lockbox 2.1.0 → 2.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 732b29630e94d7e05292a10ff4106f05152418a335fb7a5e7da9b5a632c05856
-  data.tar.gz: 8d7d40d7d4f8bb5ecc4737c4664a87bfc33d1f331b0a46d36ebc6a3ce5573ee2
+  metadata.gz: 3c892b20d24ec1db29f60f508b0103c315450bf85f71e3d5ff9b92d3f21d1cca
+  data.tar.gz: 000fdbc4bc30ba97738d3823b719bbb37d23c4d926792d2f65197043502e843e
 SHA512:
-  metadata.gz: 11ba243e0e997a3140a5f3682f38023b9dcf29fdd9c181ea9f693404b4204bd7e83a4caef669126ff9fe432882773ff8f52e129117c201f0dc6eae7de9539849
-  data.tar.gz: 206197fbff415597cb816f77d9354fc8b2ee0c60ceccfb1b5414a44cf19a14b1b9224e09d1c7b0148a9ecb4b0d6673f70f2f35008b6a105bab8e02a55fdf81ce
+  metadata.gz: 4fc7026684f02a5f8a34e827c16566425e2987efc5f5b02ff905431e1d1e9bdbf2ac542d87413418d8c0cb2b3d8feb2ce58c61aaed96b1dc32bf2a490cea8c4c
+  data.tar.gz: a04a81cab9ea3b9c8b8591846fe10866610fadd4829e04ffdc6bbd67138df307a78e05da0cf820bd1a44544a54980191202a4afd8b8b9e5f4ca1bf6f8109c529

data/CHANGELOG.md

@@ -1,3 +1,11 @@
+## 2.3.0 (2026-11-10)
+
+- Fixed hybrid encryption key being able to decrypt - [more info](https://github.com/ankane/lockbox/security/advisories/GHSA-586r-mm5q-xhg2)
+
+## 2.2.0 (2026-04-04)
+
+- Dropped support for Active Record < 7.2 and Ruby < 3.3
+
 ## 2.1.0 (2025-10-15)
 
 - Added warning for `download_chunk` method

data/LICENSE.txt

@@ -1,6 +1,6 @@
 The MIT License (MIT)
 
-Copyright (c) 2018-2025 Andrew Kane
+Copyright (c) 2018-2026 Andrew Kane
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

data/README.md

@@ -72,7 +72,7 @@ Then follow the instructions below for the data you want to encrypt.
 Create a migration with:
 
 ```ruby
-class AddEmailCiphertextToUsers < ActiveRecord::Migration[8.0]
+class AddEmailCiphertextToUsers < ActiveRecord::Migration[8.1]
   def change
     add_column :users, :email_ciphertext, :text
   end
@@ -251,7 +251,7 @@ User.decrypt_email_ciphertext(user.email_ciphertext)
 Create a migration with:
 
 ```ruby
-class AddBodyCiphertextToRichTexts < ActiveRecord::Migration[8.0]
+class AddBodyCiphertextToRichTexts < ActiveRecord::Migration[8.1]
   def change
     add_column :action_text_rich_texts, :body_ciphertext, :text
   end
@@ -382,7 +382,7 @@ Encryption is applied to all versions after processing.
 You can mount the uploader [as normal](https://github.com/carrierwaveuploader/carrierwave#activerecord). With Active Record, this involves creating a migration:
 
 ```ruby
-class AddLicenseToUsers < ActiveRecord::Migration[8.0]
+class AddLicenseToUsers < ActiveRecord::Migration[8.1]
   def change
     add_column :users, :license, :string
   end
@@ -910,7 +910,7 @@ end
 You can use `binary` columns for the ciphertext instead of `text` columns.
 
 ```ruby
-class AddEmailCiphertextToUsers < ActiveRecord::Migration[8.0]
+class AddEmailCiphertextToUsers < ActiveRecord::Migration[8.1]
   def change
     add_column :users, :email_ciphertext, :binary
   end
@@ -961,7 +961,7 @@ end
 Create a migration with:
 
 ```ruby
-class MigrateToLockbox < ActiveRecord::Migration[8.0]
+class MigrateToLockbox < ActiveRecord::Migration[8.1]
   def change
     add_column :users, :name_ciphertext, :text
     add_column :users, :email_ciphertext, :text
@@ -994,7 +994,7 @@ end
 Then remove the previous gem from your Gemfile and drop its columns.
 
