdcd43b7bcd47c
 SHA512:
-  metadata.gz: bc64b08e053da076bab07709bed61f1ff0c41ebcdb59a3963f63b7846b897efa2b8a2de43330b8bb0a3d7b473d377dc676da2ef4331ebcd52d18749809b8b1c3
-  data.tar.gz: 8495ae0d1ed045619ed752ef55cc240ff5180b6da68bf27f2cc858e6ec1a190eb93e10c5dc1e23665a363ee42448dc1df6d23f3522ab03813f6d2f48da322b44
+  metadata.gz: 77e5c3acde924854471a36ede3d43e010fcf4f2bd7f4a49b75c753e7c80e4c0651355c0c33ec28a9d1c229abf14fd5da61b40c1eae2a23cbd31f8c8ef94cd9a5
+  data.tar.gz: 21a8c95376177e30642bed7aefd1b1f87ccd5f0a00d489592c154ed1ecf86cdf076df57f04f98d01ad802b4ea1c62367b5afcc0fdd165501f95fe081ac10efd9

data/CHANGELOG.md

@@ -1,4 +1,31 @@
 # Changelog
 
+## 1.1.0 - 2026-07-14
+
+- Freeze config strings upon object initialization
+- Merge custom scrypt params
+- Block58 now defaults to a generic s2i that handles any block size
+- Optimised 16-byte unrolled s2i selected via `Block58::build`
+- Recognize unprefixed decodes by payload length
+- Fix github CI warnings
+- Write notes on salt & improve examples
+
+## 1.0.0 - 2026-07-14
+
+### Breaking changes
+
+- Treat out-of-range base58 strings as invalid instead of wrapping them.
+- Reject separators that share codepoints with the encoding alphabet.
+- Drop support for Rubies < 3.3.
+
+### Other changes
+
+- Code style nitpicks.
+- Support for 32-bit Rubies.
+- Support for Ruby 4.0.
+- Documentation improvements.
+- A custom alphabet may be configured via `Epithet::Config`.
+- Custom alphabets must be strictly ascending byte codepoints.
+
 ## 0.1.0 - 2025-12-22
 - Initial release.

data/README.md

@@ -21,12 +21,14 @@ gem install epithet
 
 ## Usage
 
+With `EPITHET_PASSPHRASE="example only"`:
+
 ```ruby
 require 'epithet'
 
 def epithet_initialize
   Epithet.configure(
-    passphrase: ENV.fetch('EPITHET_PASSPHRASE') { 'example only' },
+    passphrase: ENV.fetch('EPITHET_PASSPHRASE'),
     salt: 'v1'
   )
 end

data/SECURITY.md

@@ -2,40 +2,52 @@
 
 ## Cryptographic considerations
 
-The primary construction is `AES-256-ECB(id(8B) + HMAC-SHA256(id)[0,7])` with the result
-base58 encoded for transmission and a contextual prefix prepended. Subkeys for AES and
-HMAC are by default derived with HKDF using an internal key generator that takes IKM from
-a passphrase via scrypt, salting generated keys by prefix and purpose.
-
-This library is intended for high-performance obfuscation of integer sequences, deflection
-of casual tampering, and conversion to a compact, stable wire parameter format.  Although
-it uses standard cryptographic primitives to do so, the design trade-off of the compact
-format means it is not intended to defeat nation-state security services, talented
+The primary construction is `AES-256-ECB(id(8B) + HMAC-SHA256(id)[0,7])` with the result base58
+encoded for transmission and a contextual prefix prepended. Subkeys for AES and HMAC are by default
+derived with HKDF using an internal key generator that takes IKM from a passphrase via scrypt,
+salting generated keys by prefix and purpose.
+
+This library is intended for high-performance obfuscation of integer sequences, deflection of casual
+tampering, and conversion to a compact, stable wire parameter format that is hard to guess and hard
+to predict.  Although it uses standard cryptographic primitives to do so, the design trade-off of
+the compact format means it is not intended to defeat nation-state security services, talented
 cryptographers, or even a well-resourced enterprise.
 
-The identifiers produced are intentionally deterministic i.e. replayable and reusable. For
-privacy, confidentiality, and authentication purposes they should therefore be considered
-equivalent to the plaintext integer they represent, and those purposes must still be addressed
-in the usual manner.
