rbnacl 6.0.0 → 6.0.1
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/CHANGES.md +71 -96
- data/README.md +10 -36
- data/lib/rbnacl.rb +4 -0
- data/lib/rbnacl/boxes/curve25519xsalsa20poly1305.rb +1 -1
- data/lib/rbnacl/boxes/sealed.rb +136 -0
- data/lib/rbnacl/init.rb +1 -1
- data/lib/rbnacl/password_hash/argon2.rb +12 -12
- data/lib/rbnacl/signatures/ed25519.rb +3 -3
- data/lib/rbnacl/sodium.rb +14 -9
- data/lib/rbnacl/version.rb +1 -1
- data/spec/rbnacl/boxes/sealed_spec.rb +63 -0
- data/spec/rbnacl/sodium_spec.rb +51 -0
- data/spec/shared/sealed_box.rb +29 -0
- data/spec/spec_helper.rb +1 -0
- metadata +9 -2
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 15129e7babc37c8c428aca4bedbf8e9577d7ddd6b1f0252de1c4c7e83034368b
|
|
4
|
+
data.tar.gz: 61a22eaacfd4043a3348db5ed4230745cb8df2d66607a39392e6b9dde0c817fd
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: c43e06b87c005bc4b3086df982add673eaae4b6554556fd6b47b89bb14e2da1028e804ef62d3617ba311820d1623948bd0875fd273152c52bd64da96452fc67d
|
|
7
|
+
data.tar.gz: 7cfaff058fbc58386614e9efe0d62ef47f550f6e571e6c1ff3f887627d36c95e05be295fabc52fea5bd739db21e9249606db8317d8038db3bf0907bd23d9106b
|
data/CHANGES.md
CHANGED
|
@@ -1,148 +1,123 @@
|
|
|
1
|
-
## [6.0.
|
|
2
|
-
|
|
3
|
-
[6.0.0]: https://github.com/crypto-rb/rbnacl/pull/182
|
|
1
|
+
## [6.0.1] (2019-01-27)
|
|
4
2
|
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
3
|
+
- Add fallback `sodium_constants` for Argon2 ([#189])
|
|
4
|
+
- Support libsodium versions used by Heroku ([#186])
|
|
5
|
+
- Sealed boxes ([#184])
|
|
8
6
|
|
|
9
|
-
|
|
10
|
-
Add support for XChaCha20-Poly1305.
|
|
11
|
-
([@AnIrishDuck])
|
|
12
|
-
|
|
13
|
-
* [#174](https://github.com/crypto-rb/rbnacl/pull/174)
|
|
14
|
-
Fix buffer size type in `randombytes_buf` binding.
|
|
15
|
-
([@elijh])
|
|
16
|
-
|
|
17
|
-
* [#172](https://github.com/crypto-rb/rbnacl/pull/172)
|
|
18
|
-
Add support for argon2id digest.
|
|
19
|
-
([@trofi])
|
|
7
|
+
## [6.0.0] (2018-11-08)
|
|
20
8
|
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
9
|
+
- Deprecate rbnacl-libsodium ([#180])
|
|
10
|
+
- Add support for XChaCha20-Poly1305 ([#176])
|
|
11
|
+
- Fix buffer size type in `randombytes_buf` binding ([#174])
|
|
12
|
+
- Add support for argon2id digest ([#174])
|
|
13
|
+
- Support for non-32-byte HMAC-SHA256/512 keys ([#166])
|
|
24
14
|
|
|
25
15
|
## 5.0.0 (2017-06-13)
|
|
26
16
|
|
|
27
|
-
|
|
28
|
-
Support the BLAKE2b Initialize-Update-Finalize API.
|
|
29
|
-
([@fudanchii])
|
|
17
|
+
- Support the BLAKE2b Initialize-Update-Finalize API ([#159])
|
|
30
18
|
|
|
31
19
|
## 4.0.2 (2017-03-12)
|
|
32
20
|
|
|
33
|
-
|
|
34
|
-
Raise error on degenerate keys (fixes #152).