 ```ruby
-class RemovePreviousEncryptedColumns < ActiveRecord::Migration[8.0]
+class RemovePreviousEncryptedColumns < ActiveRecord::Migration[8.1]
   def change
     remove_column :users, :encrypted_name, :text
     remove_column :users, :encrypted_name_iv, :text

data/lib/lockbox/active_storage_extensions.rb

@@ -118,13 +118,6 @@ module Lockbox
         super
       end
 
-      if ActiveStorage::VERSION::STRING.to_f == 7.1 && ActiveStorage.version >= "7.1.4"
-        def transform_variants_later
-          blob.instance_variable_set(:@lockbox_encrypted, true) if Utils.encrypted_options(record, name)
-          super
-        end
-      end
-
       def open(**options)
         blob.open(**options) do |file|
           options = Utils.encrypted_options(record, name)
@@ -149,12 +142,6 @@ module Lockbox
     end
 
     module Blob
-      if ActiveStorage::VERSION::STRING.to_f == 7.1 && ActiveStorage.version >= "7.1.4"
-        def preview_image_needed_before_processing_variants?
-          !instance_variable_defined?(:@lockbox_encrypted) && super
-        end
-      end
-
       private
 
       def extract_content_type(io)

data/lib/lockbox/box.rb

@@ -6,8 +6,8 @@ module Lockbox
       raise ArgumentError, "Cannot pass both key and encryption/decryption key" if key && (encryption_key || decryption_key)
 
       key = Lockbox::Utils.decode_key(key) if key
-      encryption_key = Lockbox::Utils.decode_key(encryption_key, size: 64) if encryption_key
-      decryption_key = Lockbox::Utils.decode_key(decryption_key, size: 64) if decryption_key
+      encryption_key, legacy_encryption = decode_hybrid_key(encryption_key) if encryption_key
+      decryption_key, legacy_decryption = decode_hybrid_key(decryption_key) if decryption_key
 
       algorithm ||= "aes-gcm"
 
@@ -26,8 +26,22 @@ module Lockbox
       when "hybrid"
         raise ArgumentError, "Missing key" unless encryption_key || decryption_key
         require "rbnacl"
-        @encryption_box = RbNaCl::Boxes::Curve25519XSalsa20Poly1305.new(encryption_key.slice(0, 32), encryption_key.slice(32..-1)) if encryption_key
-        @decryption_box = RbNaCl::Boxes::Curve25519XSalsa20Poly1305.new(decryption_key.slice(32..-1), decryption_key.slice(0, 32)) if decryption_key
+        if encryption_key
+          @encryption_box =
+            if legacy_encryption
+              nil
+            else
+              RbNaCl::Boxes::Sealed.from_public_key(encryption_key)
+            end
+        end
+        if decryption_key
+          @decryption_box =
+            if legacy_decryption
+              RbNaCl::Boxes::Curve25519XSalsa20Poly1305.new(decryption_key.byteslice(32..-1), decryption_key.byteslice(0, 32))
+            else
+              RbNaCl::Boxes::Sealed.from_private_key(decryption_key)
+            end
+        end
       else
         raise ArgumentError, "Unknown algorithm: #{algorithm}"
       end
@@ -44,17 +58,16 @@ module Lockbox
       when "hybrid"
         raise ArgumentError, "No encryption key set" unless defined?(@encryption_box)
         raise ArgumentError, "Associated data not supported with this algorithm" if associated_data
-        nonce = generate_nonce(@encryption_box)
-        ciphertext = @encryption_box.encrypt(nonce, message)
+        Utils.raise_hybrid_error if @encryption_box.nil?
+        @encryption_box.encrypt(message)
       when "xsalsa20"
         raise ArgumentError, "Associated data not supported with this algorithm" if associated_data
         nonce = generate_nonce(@box)
-        ciphertext = @box.encrypt(nonce, message)
+        nonce + @box.encrypt(nonce, message)
       else
         nonce = generate_nonce(@box)
-        ciphertext = @box.encrypt(nonce, message, associated_data)
+        nonce + @box.encrypt(nonce, message, associated_data)
       end
-      nonce + ciphertext
     end
 
     def decrypt(ciphertext, associated_data: NOT_SET)
@@ -64,8 +77,12 @@ module Lockbox
         when "hybrid"
           raise ArgumentError, "No decryption key set" unless defined?(@decryption_box)
           raise ArgumentError, "Associated data not supported with this algorithm" if associated_data
-          nonce, ciphertext = extract_nonce(@decryption_box, ciphertext)
-          @decryption_box.decrypt(nonce, ciphertext)
+          if @decryption_box.is_a?(RbNaCl::Boxes::Sealed)
+            @decryption_box.decrypt(ciphertext)
+          else
+            nonce, ciphertext = extract_nonce(@decryption_box, ciphertext)
+            @decryption_box.decrypt(nonce, ciphertext)
+          end
         when "xsalsa20"
           raise ArgumentError, "Associated data not supported with this algorithm" if associated_data
           nonce, ciphertext = extract_nonce(@box, ciphertext)
@@ -94,5 +111,15 @@ module Lockbox
       nonce = bytes.slice(0, nonce_bytes)
       [nonce, bytes.slice(nonce_bytes..-1)]
     end
+
+    def decode_hybrid_key(key)
+      [Lockbox::Utils.decode_key(key), false]
+    rescue Error => e
+      begin
+        [Lockbox::Utils.decode_key(key, size: 64), true]
+      rescue Error
+        raise e
+      end
+    end
   end
 end