+The identifiers produced are intentionally deterministic i.e. replayable and reusable. For privacy,
+confidentiality, and authentication purposes they should therefore be considered equivalent to the
+plaintext integer they represent, and those concerns must still be addressed in the usual manner.
 
 The tamper detection is necessarily probabilistic, because the MAC is truncated.
 
-If configuring alternative cipher and digest algorithms, note that only 128-bit block
-ciphers that function without IV/nonce requirements are accepted. Streaming ciphers
-(e.g. chacha20) or block ciphers in streaming modes (e.g. aes-256-ctr) must not be used;
-no nonce/IV value is included in construction, making them trivially vulnerable to
-known-plaintext attacks. These, CBC/OCB, and other IV/nonce modes may also be rejected
-by Epithet's guardrails.
+Encodings are canonical, producing exactly one string per id, and Epithet will reject attempts to
+decode a value exceeding the 128-bit block.
 
-A weak, guessable, or disclosed passphrase will compromise the obfuscation and
-tamper-detection properties.
+If configuring alternative cipher algorithms, note that only 128-bit block ciphers that function
+without IV/nonce requirements are accepted. Streaming ciphers (e.g. chacha20) or block ciphers in
+streaming modes (e.g. aes-256-ctr) must not be used; no nonce/IV value is included in construction,
+making them trivially vulnerable to known-plaintext attacks.  These, CBC/OCB, and other IV/nonce
+modes may also be rejected by Epithet's guardrails.
+
+If configuring alternative digest algorithms, note that any algorithm may be accepted whenever they
+it produces at least 64 bits of output. HMAC does not rest on collision resistance, so even dated
+digests are not trivially forgeable here, but algorithms other than the defaults step outside the
+supported security profile.  If you must stray, stay within the SHA-2 family.
+
+A weak, guessable, or disclosed passphrase will compromise the obfuscation and tamper-detection
+properties.
 
 Use Epithet at your own risk.
 
+## On salt
+
+Epithet uses salt in two ways.  Firstly, as part of a scrypt operation to turn the configured
+passphrase into initial keying material.  Secondly, to supply an additional affordance to separate
+derived subkeys by some application-specific division such as purpose or rotation epoch.  Epithet
+does not store or verify passwords; both uses of salt are non-secret configuration and may safely be
+committed to source control.
+
 ## Vulnerabilities
 
 If you think you've found a vulnerability in Epithet that compromises its design or behaviour, please
 [report it via a private advisory](https://github.com/inopinatus/epithet/security/advisories/new).
 Do not open a public issue or pull request.
-
-

data/examples/basic.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'epithet'
 
 def epithet_initialize

data/lib/epithet/version.rb

@@ -1,4 +1,6 @@
+# frozen_string_literal: true
+
 class Epithet
-  # `= "0.1.0"`
-  VERSION = "0.1.0"
+  # `= '1.1.0'`
+  VERSION = '1.1.0'
 end

data/lib/epithet.rb

@@ -13,6 +13,8 @@ require 'openssl'
 # Pseudo-AEAD is via `AES-256-ECB(id(8B) + HMAC-SHA256(id)[0,7])` with the result
 # base58 encoded for transmission and the contextual prefix prepended.
 #
+# Encodings are canonical; a given configuration accepts exactly one string per id.
