gfc64 0.0.2

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: f93c96115de165e7cec9824e893e7254b6612c5d254c19d19c14899c7aa68ef1
+  data.tar.gz: 00fc60e41ebe8a82bd7de95386aaa097df8a468ecb13e1ad98c7a4b5a311f59c
+SHA512:
+  metadata.gz: 2b7b53943801d158fbc1e44c2a9bd6038aa4445047ebfc7de941f3dc583bb55120e9353dbea6d12de4253d1bc67f88c44e4a1c2326a549f4dd13a6a0842e2041
+  data.tar.gz: 6674b80a4457530858aa15b57d89b421431e81313066356d95013292257b160936efde74b27349f410d5cc002dc64bf5dfe9fb00f08af830d72c5dfb2268a617

data/README.md

@@ -0,0 +1,46 @@
+# GFC64
+
+Format-preserving Generalized Feistel Cipher for 64-bit integers. Encrypts 64-bit
+integers into... 64-bit integers!
+
+Very useful for if you have sequential 64-bit integer database primary keys that
+you want to expose in an app, but you don't want to leak count information
+(e.g. `/customers/1`, `/customers/2`, ...), and you don't want to add another
+column to store something auxiliary like a UUID.
+
+For example, with this gem, routes like
+
+`/customers/1` can become something like `/customers/4552956331295818987`, and
+
+`/customers/2` can become something like `/customers/3833777695217202560`
+
+## Usage
+
+```ruby
+key = SecureRandom.hex(32) # => "ffb5e3600fc27924f97dc055440403b10ce97160261f2a87eee576584cf942e5"
+gfc = GFC64.new(key)
+gfc.encrypt(1) # => 4552956331295818987
+gfc.decrypt(4552956331295818987) # => 1
+gfc.encrypt(2) # => 3833777695217202560
+gfc.decrypt(3833777695217202560) # => 2
+```
+
+## Disclaimer
+
+This code has not been vetted by a security audit or a professional
+cryptographer so may be wrong and/or insecure.
+
+## License
+
+This was written with AI tool assistance. If any code mirrors existing
+copyrighted works, it was not my intent, and the copyright remains with the
+original works. My contributions are MIT licensed.
+
+## References
+
+Black, John, and Phillip Rogaway. ["Ciphers with Arbitrary Finite Domains."][paper] In Topics in Cryptology — CT-RSA 2002, edited by Bart Preneel, 2271:114–30. Lecture Notes in Computer Science. Berlin, Heidelberg: Springer Berlin Heidelberg, 2002. https://doi.org/10.1007/3-540-45760-7_9.
+
+Hat tip to [this Hacker News comment][hn] that led me to the idea and the paper.
+
+[paper]: https://web.cs.ucdavis.edu/~rogaway/papers/subset.pdf
+[hn]: https://news.ycombinator.com/item?id=27016779

data/lib/gfc64.rb

@@ -0,0 +1,57 @@
+# frozen_string_literal: true
+
+require "openssl"
+require "securerandom"
+
+class GFC64
+  VERSION = "0.0.2".freeze
+
+  attr_reader :rounds, :key, :block_size
+
+  def initialize(key, rounds: 3)
+    @key = key
+    @block_size = 8 # 64 bits
+    @rounds = rounds
+  end
+
+  def encrypt(number)
+    raise ArgumentError, 'Number must be a 64-bit integer' unless number.is_a?(Integer) && number.between?(0, 2**64 - 1)
+
+    # Split the number into two 32-bit halves
+    left, right = number >> 32, number & 0xFFFFFFFF
+
+    rounds.times do |round|
+      round_key = derive_round_key(key, round)
+      aes = OpenSSL::Cipher.new('AES-128-ECB').encrypt
+      aes.key = round_key
+      f = aes.update([right].pack('N')) + aes.final
+      left, right = right, left ^ f.unpack1('N')
+    end
+
+    # Combine the two 32-bit halves back into a 64-bit number
+    (left << 32) | right
+  end
+
+  def decrypt(number)
+    raise ArgumentError, 'Number must be a 64-bit integer' unless number.is_a?(Integer) && number.between?(0, 2**64 - 1)
+
+    left, right = number >> 32, number & 0xFFFFFFFF
+
+    rounds.times do |round|
+      round_key = derive_round_key(key, rounds - round - 1)
+      aes = OpenSSL::Cipher.new('AES-128-ECB').encrypt
+      aes.key = round_key
+      f = aes.update([left].pack('N')) + aes.final
+      left, right = right ^ f.unpack1('N'), left
+    end
+
+    (left << 32) | right
+  end
+
+  private
+
+  def derive_round_key(key, round)
+    # A simple round key derivation using SHA256 and the round number
+    OpenSSL::Digest::SHA256.digest(key + [round].pack('L'))[0...16] # Truncate to 128 bits for AES key
+  end
+end

metadata

@@ -0,0 +1,48 @@
+--- !ruby/object:Gem::Specification
+name: gfc64
+version: !ruby/object:Gem::Version
+  version: 0.0.2
+platform: ruby
+authors:
+- Abe Voelker
+autorequire: 
+bindir: bin
+cert_chain: []
+date: 2023-11-03 00:00:00.000000000 Z
+dependencies: []
+description: Hides sequential primary key counts without resorting to UUIDs or GUIDs.
+email: abe@abevoelker.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- README.md
+- lib/gfc64.rb
+homepage: https://github.com/abevoelker/gfc64
+licenses:
+- MIT
+metadata:
+  homepage_uri: https://github.com/abevoelker/gfc64
+  documentation_uri: https://rubydoc.info/github/abevoelker/gfc64
+  source_code_uri: https://github.com/abevoelker/gfc64
+  bug_tracker_uri: https://github.com/abevoelker/gfc64/issues
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: 2.1.0
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.4.10
+signing_key: 
+specification_version: 4
+summary: Generalized Feistel Cipher for 64-bit integers
+test_files: []