|
|
35
|
-
([@paragonie-scott], [@tarcieri])
|
|
21
|
+
- Raise error on degenerate keys. Fixes #152 ([#157])
|
|
36
22
|
|
|
37
23
|
## 4.0.1 (2016-12-04)
|
|
38
24
|
|
|
39
|
-
|
|
40
|
-
Last minute changes to the ChaCha20Poly1305 API.
|
|
41
|
-
([@tarcieri])
|
|
25
|
+
- Last minute changes to the ChaCha20Poly1305 API ([#148])
|
|
42
26
|
|
|
43
27
|
## 4.0.0 (2016-12-04)
|
|
44
28
|
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
* [#142](https://github.com/crypto-rb/rbnacl/pull/142)
|
|
50
|
-
Added support for Argon2 password hash.
|
|
51
|
-
([@elijh])
|
|
52
|
-
|
|
53
|
-
* [#143](https://github.com/crypto-rb/rbnacl/pull/143)
|
|
54
|
-
Require Ruby 2.2.6+.
|
|
55
|
-
([@tarcieri])
|
|
29
|
+
- Add wrappers for ChaCha20Poly1305 AEAD ciphers ([#141])
|
|
30
|
+
- Added support for Argon2 password hash ([#142])
|
|
31
|
+
- Require Ruby 2.2.6+ ([#143])
|
|
56
32
|
|
|
57
33
|
## 3.4.0 (2015-05-07)
|
|
58
34
|
|
|
59
|
-
|
|
60
|
-
|
|
61
|
-
([@grempe])
|
|
62
|
-
|
|
63
|
-
* [#137](https://github.com/crypto-rb/rbnacl/pull/137)
|
|
64
|
-
Expose HMAC-SHA512 (with 64-byte keys)
|
|
65
|
-
([@mwpastore])
|
|
35
|
+
- Expose `RbNaCl::Signatures::Ed25519#keypair_bytes` ([#135])
|
|
36
|
+
- Expose HMAC-SHA512 with 64-byte keys ([#137])
|
|
66
37
|
|
|
67
38
|
## 3.3.0 (2015-12-29)
|
|
68
39
|
|
|
69
|
-
|
|
70
|
-
|
|
71
|
-
([@namelessjon])
|
|
72
|
-
|
|
73
|
-
* [#128](https://github.com/crypto-rb/rbnacl/pull/128)
|
|
74
|
-
Remove use of Thread.exclusive when initializing library.
|
|
75
|
-
([@tarcieri])
|
|
40
|
+
- Remove use of Thread.exclusive when initializing library ([#128])
|
|
41
|
+
- Add salt/personalisation strings for Blake2b ([#105])
|
|
76
42
|
|
|
77
43
|
## 3.2.0 (2015-05-31)
|
|
78
44
|
|
|
79
|
-
|
|
80
|
-
|
|
45
|
+
- Fix method signature for blake2b
|
|
46
|
+
- RuboCop-friendly codebase
|
|
81
47
|
|
|
82
48
|
## 3.1.2 (2014-08-30)
|
|
83
49
|
|
|
84
|
-
|
|
50
|
+
- Fix scrypt support with libsodium 0.7.0 (scryptsalsa208sha256)
|
|
85
51
|
|
|
86
52
|
## 3.1.1 (2014-06-14)
|
|
87
53
|
|
|
88
|
-
|
|
89
|
-
|
|
90
|
-
|
|
54
|
+
- Fix undefined variable warning
|
|
55
|
+
- RSpec 3 fixups
|
|
56
|
+
- RuboCop
|
|
91
57
|
|
|
92
58
|
## 3.1.0 (2014-05-22)
|
|
93
59
|
|
|
94
|
-
|
|
60
|
+
- The scrypt password hashing function: `RbNaCl::PasswordHash.scrypt`
|
|
95
61
|
|
|
96
62
|
## 3.0.1 (2014-05-12)
|
|
97
63
|
|
|
98
|
-
|
|
64
|
+
- Load gem from `RBNACL_LIBSODIUM_GEM_LIB_PATH` if set. Used by rbnacl-libsodium
|
|
99
65
|
gem to use libsodium compiled from a gem.
