ncypher 0.6.1 → 1.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA1:
-  metadata.gz: b65ff999987a0b7d414107d2910d0e00d5f206fd
-  data.tar.gz: c82bced9cc0630a9700162fda252abe17922fee3
+SHA256:
+  metadata.gz: 868bcb19ae0d6aea28005adc399f21ca2dd461663ff9cbaf8e7a3a767734052b
+  data.tar.gz: 830d632e5fc2f119e6768ae7e115c2cfccdac0fa017379241ef6397c418923d1
 SHA512:
-  metadata.gz: 48e16e07449f59be41db2260df232003fd7d527dba43fca21972d8ed6716e4b7810813eb66a47c64b195820b90822f59351a304e90a3594510d2fec05fbf0b39
-  data.tar.gz: 7bf1a6aa712ab2c6425d5b240dc9ac344f071ad3b86dd79c1be9de083a7dd3eae0e0c00eddb6b85fb911244181a46b884e23ab6a12ab893fc6618379946ff27c
+  metadata.gz: f8525b09eebde943e697c665c813ab6814eb867fddef0bd7f0e864c3aa0d293a7c55da4ba2557793246f23a70642fc7229a949be3b2514530670789358a0be11
+  data.tar.gz: ddff860755ae08603db392033d72583766e34efaa758f0044be4e0e0deab29afea9f669833dd2cc73f96c01029de8854aead7b576147a98cd1280cc2e0e70517

data/.travis.yml

@@ -2,9 +2,11 @@ sudo: false
 cache:
   bundler: true
 language: ruby
-rvm:
-  - 2.2.1
-before_install: gem install bundler -v 1.12.5
+dist: bionic
+before_install:
+  - gem install bundler -v 2.0
+  - sudo apt-get update -y
+  - sudo apt-get install -y libsodium23
 script: bundle exec rake
 deploy:
   provider: rubygems

data/README.md

@@ -3,7 +3,15 @@
 
 # Ncypher
 
-Ncypher is a gem to help you to encrypt your credentials in your ruby apps in a safe manner.
+Ncypher is a gem to help you to encrypt your credentials in your projects in a safe manner.
+
+## Upgrade from versions before 1.0
+Versions before 1.0 were using rbnacl-libsodium gem which is now deprecated.  
+The big difference is that now you need to have libsodium installed on your host system.  
+That also means faster gem installation. =)  
+Check https://github.com/RubyCrypto/rbnacl/wiki/Installing-libsodium for more info.  
+Note: You need Argon2 support. So libsodium >= v1.0.15
+
 
 ## Installation
 
@@ -32,8 +40,8 @@ You can also set the env variable `NCYPHER_KEY` to that generated key (i.e `expo
 