+#
 # Subkeys for AES and HMAC are by default derived with HKDF using an internal key
 # generator that takes IKM from a passphrase via scrypt.  An alternative key generator
 # may be injected via Config objects. Subkeys are salted by prefix and an optional
@@ -43,14 +45,14 @@ class Epithet
   #
   def initialize(prefix, config: Epithet.defaults)
     prefix = String(prefix)
-    key_salt = [prefix.bytesize, prefix, config.salt.bytesize, config.salt].pack("Q>Z*Q>Z*")
-    @block58 = Block58.new(16)
+    key_salt = [prefix.bytesize, prefix, config.salt.bytesize, config.salt].pack('Q>Z*Q>Z*')
+    @block58 = Block58.build(16, alphabet: config.alphabet)
     @prefix_s = "#{prefix}#{config.separator}"
 
     cipher_key_len = OpenSSL::Cipher.new(config.cipher).key_len
     digest_key_len = OpenSSL::Digest.new(config.digest).block_length
-    cipher_key = config.keygen.generate("epithet:ecb", key_salt, cipher_key_len)
-    digest_key = config.keygen.generate("epithet:mac", key_salt, digest_key_len)
+    cipher_key = config.keygen.generate('epithet:ecb', key_salt, cipher_key_len)
+    digest_key = config.keygen.generate('epithet:mac', key_salt, digest_key_len)
 
     @encryptor = OpenSSL::Cipher.new(config.cipher).encrypt.tap { |c| c.key = cipher_key; c.padding = 0 }
     @decryptor = OpenSSL::Cipher.new(config.cipher).decrypt.tap { |c| c.key = cipher_key; c.padding = 0 }
@@ -60,7 +62,7 @@ class Epithet
   # Encode a 64-bit unsigned Integer to a prefixed Base58 string.
   # Raises ArgumentError on invalid values.
   def encode(id)
-    raise ArgumentError, "not a 64-bit unsigned integer" unless Integer === id && id.size == 8 && id >= 0
+    raise ArgumentError, 'not a 64-bit unsigned integer' unless Integer === id && id.bit_length <= 64 && id >= 0
 
     e = @encryptor.dup
     h = @hmac.dup
@@ -72,13 +74,14 @@ class Epithet
     @prefix_s + @block58.i2s(ct)
   end
 
-  # Decode a prefixed or raw Base58 string to an Integer.
+  # Decode a prefixed or raw Base58 string to an Integer. Raw inputs are
+  # recognised by their exact payload length.
   #
   # Returns the Integer on success, nil if authentication fails.
-  # Raises ArgumentError on invalid formats.
+  # Raises ArgumentError on invalid wire format (see Block58#valid?).
   def decode(s)
-    s = s.delete_prefix(@prefix_s)
-    raise ArgumentError, "unexpected format" unless @block58.valid?(s)
+    s = s.delete_prefix(@prefix_s) unless s.bytesize == @block58.size
+    raise ArgumentError, 'unexpected format' unless @block58.valid?(s)
 
     d = @decryptor.dup
     h = @hmac.dup
@@ -102,7 +105,10 @@ class Epithet
     # #### Examples
     #
     #     # As it might appear in an initializer
-    #     Epithet.configure(passphrase: ENV.fetch('EPITHET_PASSPHRASE'))
+    #     Epithet.configure(
+    #       passphrase: ENV.fetch('EPITHET_PASSPHRASE'),
+    #       scrypt: { salt: "#{MyApp.name}/#{MyApp.env}" }
+    #     )
     #
     #     # Retaining already-configured passphrase but updating salt,
     #     # and using a custom separator.
@@ -115,11 +121,13 @@ class Epithet
     # #### Options
     #
     # *   `:passphrase` - Install new key generator with scrypt-derived key material
-    # *   `:scrypt` - Params for scrypt; omit to use `Keygen::DEFAULT_SCRYPT_PARAMS`
+    # *   `:scrypt` - Params for scrypt, merged over `Keygen::DEFAULT_SCRYPT_PARAMS`
     # *   `:keygen` - Install an existing key generator
     # *   `:cipher` - Must be a 128-bit block cipher in ECB mode or equivalent; omit for standard `aes-256-ecb`
     # *   `:digest` - Must be >= 64 bits; omit for standard `sha256`
-    # *   `:separator` - Inserted as string between the prefix and the generated param. may be nil; omit for underscore.
+    # *   `:separator` - String inserted between the prefix and the generated param; omit for standard `_`.
+    #                    May be `nil`. Must not share bytes with the alphabet.
+    # *   `:alphabet` - Alphabet for the wire encoding; must be 58 strictly ascending bytes; omit for `Block58::Alphabet`.