|
|
100
66
|
|
|
101
67
|
## 3.0.0 (2014-04-22)
|
|
102
68
|
|
|
103
|
-
|
|
104
|
-
|
|
69
|
+
- Rename RandomNonceBox to SimpleBox (backwards compatibility preserved)
|
|
70
|
+
- Reverse documented order of SimpleBox/RandomNonceBox initialize parameters.
|
|
105
71
|
Technically backwards compatible, but confusing.
|
|
106
|
-
|
|
72
|
+
- Ensure all strings are ASCII-8BIT/BINARY encoding prior to use
|
|
107
73
|
|
|
108
74
|
## 2.0.0 (2013-11-07)
|
|
109
75
|
|
|
110
|
-
|
|
111
|
-
|
|
112
|
-
|
|
76
|
+
- Rename Crypto module to RbNaCl module
|
|
77
|
+
- Add encrypt/decrypt aliases for `Crypto::RandomNonceBox`
|
|
78
|
+
- `RbNaCl::VerifyKey#verify` operand order was reversed. New operand order is
|
|
113
79
|
signature, message instead of message, signature
|
|
114
|
-
|
|
115
|
-
all now raise a (descendent of) CryptoError if the check
|
|
116
|
-
failures are handled by the program.
|
|
117
|
-
|
|
118
|
-
which are named after the primitives they provide
|
|
119
|
-
|
|
120
|
-
|
|
121
|
-
|
|
122
|
-
|
|
123
|
-
|
|
124
|
-
|
|
125
|
-
|
|
126
|
-
|
|
80
|
+
- `RbNaCL::SecretBox#open`, `RbNaCl::Box#open`, `Auth#verify` and
|
|
81
|
+
`VerifyKey#verify` all now raise a (descendent of) CryptoError if the check
|
|
82
|
+
fails. This ensures failures are handled by the program.
|
|
83
|
+
- `RbNaCl::SecretBox`, Box, etc. are all now aliases for the real
|
|
84
|
+
implementations, which are named after the primitives they provide
|
|
85
|
+
- Removed encoder functionality.
|
|
86
|
+
- Add support for the Blake2b cryptographic hash algorithm.
|
|
87
|
+
- Add checks that we have a sufficiently recent version of libsodium (0.4.3+)
|
|
88
|
+
- Dropped ruby-1.8 support
|
|
89
|
+
- Call the `sodium_init()` function, to select the best algorithms.
|
|
90
|
+
- Fix some typos in the documentation
|
|
91
|
+
- Changes in the low level binding for libsodium and removal of the NaCl module
|
|
92
|
+
- Add a mutex around calls to randombytes in libsodium
|
|
127
93
|
|
|
128
94
|
## 1.1.0 (2013-04-19)
|
|
129
95
|
|
|
130
|
-
|
|
96
|
+
- Provide API for querying primitives and details about them, such as key
|
|
131
97
|
lengths, nonce lengths, etc.
|
|
132
|
-
|
|
98
|
+
- Fixed bug on passing null bytes to sha256, sha512 functions.