data/lib/lockbox/carrier_wave_extensions.rb

@@ -1,6 +1,8 @@
 module Lockbox
   module CarrierWaveExtensions
     def encrypt(**options)
+      Utils.check_options(options)
+
       class_eval do
         # uses same hook as process (before cache)
         # processing can be disabled, so better to keep separate

data/lib/lockbox/model.rb

@@ -23,6 +23,8 @@ module Lockbox
       #   options[:type] = :decimal
       # end
 
+      Utils.check_options(options)
+
       custom_type = options[:type].respond_to?(:serialize) && options[:type].respond_to?(:deserialize)
       valid_types = [nil, :string, :boolean, :date, :datetime, :time, :integer, :float, :decimal, :binary, :json, :hash, :array, :inet]
       raise ArgumentError, "Unknown type: #{options[:type]}" unless custom_type || valid_types.include?(options[:type])
@@ -259,18 +261,16 @@ module Lockbox
                 result
               end
 
-              if ActiveRecord::VERSION::STRING.to_f >= 7.2
-                def self.insert(attributes, **options)
-                  super(lockbox_map_record_attributes(attributes), **options)
-                end
+              def self.insert(attributes, **options)
+                super(lockbox_map_record_attributes(attributes), **options)
+              end
 
-                def self.insert!(attributes, **options)
-                  super(lockbox_map_record_attributes(attributes), **options)
-                end
+              def self.insert!(attributes, **options)
+                super(lockbox_map_record_attributes(attributes), **options)
+              end
 
-                def self.upsert(attributes, **options)
-                  super(lockbox_map_record_attributes(attributes, check_readonly: true), **options)
-                end
+              def self.upsert(attributes, **options)
+                super(lockbox_map_record_attributes(attributes, check_readonly: true), **options)
               end
 
               def self.insert_all(attributes, **options)
@@ -344,20 +344,9 @@ module Lockbox
             end
 
             # warn on default attributes
-            if ActiveRecord::VERSION::STRING.to_f >= 7.2
-              # TODO improve
-              if pending_attribute_modifications.any? { |v| v.is_a?(ActiveModel::AttributeRegistration::ClassMethods::PendingDefault) && v.name == name.to_s }
-                warn "[lockbox] WARNING: attributes with `:default` option are not supported. Use `after_initialize` instead."
-              end
-            elsif attributes_to_define_after_schema_loads.key?(name.to_s)
-              opt = attributes_to_define_after_schema_loads[name.to_s][1]
-
-              # not ideal, since NO_DEFAULT_PROVIDED is private
-              has_default = opt != ActiveRecord::Attributes::ClassMethods.const_get(:NO_DEFAULT_PROVIDED)
-
-              if has_default
-                warn "[lockbox] WARNING: attributes with `:default` option are not supported. Use `after_initialize` instead."
-              end
+            # TODO improve
+            if pending_attribute_modifications.any? { |v| v.is_a?(ActiveModel::AttributeRegistration::ClassMethods::PendingDefault) && v.name == name.to_s }
+              warn "[lockbox] WARNING: attributes with `:default` option are not supported. Use `after_initialize` instead."
             end
 