     # *   `:salt` - If supplied, stringified form is included in subkey derivation
     #
     # At minimum, one of `passphrase:` or `keygen:` is required.
@@ -149,20 +157,23 @@ class Epithet
     #     acct_epithet = Epithet.new('acct', config: cfg)
     #
     def configure(opts) = @defaults = Config === opts ? opts : Config.new(opts)
-    def defaults() = @defaults || raise(RuntimeError, "no Epithet defaults configured")
+    def defaults() = @defaults || raise('no Epithet defaults configured')
   end
 
   # Class for passing around preset configs. See Epithet::configure for options.
   class Config
-    attr_reader :keygen, :salt, :separator, :cipher, :digest # :nodoc:
+    attr_reader :keygen, :salt, :separator, :alphabet, :cipher, :digest # :nodoc:
+
     def initialize(opts = {})
       opts = opts.dup
-      @separator = String(opts.delete(:separator) { '_' })
-      @salt = String(opts.delete(:salt))
-      @cipher = opts.delete(:cipher) || 'aes-256-ecb'
-      @digest = opts.delete(:digest) || 'sha256'
+      @separator = -String(opts.delete(:separator) { '_' })
+      @salt = -String(opts.delete(:salt))
+      @alphabet = -String(opts.delete(:alphabet) { Block58::Alphabet })
+      @cipher = -(opts.delete(:cipher) || 'aes-256-ecb')
+      @digest = -(opts.delete(:digest) || 'sha256')
 
       cipher = OpenSSL::Cipher.new(@cipher)
+      raise ArgumentError, 'separator intersects alphabet' if @separator.bytes.intersect?(@alphabet.bytes)
       raise ArgumentError, "#{@cipher} not a 128-bit block cipher" if cipher.block_size != 16
       raise ArgumentError, "#{@cipher} requires an IV/nonce" if cipher.iv_len != 0
       raise ArgumentError, "#{@digest} produces < 64-bit digest" if OpenSSL::Digest.new(@digest).digest_length < 8
@@ -170,8 +181,9 @@ class Epithet
       @keygen = opts.delete(:keygen) || Keygen.new(
         passphrase: opts.delete(:passphrase),
         digest: @digest,
-        scrypt: opts.delete(:scrypt) || Keygen::DEFAULT_SCRYPT_PARAMS)
+        scrypt: opts.delete(:scrypt) || {})
       raise ArgumentError, "unused option(s) #{opts.keys}" unless opts.empty?
+      freeze
     end
   end
 
@@ -182,7 +194,7 @@ class Epithet
     # ```ruby
     # DEFAULT_SCRYPT_PARAMS = {
     #   salt: 'epithet-default',
-    #   N: 1<<17,
+    #   N: 1 << 17,
     #   r: 8,
     #   p: 1,
     #   length: 32
@@ -190,20 +202,22 @@ class Epithet
     # ```
     DEFAULT_SCRYPT_PARAMS = {
       salt: 'epithet-default',
-      N: 1<<17,
+      N: 1 << 17,
       r: 8,
       p: 1,
       length: 32
     }.freeze
 
     # Create a new key generator from either high-entropy key material, or a supplied passphrase.
-    def initialize(ikm: nil, passphrase: nil, digest: "sha256", scrypt: DEFAULT_SCRYPT_PARAMS)
+    # Supplied scrypt params are merged over DEFAULT_SCRYPT_PARAMS.
+    def initialize(ikm: nil, passphrase: nil, digest: 'sha256', scrypt: {})
       if (passphrase.nil? && ikm.nil?) || (!passphrase.nil? && !ikm.nil?)
-        raise ArgumentError, "keygen requires either ikm or passphrase"
+        raise ArgumentError, 'keygen requires either ikm or passphrase'
       end
 
-      @ikm = ikm || OpenSSL::KDF.scrypt(passphrase, **scrypt)
-      @digest = digest
+      @ikm = (ikm ? ikm.b : OpenSSL::KDF.scrypt(passphrase, **DEFAULT_SCRYPT_PARAMS, **scrypt)).freeze
+      @digest = -String(digest)
+      freeze
     end
 
     def inspect
@@ -217,30 +231,48 @@ class Epithet
   end
 
   # Fixed-length Base58 codec for a fixed-size block.
+  #
+  # Obtain codecs via Block58::build, which selects the fastest variant for
+  # the block size, an unrolled decoder for 16-byte blocks, or the generic
+  # chunked decoder otherwise.
   class Block58
-    # `= "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz"`
-    Alphabet = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz"
+    # `= '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz'`
+    Alphabet = '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz'
+
+    POW58 = Array.new(11) { 58**_1 }.freeze # :nodoc:
+
+    attr_reader :size
+
+    # Same as ::new but may select a tuned subclass for performance.