|
|
133
99
|
|
|
134
100
|
## 1.0.0 (2013-03-08)
|
|
135
101
|
|
|
136
|
-
|
|
137
|
-
|
|
138
|
-
[
|
|
139
|
-
[
|
|
140
|
-
[
|
|
141
|
-
[
|
|
142
|
-
[
|
|
143
|
-
[
|
|
144
|
-
[
|
|
145
|
-
[
|
|
146
|
-
[
|
|
147
|
-
[
|
|
148
|
-
[
|
|
102
|
+
- Initial release
|
|
103
|
+
|
|
104
|
+
[6.0.1]: https://github.com/crypto-rb/rbnacl/pull/191
|
|
105
|
+
[#189]: https://github.com/crypto-rb/rbnacl/pull/189
|
|
106
|
+
[#186]: https://github.com/crypto-rb/rbnacl/pull/186
|
|
107
|
+
[#184]: https://github.com/crypto-rb/rbnacl/pull/184
|
|
108
|
+
[6.0.0]: https://github.com/crypto-rb/rbnacl/pull/182
|
|
109
|
+
[#180]: https://github.com/crypto-rb/rbnacl/pull/180
|
|
110
|
+
[#176]: https://github.com/crypto-rb/rbnacl/pull/176
|
|
111
|
+
[#174]: https://github.com/crypto-rb/rbnacl/pull/174
|
|
112
|
+
[#172]: https://github.com/crypto-rb/rbnacl/pull/172
|
|
113
|
+
[#166]: https://github.com/crypto-rb/rbnacl/pull/166
|
|
114
|
+
[#159]: https://github.com/crypto-rb/rbnacl/pull/159
|
|
115
|
+
[#157]: https://github.com/crypto-rb/rbnacl/pull/157
|
|
116
|
+
[#148]: https://github.com/crypto-rb/rbnacl/pull/148
|
|
117
|
+
[#143]: https://github.com/crypto-rb/rbnacl/pull/143
|
|
118
|
+
[#142]: https://github.com/crypto-rb/rbnacl/pull/142
|
|
119
|
+
[#141]: https://github.com/crypto-rb/rbnacl/pull/141
|
|
120
|
+
[#137]: https://github.com/crypto-rb/rbnacl/pull/137
|
|
121
|
+
[#135]: https://github.com/crypto-rb/rbnacl/pull/135
|
|
122
|
+
[#128]: https://github.com/crypto-rb/rbnacl/pull/128
|
|
123
|
+
[#105]: https://github.com/crypto-rb/rbnacl/pull/105
|
data/README.md
CHANGED
|
@@ -7,26 +7,13 @@
|
|
|
7
7
|
[](https://github.com/crypto-rb/rbnacl/blob/master/LICENSE.txt)
|
|
8
8
|
[](https://gitter.im/crypto-rb/Lobby)
|
|
9
9
|
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
https://github.com/crypto-rb/rbnacl/tree/4-x-stable
|
|
14
|
-
|
|
15
|
-
A Ruby binding to the state-of-the-art [Networking and Cryptography][nacl]
|
|
16
|
-
library by [Daniel J. Bernstein][djb]. This is **NOT** Google Native Client.
|
|
17
|
-
This is a crypto library.
|
|
18
|
-
|
|
19
|
-
On a completely unrelated topic, RbNaCl is also the empirical formula for
|
|
20
|
-
Rubidium Sodium Chloride.
|
|
21
|
-
|
|
22
|
-
Need help with RbNaCl? Join the [RbNaCl Google Group][group].
|
|
23
|
-
We're also on IRC at #crypto-rb on irc.freenode.net
|
|
10
|
+
Ruby binding for [libsodium], a fork of the [Networking and Cryptography][nacl]
|
|
11
|
+
library.
|
|
24
12
|
|
|
13
|
+
[libsodium]: https://libsodium.org
|
|
25
14
|
[nacl]: http://nacl.cr.yp.to/
|
|
26
|
-
[djb]: http://cr.yp.to/djb.html
|
|
27
|
-
[group]: http://groups.google.com/group/rbnacl
|
|
28
15
|
|
|
29
|
-
## Why NaCl?
|
|
16
|
+
## Why libsodium/NaCl?
|
|
30
17
|
|
|
31
18
|
NaCl is a different kind of cryptographic library. In the past crypto
|
|
32
19
|
libraries were kitchen sinks of little bits and pieces, like ciphers,
|
|
@@ -50,9 +37,6 @@ curves and the XSalsa20 stream cipher. This means with NaCl you not only get
|
|
|
50
37
|
a system which is designed to be secure-by-default, you also get one which
|
|
51
38
|
is extremely fast with comparatively small cryptographic keys.