 To encrypt a new password (or anything else), ncypher supports stdin. So you can do:
 ```
-$> cat secret_file | ncypher encrypt > secret_file.encrypted
-$> cat secret_file.encrypted | ncypher decrypt > secret_file
+$> ncypher encrypt < secret_file > secret_file.encrypted
+$> ncypher decrypt < secret_file.encrypted > secret_file
 $> ncypher encrypt
 mypassword
 <CTRL+D>
@@ -61,21 +69,39 @@ p4$$w0rd
 
 :)
 
-And Ncypher::Ncypher.decrypt will magically use your key in `.ncypher_key` to decrypt that password at runtime. 
+And if you are using ruby, Ncypher::Ncypher.decrypt will magically use your key in `.ncypher_key` to decrypt that password at runtime. 
 Now you can directy put in your .yaml files:
 ```
 defaults: &defaults
   my_password: <%= Ncypher::Ncypher.decrypt('lXEwfKv4dEjmK0kojEAnikNsLCsVCtSMiR2aSfM6uUXYn2DzCZ3O7SA9HaGnMp/kEEsI') %>
 ```
 
+## Password derived secret key
+
+In some cases you may want to derive a key from a particular password you have memorized. You can simply do:
+
+```
+$> ncypher derive_key p4$$w0rd
+R9RgHcFnuHr+86/7v3MdDyu3V63jh69VCPMXknA2v6E=
+SALT: 4+d4JTGTxRbtXs1vYScBYg==
+```
 
+You can see that the salt is randomly generated for security reasons. You should put that salt in a `.ncypher_salt` file in the current directory (this file can be pushed to your repository). So that the next time you do `ncypher derive_key p4$$w0rd` you get the exact same ncyper\_key generated.  
+Note that the salt is written on STDERR so you can directly do:
 
+```
+$> ncypher derive_key p4$$w0rd > .ncypher_key
+SALT: WKCAkJcS65nx3lA/w1BmBw==
+```
 
-## Development
+Then you have the ncypher\_key in .ncypher\_key. Be sure to save the salt if you want to be able to derive back the exact same key in the future.  
+The derive_key command also listen to stdin so for safety you can instead do:  
 
-After checking out the repo, run `bin/setup` to install dependencies. Then, run `rake test` to run the tests. You can also run `bin/console` for an interactive prompt that will allow you to experiment.
+```
+$> ncypher derive_key > .ncypher_key
+```
 
-To install this gem onto your local machine, run `bundle exec rake install`. To release a new version, update the version number in `version.rb`, and then run `bundle exec rake release`, which will create a git tag for the version, push git commits and tags, and push the `.gem` file to [rubygems.org](https://rubygems.org).
+And enter your password then CTRL+D.  
 
 ## Contributing
 

data/exe/ncypher

@@ -1,17 +1,16 @@
 #!/usr/bin/env ruby
-require 'ncypher'
+require "ncypher"
 
 begin
-  Object.const_get('Ncypher')
+  Object.const_get("Ncypher")
 rescue NameError
-  require 'bundler/setup'
+  require "bundler/setup"
 end
 
-SUB_COMMANDS = %w(generate_key encrypt decrypt)
-
 if ARGV.empty?
   STDERR.puts "Ncypher a credential encryption tool"
   STDERR.puts "usage: ncypher generate_key"
+  STDERR.puts "usage: ncypher derive_key <password> [salt]"
   STDERR.puts "usage: ncypher key"
   STDERR.puts "usage: ncypher encrypt <text>"
   STDERR.puts "usage: ncypher decrypt <text>"
@@ -20,14 +19,24 @@ end
 
 cmd = ARGV.shift
 case cmd
-  when "generate_key"
-    puts Ncypher::Ncypher.new.generate_key
-  when "key"
-    puts Ncypher::Ncypher.new.key_b64
-  when "encrypt"
-    text = (ARGV.shift || STDIN.read)
-    puts Ncypher::Ncypher.new.encrypt(text.strip)
-  when "decrypt"
-    text = (ARGV.shift || STDIN.read)
-    puts Ncypher::Ncypher.new.decrypt(text.strip)
+when "generate_key"
+  puts Ncypher::Ncypher.new.generate_key
+when "derive_key"
+  password = (ARGV.shift || STDIN.read)
+  unless password
+    abort "ncypher derive_key <password> [salt]"
+  end
+  salt = File.exists?(".ncypher_salt") ? File.read(".ncypher_salt")&.strip : ARGV.shift
+  key, used_salt = Ncypher::Ncypher.new.derive_key(password.strip, salt)
+  STDOUT.puts key
+  STDERR.puts "SALT: #{used_salt}" # Put salt on stderr so we can do ncypher deriver_key password > .ncypher_key
+                                   # and keep salt out of .ncypher_key
+when "key"
+  puts Ncypher::Ncypher.new.key_b64
+when "encrypt"
+  text = (ARGV.shift || STDIN.read)
+  puts Ncypher::Ncypher.new.encrypt(text.strip)
+when "decrypt"
+  text = (ARGV.shift || STDIN.read)
+  puts Ncypher::Ncypher.new.decrypt(text.strip)
 end

data/lib/ncypher.rb

@@ -1,14 +1,13 @@
 require "ncypher/version"
 
-require 'base64'
-require 'rbnacl/libsodium'
-require 'rbnacl'
+require "base64"
 
-module Ncypher
+require "rbnacl"
 
+module Ncypher
   class Ncypher
-