+    def self.build(block_size, ...) = (block_size == 16 ? Unrolled16 : self).new(block_size, ...)
 
     # Create a codec for a block size in bytes.
+    #
+    # The alphabet must be 58 distinct bytes in ascending order, so that
+    # lexicographic order agrees with numeric order.
     def initialize(block_size, alphabet: Alphabet)
+      raise ArgumentError, 'invalid block size' unless Integer === block_size && block_size > 0
       @alphabet = alphabet.b.freeze
-      raise ArgumentError, "invalid alphabet length" unless @alphabet.bytesize == 58
+      raise ArgumentError, 'invalid alphabet length' unless @alphabet.bytesize == 58
+      raise ArgumentError, 'alphabet not strictly ascending' unless @alphabet.bytes.each_cons(2).all? { _2 > _1 }
       @size = ((block_size * 8) / Math.log2(58)).ceil(0)
       @charsel = @alphabet.gsub(/[\^\-\\]/, '\\\\\&').freeze
       @blank = @alphabet[0] * @size
       @lut = @alphabet.each_byte.with_index.with_object("\0" * 256) { |(val, idx), lut| lut.setbyte(val, idx) }.freeze
+      @max = i2s((1 << (block_size * 8)) - 1).freeze
     end
 
     def inspect
       "#<#{self.class}:#{'%#016x' % (object_id << 1)} size=#{@size} alphabet=#{@alphabet}>"
     end
 
-    # Return true if the string has the right size and alphabet.
+    # Return true if the string is in range with the right size and alphabet.
     def valid?(s)
-      String === s && s.bytesize == @size && s.count(@charsel) == @size
+      String === s && s.bytesize == @size && s <= @max && s.count(@charsel) == @size
     end
 
     # Encode a non-negative Integer to fixed-length Base58.
+    # Truncates if int >= 58**size.
     def i2s(int)
       # Using divmod+setbyte is faster than Integer#digits under YJIT,
       # and about equal in plain MRI.
@@ -257,42 +289,80 @@ class Epithet
     end
 
     # Decode a fixed-length Base58 string to an Integer.
-    # Assumes the input passes `#valid?`.
+    # Assumes the input passes `#valid?`. Wraps at 58**size on the i2s round trip.
     def s2i(str)
-      # By unrolling coefficients, this is ~8x faster than Horner's scheme
+      # Chunking intermediate results into 64-bit integers is ~5x faster
+      # under YJIT than Horner's scheme
       #
       #   str.each_byte.inject(0) { _1 * 58 + @lut[_2] }
       #
-      # at computing the inner product when using YJIT, by chunking
-      # intermediate results into 64-bit integers.
+      # at computing the inner product.
       lut = @lut
+      size = @size
+      pow = POW58
+      acc = 0
+      pos = 0
+      while pos < size
+        n = size - pos
+        n = 10 if n > 10
+        chunk = 0
+        i = 0
+        while i < n
+          chunk = (chunk * 58) + lut.getbyte(str.getbyte(pos))
+          pos += 1
+          i += 1
+        end
+        acc = (acc * pow[n]) + chunk
+      end
+      acc
+    end
+
+    # Specialised decoder for 16-byte blocks (22 digits) with a fully unrolled inner product.
+    class Unrolled16 < Block58
+      def initialize(...)
+        super
+        raise ArgumentError, 'unrolled codec requires a 16-byte block' unless @size == 22
+      end
+
+      # Decode a fixed-length Base58 string to an Integer.
+      # Assumes the input passes `#valid?`.
+      def s2i(str)
+        # rubocop:disable Style/NumericLiterals, Lint/AmbiguousOperatorPrecedence, Layout
+        #
+        # By unrolling the chunks against literal coefficients, this is ~1.6x
+        # faster under YJIT than the generic chunked Block58#s2i, and ~8x
+        # faster than Horner's scheme.