|
|
52
39
|
|
|
53
|
-
For more information on NaCl's goals, see Dan Bernstein's presentation
|
|
54
|
-
[Blaming the Cryptographic User](http://cr.yp.to/talks/2012.08.08/slides.pdf)
|
|
55
|
-
|
|
56
40
|
### Is it any good?
|
|
57
41
|
|
|
58
42
|
[Yes.](http://news.ycombinator.com/item?id=3067434)
|
|
@@ -75,29 +59,19 @@ You can use RbNaCl on platforms libsodium is supported (see below).
|
|
|
75
59
|
This library aims to support and is [tested against][travis] the following Ruby
|
|
76
60
|
versions:
|
|
77
61
|
|
|
78
|
-
* Ruby 2.2
|
|
79
|
-
* Ruby 2.3
|
|
80
|
-
* Ruby 2.4
|
|
81
|
-
*
|
|
62
|
+
* Ruby 2.2
|
|
63
|
+
* Ruby 2.3
|
|
64
|
+
* Ruby 2.4
|
|
65
|
+
* Ruby 2.5
|
|
66
|
+
* JRuby 9.1
|
|
82
67
|
|
|
83
68
|
If something doesn't work on one of these versions, it's a bug.
|
|
84
69
|
|
|
85
|
-
This library may inadvertently work (or seem to work) on other Ruby versions,
|
|
86
|
-
however support will only be provided for the versions listed above.
|
|
87
|
-
|
|
88
|
-
If you would like this library to support another Ruby version or
|
|
89
|
-
implementation, you may volunteer to be a maintainer. Being a maintainer
|
|
90
|
-
entails making sure all tests run and pass on that implementation. When
|
|
91
|
-
something breaks on your implementation, you will be responsible for providing
|
|
92
|
-
patches in a timely fashion. If critical issues for a particular implementation
|
|
93
|
-
exist at the time of a major release, support for that Ruby version may be
|
|
94
|
-
dropped.
|
|
95
|
-
|
|
96
70
|
[travis]: http://travis-ci.org/crypto-rb/rbnacl
|
|
97
71
|
|
|
98
72
|
## Installation
|
|
99
73
|
|
|
100
|
-
Note: [Windows installation instructions are available](https://github.com/crypto-rb/rbnacl/wiki/
|
|
74
|
+
Note: [Windows installation instructions are available](https://github.com/crypto-rb/rbnacl/wiki/Installing-libsodium#windows).
|
|
101
75
|
|
|
102
76
|
### libsodium
|
|
103
77
|
|
data/lib/rbnacl.rb
CHANGED
|
@@ -52,6 +52,9 @@ module RbNaCl
|
|
|
52
52
|
require "rbnacl/boxes/curve25519xsalsa20poly1305/private_key"
|
|
53
53
|
require "rbnacl/boxes/curve25519xsalsa20poly1305/public_key"
|
|
54
54
|
|
|
55
|
+
# Sealed boxes
|
|
56
|
+
require "rbnacl/boxes/sealed"
|
|
57
|
+
|
|
55
58
|
# Secret Key Encryption (SecretBox): XSalsa20Poly1305
|
|
56
59
|
require "rbnacl/secret_boxes/xsalsa20poly1305"
