ohlol-nachos 0.3.1 → 0.3.2

data/README.markdown

@@ -3,23 +3,63 @@ NACHOS
 
 Nachos keeps people from taking your stuff. It's mine, nachos!
 
+I recently needed the ability to programatically encrypt and decrypt data on
+the fly for operations support purposes (code releases, etc). I considered
+writing a script, but it just didn't seem very clean. Plus, the main reason I
+needed it was for software deployment, which I execute in Rake tasks.
+
+It uses two levels of encryption:
+
+   1. AES-256 CBC encryption of the data with a secret key and an IV
+   2. PKI encryption (private key is 3DES encrypted, too!) of the secret key
+and IV
+
+While it's arguably unnecessary to encrypt the IV, I did want to be able to
+store my secret key without worrying about it getting compromised. This allows
+me to keep all of my keystores where ever I want, including a SCM. For stuff
+like code releases, this is huge.
+
+Another really cool facet of this is that I can keep revisioned copies of not
+only my sensitive data, but also my keystores! Oh yeah.
+
 You need to generate a public and private key to bootstrap it.
 
+For more info, check here: http://ohlol.net/2009/07/announcing-nachos.html
+
+INSTALL
+-------
+
+    % sudo gem sources -a http://gems.github.com
+    % sudo gem install ohlol-nachos
+
+SETUP/BOOTSTRAP
+---------------
+
+    % openssl genrsa -des3 -out config/private.pem 2048
+      <enter passphrase>
+      <repeat passphrase>
+    % openssl rsa -in config/private.pem -pubout -out config/public.pem
+
 EXAMPLE USAGE
 -------------
 
-...to store:
+to store:
 
-    require 'ohlol-nachos'
+    require 'nachos'
     
+
+    config = {
+      :public_key => 'config/public.pem',
+      :private_key => 'config/private.pem',
+      :secret_key => 'config/secret-key.yml',
+      :data_store => 'config/secret-data.enc'
+    }
+
     e = Nachos::Encryptor('password')
     e.clear_data = 'foo bar baz'
     e.save_data
 
-...to load:
+to load:
 
-    require 'ohlol-nachos'
-    
-    e = Nachos::Encryptor('password)'
     e.load_data
     puts e.clear_data

data/VERSION

@@ -1 +1 @@
-0.3.1
+0.3.2

data/lib/nachos.rb

@@ -50,8 +50,6 @@ class Nachos::Encryptor
       @public_key = OpenSSL::PKey::RSA.new(File.open(self.config[:public_key]))
       @private_key =
         OpenSSL::PKey::RSA.new(File.open(self.config[:private_key]), password)
-      @cipher = OpenSSL::Cipher::Cipher.new('aes-256-cbc')
-
       @keystore = Nachos::KeyStore.new
 
       keypair
@@ -69,11 +67,15 @@ class Nachos::Encryptor
   def keypair
     if @keystore.secret_key.empty? || @keystore.secret_iv.empty?
       begin
-        @clear_secret_key = @cipher.random_key
-        @clear_secret_iv = @cipher.random_iv
+        cipher = OpenSSL::Cipher::Cipher.new('aes-256-cbc')
+
+        @clear_secret_key = cipher.random_key
+        @clear_secret_iv = cipher.random_iv
 
-        @secret_key = @keystore.secret_key = encrypt(@clear_secret_key)
-        @secret_iv = @keystore.secret_iv = encrypt(@clear_secret_iv)
+        @secret_key = @keystore.secret_key =
+          @public_key.public_encrypt(@clear_secret_key)
+        @secret_iv = @keystore.secret_iv =
+          @public_key.public_encrypt(@clear_secret_iv)
         @keystore.save_secrets
       rescue => e
         raise Nachos::EncryptorException, "There was a problem generating " +
@@ -84,8 +86,8 @@ class Nachos::Encryptor
       @secret_iv = @keystore.secret_iv
     end
 
-    @clear_secret_key = decrypt(@secret_key)
-    @clear_secret_iv = decrypt(@secret_iv)
+    @clear_secret_key = @private_key.private_decrypt(@secret_key)
+    @clear_secret_iv = @private_key.private_decrypt(@secret_iv)
   end
 
   def encrypt(str)
@@ -93,8 +95,14 @@ class Nachos::Encryptor
       raise Nachos::EncryptorException, "What do you want to encrypt?"
     else
       begin
-      @cipher.encrypt
-      str = @public_key.public_encrypt(str)
+        cipher = OpenSSL::Cipher::Cipher.new('aes-256-cbc')
+
+        cipher.encrypt
+        cipher.key = @clear_secret_key
+        cipher.iv = @clear_secret_iv
+
+        str_e = cipher.update(str)
+        str_e << cipher.final
       rescue => e
         raise Nachos::EncryptorException, "Couldn't encrypt the data! (#{e})"
       end
@@ -106,10 +114,16 @@ class Nachos::Encryptor
       raise Nachos::EncryptorException, "What do you want to decrypt?"
     else
       begin
-        @cipher.decrypt
-         str = @private_key.private_decrypt(str)
+        cipher = OpenSSL::Cipher::Cipher.new('aes-256-cbc')
+
+        cipher.decrypt
+        cipher.key = @clear_secret_key
+        cipher.iv = @clear_secret_iv
+
+        str_d = cipher.update(str)
+        str_d << cipher.final
       rescue => e
-        raise Nachos::decryptorException, "Couldn't decrypt the data! (#{e})"
+        raise Nachos::EncryptorException, "Couldn't decrypt the data! (#{e})"
       end
     end
   end
@@ -123,7 +137,7 @@ class Nachos::Encryptor
       end
 
       @encrypted_data.chomp!
-      @clear_data = decrypt(@encrypted_data)
+      @clear_data = decrypt(Base64.decode64(@encrypted_data))
     rescue Errno::ENOENT
     rescue => e
       raise Nachos::EncryptorException, "There was a problem reading the " +
@@ -138,7 +152,7 @@ class Nachos::Encryptor
 
     begin
       File.open(self.config[:data_store], 'w') do |f|
-        f.puts @encrypted_data
+        f.puts Base64.encode64(@encrypted_data)
       end
     rescue
       raise Nachos::EncryptorException, "There was a problem saving the data " +

data/nachos.gemspec

@@ -2,11 +2,11 @@
 
 Gem::Specification.new do |s|
   s.name = %q{nachos}
-  s.version = "0.3.1"
+  s.version = "0.3.2"
 
   s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
   s.authors = ["Scott Smith"]
-  s.date = %q{2009-07-16}
+  s.date = %q{2009-07-17}
   s.description = %q{Nachos is a Ruby library for managing an encrypted data store.}
   s.email = %q{scott@ohlol.net}
   s.extra_rdoc_files = [

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification 
 name: ohlol-nachos
 version: !ruby/object:Gem::Version 
-  version: 0.3.1
+  version: 0.3.2
 platform: ruby
 authors: 
 - Scott Smith
@@ -9,7 +9,7 @@ autorequire:
 bindir: bin
 cert_chain: []
 
-date: 2009-07-16 00:00:00 -07:00
+date: 2009-07-17 00:00:00 -07:00
 default_executable: 
 dependencies: []