+        lut = @lut
 
-      acc0 = lut.getbyte(str.getbyte(0)) * 7427658739644928 +
-             lut.getbyte(str.getbyte(1)) * 128063081718016 +
-             lut.getbyte(str.getbyte(2)) * 2207984167552 +
-             lut.getbyte(str.getbyte(3)) * 38068692544 +
-             lut.getbyte(str.getbyte(4)) * 656356768 +
-             lut.getbyte(str.getbyte(5)) * 11316496 +
-             lut.getbyte(str.getbyte(6)) * 195112 +
-             lut.getbyte(str.getbyte(7)) * 3364 +
-             lut.getbyte(str.getbyte(8)) * 58 +
-             lut.getbyte(str.getbyte(9))
-
-      acc1 = lut.getbyte(str.getbyte(10)) * 7427658739644928 +
-             lut.getbyte(str.getbyte(11)) * 128063081718016 +
-             lut.getbyte(str.getbyte(12)) * 2207984167552 +
-             lut.getbyte(str.getbyte(13)) * 38068692544 +
-             lut.getbyte(str.getbyte(14)) * 656356768 +
-             lut.getbyte(str.getbyte(15)) * 11316496 +
-             lut.getbyte(str.getbyte(16)) * 195112 +
-             lut.getbyte(str.getbyte(17)) * 3364 +
-             lut.getbyte(str.getbyte(18)) * 58 +
-             lut.getbyte(str.getbyte(19))
-
-                               lut.getbyte(str.getbyte(21)) +
-                          58 * lut.getbyte(str.getbyte(20)) +
-                        3364 * acc1 +
-      1449225352009601191936 * acc0
+        acc0 = lut.getbyte(str.getbyte(0)) * 7427658739644928 +
+               lut.getbyte(str.getbyte(1)) * 128063081718016 +
+               lut.getbyte(str.getbyte(2)) * 2207984167552 +
+               lut.getbyte(str.getbyte(3)) * 38068692544 +
+               lut.getbyte(str.getbyte(4)) * 656356768 +
+               lut.getbyte(str.getbyte(5)) * 11316496 +
+               lut.getbyte(str.getbyte(6)) * 195112 +
+               lut.getbyte(str.getbyte(7)) * 3364 +
+               lut.getbyte(str.getbyte(8)) * 58 +
+               lut.getbyte(str.getbyte(9))
+
+        acc1 = lut.getbyte(str.getbyte(10)) * 7427658739644928 +
+               lut.getbyte(str.getbyte(11)) * 128063081718016 +
+               lut.getbyte(str.getbyte(12)) * 2207984167552 +
+               lut.getbyte(str.getbyte(13)) * 38068692544 +
+               lut.getbyte(str.getbyte(14)) * 656356768 +
+               lut.getbyte(str.getbyte(15)) * 11316496 +
+               lut.getbyte(str.getbyte(16)) * 195112 +
+               lut.getbyte(str.getbyte(17)) * 3364 +
+               lut.getbyte(str.getbyte(18)) * 58 +
+               lut.getbyte(str.getbyte(19))
+
+                                 lut.getbyte(str.getbyte(21)) +
+                            58 * lut.getbyte(str.getbyte(20)) +
+                          3364 * acc1 +
+        1449225352009601191936 * acc0
+
+        # rubocop:enable Style/NumericLiterals, Lint/AmbiguousOperatorPrecedence, Layout
+      end
     end
   end
 end

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: epithet
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 1.1.0
 platform: ruby
 authors:
 - Josh Goodall
-autorequire: 
 bindir: bin
 cert_chain: []
-date: 2025-12-22 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: minitest
@@ -52,6 +51,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '7'
+- !ruby/object:Gem::Dependency
+  name: rubocop
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 description: Epithet generates stable, prefixed, Base58 identifiers from 64-bit integers
   using AES and HMAC.
 email:
@@ -76,7 +89,6 @@ metadata:
   changelog_uri: https://github.com/inopinatus/epithet/blob/main/CHANGELOG.md
   bug_tracker_uri: https://github.com/inopinatus/epithet/issues
   rubygems_mfa_required: 'true'
-post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
@@ -84,15 +96,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '3'
+      version: '3.3'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.3.1
-signing_key: 
+rubygems_version: 4.0.10
 specification_version: 4
 summary: External base58 identifiers with reversible, authenticated obfuscation.
 test_files: []