|
|
57
60
|
|
|
@@ -93,6 +96,7 @@ module RbNaCl
|
|
|
93
96
|
Box = Boxes::Curve25519XSalsa20Poly1305
|
|
94
97
|
PrivateKey = Boxes::Curve25519XSalsa20Poly1305::PrivateKey
|
|
95
98
|
PublicKey = Boxes::Curve25519XSalsa20Poly1305::PublicKey
|
|
99
|
+
SealedBox = Boxes::Sealed
|
|
96
100
|
SecretBox = SecretBoxes::XSalsa20Poly1305
|
|
97
101
|
SigningKey = Signatures::Ed25519::SigningKey
|
|
98
102
|
VerifyKey = Signatures::Ed25519::VerifyKey
|
|
@@ -73,7 +73,7 @@ module RbNaCl
|
|
|
73
73
|
sodium_constant :BOXZEROBYTES
|
|
74
74
|
sodium_constant :BEFORENMBYTES
|
|
75
75
|
sodium_constant :PUBLICKEYBYTES
|
|
76
|
-
sodium_constant :SECRETKEYBYTES, :PRIVATEKEYBYTES
|
|
76
|
+
sodium_constant :SECRETKEYBYTES, name: :PRIVATEKEYBYTES
|
|
77
77
|
|
|
78
78
|
sodium_function :box_curve25519xsalsa20poly1305_beforenm,
|
|
79
79
|
:crypto_box_curve25519xsalsa20poly1305_beforenm,
|
|
@@ -0,0 +1,136 @@
|
|
|
1
|
+
# encoding: binary
|
|
2
|
+
# frozen_string_literal: true
|
|
3
|
+
|
|
4
|
+
module RbNaCl
|
|
5
|
+
module Boxes
|
|
6
|
+
# Sealed boxes are designed to anonymously send messages to a recipient
|
|
7
|
+
# given its public key.
|
|
8
|
+
#
|
|
9
|
+
# Only the recipient can decrypt these messages, using its private key.
|
|
10
|
+
# While the recipient can verify the integrity of the message, it cannot
|
|
11
|
+
# verify the identity of the sender.
|
|
12
|
+
#
|
|
13
|
+
# A message is encrypted using an ephemeral key pair, whose secret part
|
|
14
|
+
# is destroyed right after the encryption process.
|
|
15
|
+
#
|
|
16
|
+
# Without knowing the secret key used for a given message, the sender
|
|
17
|
+
# cannot decrypt its own message later. And without additional data,
|
|
18
|
+
# a message cannot be correlated with the identity of its sender.
|
|
19
|
+
class Sealed
|
|
20
|
+
extend Sodium
|
|
21
|
+
|
|
22
|
+
sodium_type :box
|
|
23
|
+
sodium_constant :SEALBYTES
|
|
24
|
+
sodium_primitive :curve25519xsalsa20poly1305
|
|
25
|
+
|
|
26
|
+
sodium_function :box_seal,
|
|
27
|
+
:crypto_box_seal,
|
|
28
|
+
%i[pointer pointer ulong_long pointer]
|
|
29
|
+
|
|
30
|
+
sodium_function :box_seal_open,
|
|
31
|
+
:crypto_box_seal_open,
|
|
32
|
+
%i[pointer pointer ulong_long pointer pointer]
|
|
33
|
+
|
|
34
|
+
# WARNING: you should strongly prefer the from_private_key/from_public_key class methods.
|
|
35
|
+
#
|
|
36
|
+
# Create a new Sealed Box
|
|
37
|
+
#
|
|
38
|
+
# Sets up the Box for deriving the shared key and encrypting and
|
|
39
|
+
# decrypting messages.
|
|
40
|
+
#
|
|
41
|
+
# @param public_key [String,RbNaCl::PublicKey] The public key to encrypt to
|
|
42
|
+
# @param private_key [String,RbNaCl::PrivateKey] The private key to decrypt with
|
|
43
|
+
#
|
|
44
|
+
# @raise [RbNaCl::LengthError] on invalid keys
|
|
45
|
+
#
|
|
46
|
+
# @return [RbNaCl::SealedBox] The new Box, ready to use
|
|
47
|
+
def initialize(public_key, private_key = nil)
|
|
48
|
+
unless private_key.nil?
|
|
49
|
+
@private_key = private_key.is_a?(PrivateKey) ? private_key : PrivateKey.new(private_key)
|
|
50
|
+
raise IncorrectPrimitiveError unless @private_key.primitive == primitive
|
|
51
|
+
|
|
52
|
+
public_key = @private_key.public_key if public_key.nil?