             # preference:
@@ -385,7 +374,7 @@ module Lockbox
               when :array
                 serialize name, type: Array, coder: default_column_serializer || YAML
               end
-            elsif ActiveRecord::VERSION::STRING.to_f >= 7.2
+            else
               decorate_attributes([name]) do |attr_name, cast_type|
                 if cast_type.instance_of?(ActiveRecord::Type::Value)
                   original_type = pending_attribute_modifications.find { |v| v.is_a?(ActiveModel::AttributeRegistration::ClassMethods::PendingType) && v.name == original_name.to_s && !v.type.nil? }&.type
@@ -405,27 +394,6 @@ module Lockbox
                   cast_type
                 end
               end
-            elsif !attributes_to_define_after_schema_loads.key?(name.to_s)
-              # when migrating it's best to specify the type directly
-              # however, we can try to use the original type if its already defined
-              if attributes_to_define_after_schema_loads.key?(original_name.to_s)
-                attribute name, attributes_to_define_after_schema_loads[original_name.to_s].first
-              elsif options[:migrating]
-                # we use the original attribute for serialization in the encrypt and decrypt methods
-                # so we can use a generic value here
-                attribute name, ActiveRecord::Type::Value.new
-              else
-                attribute name, :string
-              end
-            elsif attributes_to_define_after_schema_loads[name.to_s].first.is_a?(Proc)
-              # hack for Active Record 6.1+ to set string type after serialize
-              # otherwise, type gets set to ActiveModel::Type::Value
-              # which always returns false for changed_in_place?
-              # earlier versions of Active Record take the previous code path
-              attribute_type = attributes_to_define_after_schema_loads[name.to_s].first.call(nil)
-              if attribute_type.is_a?(ActiveRecord::Type::Serialized) && attribute_type.subtype.nil?
-                attribute name, ActiveRecord::Type::Serialized.new(ActiveRecord::Type::String.new, attribute_type.coder)
-              end
             end
 
             define_method("#{name}_was") do
@@ -550,7 +518,7 @@ module Lockbox
                 # set previous attribute so changes populate correctly
                 # it's fine if this is set on future decryptions (as is the case when message is nil)
                 # as only the first value is loaded into changes
-                @attributes[name.to_s].instance_variable_set("@value_before_type_cast", message)
+                @attributes[name.to_s].instance_variable_set(:@value_before_type_cast, message)
 
                 # cache
                 # decrypt method does type casting
@@ -711,6 +679,8 @@ module Lockbox
 
     module Attached
       def encrypts_attached(*attributes, **options)
+        Utils.check_options(options)
+
         attributes.each do |name|
           name = name.to_sym
 

data/lib/lockbox/utils.rb

@@ -121,5 +121,15 @@ module Lockbox
         content_type: attachment.content_type
       }
     end
+
+    def self.check_options(options)
+      if (options[:encryption_key].is_a?(String) && options[:encryption_key].bytesize == 128) || (options[:decryption_key].is_a?(String) && options[:decryption_key].bytesize == 128)
+        raise_hybrid_error
+      end
+    end
+
+    def self.raise_hybrid_error
+      raise Lockbox::Error, "Rotate your hybrid cryptography keys and data to address GHSA-586r-mm5q-xhg2"
+    end
   end
 end

data/lib/lockbox/version.rb

@@ -1,3 +1,3 @@
 module Lockbox
-  VERSION = "2.1.0"
+  VERSION = "2.3.0"
 end

data/lib/lockbox.rb

@@ -50,15 +50,10 @@ module Lockbox
 
   def self.generate_key_pair
     require "rbnacl"
-    # encryption and decryption servers exchange public keys
-    # this produces smaller ciphertext than sealed box
-    alice = RbNaCl::PrivateKey.generate
-    bob = RbNaCl::PrivateKey.generate
-    # alice is sending message to bob
-    # use bob first in both cases to prevent keys being swappable
+    key = RbNaCl::PrivateKey.generate
     {
-      encryption_key: to_hex(bob.public_key.to_bytes + alice.to_bytes),
-      decryption_key: to_hex(bob.to_bytes + alice.public_key.to_bytes)
+      encryption_key: to_hex(key.public_key.to_bytes),
+      decryption_key: to_hex(key.to_bytes)
     }
   end
 
@@ -98,8 +93,10 @@ end
 if defined?(ActiveSupport.on_load)
   ActiveSupport.on_load(:active_record) do
     ar_version = ActiveRecord::VERSION::STRING.to_f
-    if ar_version < 7.1
-      if ar_version >= 7.0
+    if ar_version < 7.2
+      if ar_version >= 7.1
+        raise Lockbox::Error, "Active Record #{ActiveRecord::VERSION::STRING} requires Lockbox < 2.2"
+      elsif ar_version >= 7.0
         raise Lockbox::Error, "Active Record #{ActiveRecord::VERSION::STRING} requires Lockbox < 2.1"
       elsif ar_version >= 5.2
         raise Lockbox::Error, "Active Record #{ActiveRecord::VERSION::STRING} requires Lockbox < 2"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: lockbox
 version: !ruby/object:Gem::Version
-  version: 2.1.0
+  version: 2.3.0
 platform: ruby
 authors:
 - Andrew Kane
@@ -48,14 +48,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '3.2'
+      version: '3.3'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.9
+rubygems_version: 4.0.20
 specification_version: 4
 summary: Modern encryption for Ruby and Rails
 test_files: []