-    def initialize(key_filename: '.ncypher_key')
+    def initialize(key_filename: ".ncypher_key", key: nil)
+      @key = key ? Base64.strict_decode64(key.strip) : nil
       @key_filename = key_filename
     end
 
@@ -21,14 +20,31 @@ module Ncypher
     end
 
     def generate_key
-      generated_key = RbNaCl::Random.random_bytes(RbNaCl::SecretBox.key_bytes)
+      digest_size = 32 # RbNaCl::SecretBox.key_bytes
+      generated_key = RbNaCl::Random.random_bytes(digest_size)
       Base64.strict_encode64(generated_key)
     end
 
+    def derive_key(password, encoded_salt = nil)
+      salt_size = 16 # RbNaCl::PasswordHash::Argon2::SALTBYTES
+      salt ||= encoded_salt ?
+        Base64.strict_decode64(encoded_salt) :
+        RbNaCl::Random.random_bytes(salt_size)
+
+      opslimit = 5
+      memlimit = 7_256_678
+      digest_size = 32 #  RbNaCl::SecretBox.key_bytes
+      generated_key = RbNaCl::PasswordHash::Argon2.new(opslimit, memlimit, digest_size)
+                                                  .digest(password, salt, :argon2i)
+      [Base64.strict_encode64(generated_key), Base64.strict_encode64(salt)]
+    end
+
     def key
-      saved_key = ENV['NCYPHER_KEY'] || find_keyfile
-      abort "Can't find .ncypher_key file or NCYPHER_KEY env variable" if saved_key.nil?
-      Base64.strict_decode64(saved_key.strip)
+      @key ||= begin
+        saved_key = ENV["NCYPHER_KEY"] || find_keyfile
+        abort "Can't find .ncypher_key file or NCYPHER_KEY env variable" if saved_key.nil?
+        Base64.strict_decode64(saved_key.strip)
+      end
     end
 
     def key_b64
@@ -47,6 +63,10 @@ module Ncypher
       Ncypher.new.generate_key
     end
 
+    def self.derive_key(password, salt = nil)
+      Ncypher.new.derive_key(password, salt)
+    end
+
     def self.key
       Ncypher.new.key
     end
@@ -56,18 +76,17 @@ module Ncypher
     end
 
     private
+
     def box
       RbNaCl::SimpleBox.from_secret_key(key)
     end
 
-    def find_keyfile(folder: '.')
+    def find_keyfile(folder: ".")
       path = "#{folder}/#{@key_filename}"
       return File.read(path) if File.exist?(path)
-      return nil if folder == '/'
+      return nil if folder == "/"
       folder = File.expand_path("#{folder}/../")
       find_keyfile(folder: folder)
     end
-
   end
-
 end

data/lib/ncypher/version.rb

@@ -1,3 +1,3 @@
 module Ncypher
-  VERSION = "0.6.1"
+  VERSION = "1.2.0"
 end

data/ncypher.gemspec

@@ -19,10 +19,9 @@ Gem::Specification.new do |spec|
   spec.require_paths = ["lib"]
   spec.license       = 'WTFPL'
 
-  spec.add_development_dependency "bundler", "~> 1.12"
-  spec.add_development_dependency "rake", "~> 10.0"
+  spec.add_development_dependency "bundler", "~> 2.0"
+  spec.add_development_dependency "rake", "~> 12.3.3"
   spec.add_development_dependency "minitest", "~> 5.0"
 
-  spec.add_dependency 'rbnacl-libsodium', '~> 1.0'
-  spec.add_dependency 'rbnacl', '~> 3.0'
+  spec.add_dependency 'rbnacl', '~> 7.0'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: ncypher
 version: !ruby/object:Gem::Version
-  version: 0.6.1
+  version: 1.2.0
 platform: ruby
 authors:
 - David Hagege
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2017-03-24 00:00:00.000000000 Z
+date: 2021-01-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -16,28 +16,28 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.12'
+        version: '2.0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.12'
+        version: '2.0'
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '10.0'
+        version: 12.3.3
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '10.0'
+        version: 12.3.3
 - !ruby/object:Gem::Dependency
   name: minitest
   requirement: !ruby/object:Gem::Requirement
@@ -52,34 +52,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '5.0'
-- !ruby/object:Gem::Dependency
-  name: rbnacl-libsodium
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '1.0'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '1.0'
 - !ruby/object:Gem::Dependency
   name: rbnacl
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.0'
+        version: '7.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.0'
+        version: '7.0'
 description: ''
 email:
 - david.hagege@gmail.com
@@ -120,8 +106,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubyforge_project: 
-rubygems_version: 2.4.6
+rubygems_version: 3.0.6
 signing_key: 
 specification_version: 4
 summary: Ncypher lets you encrypt/decrypt credentials in a safe and transparent way