|
|
53
|
+
end
|
|
54
|
+
|
|
55
|
+
@public_key = public_key.is_a?(PublicKey) ? public_key : PublicKey.new(public_key)
|
|
56
|
+
raise IncorrectPrimitiveError unless @public_key.primitive == primitive
|
|
57
|
+
end
|
|
58
|
+
|
|
59
|
+
# Create a new Sealed Box for encrypting
|
|
60
|
+
#
|
|
61
|
+
# Sets up the Box for encryoption of new messages.
|
|
62
|
+
#
|
|
63
|
+
# @param private_key [String,RbNaCl::PrivateKey] The private key to decrypt with
|
|
64
|
+
#
|
|
65
|
+
# @raise [RbNaCl::LengthError] on invalid keys
|
|
66
|
+
#
|
|
67
|
+
# @return [RbNaCl::SealedBox] The new Box, ready to use
|
|
68
|
+
def self.from_private_key(private_key)
|
|
69
|
+
new(nil, private_key)
|
|
70
|
+
end
|
|
71
|
+
|
|
72
|
+
# Create a new Sealed Box for decrypting
|
|
73
|
+
#
|
|
74
|
+
# Sets up the Box for decrytoption of new messages.
|
|
75
|
+
#
|
|
76
|
+
# @param public_key [String,RbNaCl::PublicKey] The public key to encrypt to
|
|
77
|
+
#
|
|
78
|
+
# @raise [RbNaCl::LengthError] on invalid keys
|
|
79
|
+
#
|
|
80
|
+
# @return [RbNaCl::SealedBox] The new Box, ready to use
|
|
81
|
+
def self.from_public_key(public_key)
|
|
82
|
+
new(public_key, nil)
|
|
83
|
+
end
|
|
84
|
+
|
|
85
|
+
# Encrypts a message
|
|
86
|
+
#
|
|
87
|
+
# @param message [String] The message to be encrypted.
|
|
88
|
+
#
|
|
89
|
+
# @raise [RbNaCl::CryptoError] If the encrytion fails.
|
|
90
|
+
#
|
|
91
|
+
# @return [String] The ciphertext (BINARY encoded)
|
|
92
|
+
def box(message)
|
|
93
|
+
# No padding needed.
|
|
94
|
+
msg = message # variable name to match other RbNaCl code.
|
|
95
|
+
# ensure enough space in result
|
|
96
|
+
ct = Util.zeros(msg.bytesize + SEALBYTES)
|
|
97
|
+
|
|
98
|
+
success = self.class.box_seal(ct, msg, msg.bytesize, @public_key.to_s)
|
|
99
|
+
raise CryptoError, "Encryption failed" unless success
|
|
100
|
+
|
|
101
|
+
ct
|
|
102
|
+
end
|
|
103
|
+
alias encrypt box
|
|
104
|
+
|
|
105
|
+
# Decrypts a ciphertext
|
|
106
|
+
#
|
|
107
|
+
# @param ciphertext [String] The message to be decrypted.
|
|
108
|
+
#
|
|
109
|
+
# @raise [RbNaCl::CryptoError] If no private key is available.
|
|
110
|
+
# @raise [RbNaCl::CryptoError] If the ciphertext cannot be authenticated.
|
|
111
|
+
#
|
|
112
|
+
# @return [String] The decrypted message (BINARY encoded)
|
|
113
|
+
def open(ciphertext)
|
|
114
|
+
raise CryptoError, "Decryption failed. No private key." unless @private_key
|
|
115
|
+
|
|
116
|
+
ct = ciphertext
|
|
117
|
+
raise CryptoError, "Decryption failed. Ciphertext failed verification." if ct.bytesize < SEALBYTES
|
|
118
|
+
|
|
119
|
+
message = Util.zeros(ct.bytesize - SEALBYTES)
|
|
120
|
+
|
|
121
|
+
success = self.class.box_seal_open(message, ct, ct.bytesize, @public_key.to_s, @private_key.to_s)
|
|
122
|
+
raise CryptoError, "Decryption failed. Ciphertext failed verification." unless success
|
|
123
|
+
|
|
124
|
+
message
|
|
125
|
+
end
|
|
126
|
+
alias decrypt open
|
|
127
|
+
|
|
128
|
+
# The crypto primitive for the box class
|
|
129
|
+
#
|
|
130
|
+
# @return [Symbol] The primitive used
|
|
131
|
+
def primitive
|
|
132
|
+
self.class.primitive
|
|
133
|
+
end
|
|
134
|
+
end
|
|
135
|
+
end
|
|
136
|
+
end
|
data/lib/rbnacl/init.rb
CHANGED
|
@@ -18,18 +18,18 @@ module RbNaCl
|
|
|
18
18
|
sodium_constant :ALG_ARGON2I13
|
|
19
19
|
sodium_constant :ALG_ARGON2ID13 if Sodium::Version::ARGON2ID_SUPPORTED
|
|
20
20
|
|
|
21
|
-
sodium_constant :SALTBYTES
|
|
22
|
-
sodium_constant :STRBYTES
|
|
23
|
-
sodium_constant :OPSLIMIT_INTERACTIVE
|
|
24
|
-
sodium_constant :MEMLIMIT_INTERACTIVE
|
|
25
|
-
sodium_constant :OPSLIMIT_MODERATE
|
|
26
|
-
sodium_constant :MEMLIMIT_MODERATE
|
|
27
|
-
sodium_constant :OPSLIMIT_SENSITIVE
|
|
28
|
-
sodium_constant :MEMLIMIT_SENSITIVE
|
|
29
|
-
sodium_constant :MEMLIMIT_MIN
|
|
30
|
-
sodium_constant :MEMLIMIT_MAX
|
|
31
|
-
sodium_constant :OPSLIMIT_MIN
|
|
32
|
-
sodium_constant :OPSLIMIT_MAX
|
|
21
|
+
sodium_constant :SALTBYTES, fallback: 16
|
|
22
|
+
sodium_constant :STRBYTES, fallback: 128
|
|
23
|
+
sodium_constant :OPSLIMIT_INTERACTIVE, fallback: 4
|
|
24
|
+
sodium_constant :MEMLIMIT_INTERACTIVE, fallback: 2**25 # (32mb)
|
|
25
|
+
sodium_constant :OPSLIMIT_MODERATE, fallback: 6
|
|
26
|
+
sodium_constant :MEMLIMIT_MODERATE, fallback: 2**27 # (128mb)
|
|
27
|
+
sodium_constant :OPSLIMIT_SENSITIVE, fallback: 8
|
|
28
|
+
sodium_constant :MEMLIMIT_SENSITIVE, fallback: 2**29 # (512mb)
|
|
29
|
+
sodium_constant :MEMLIMIT_MIN, fallback: 8192
|
|
30
|
+
sodium_constant :MEMLIMIT_MAX, fallback: 4_294_967_296
|
|
31
|
+
sodium_constant :OPSLIMIT_MIN, fallback: 3
|
|
32
|
+
sodium_constant :OPSLIMIT_MAX, fallback: 10
|
|
33
33
|
|
|
34
34
|
ARGON2_MIN_OUTLEN = 16
|
|
35
35
|
ARGON2_MAX_OUTLEN = 0xFFFFFFFF
|
|
@@ -10,9 +10,9 @@ module RbNaCl
|
|
|
10
10
|
sodium_type :sign
|
|
11
11
|
sodium_primitive :ed25519
|
|
12
12
|
sodium_constant :SEEDBYTES
|
|
13
|
-
sodium_constant :PUBLICKEYBYTES, :VERIFYKEYBYTES
|
|
14
|
-
sodium_constant :SECRETKEYBYTES, :SIGNINGKEYBYTES
|
|
15
|
-
sodium_constant :BYTES, :SIGNATUREBYTES
|
|
13
|
+
sodium_constant :PUBLICKEYBYTES, name: :VERIFYKEYBYTES
|
|
14
|
+
sodium_constant :SECRETKEYBYTES, name: :SIGNINGKEYBYTES
|
|
15
|
+
sodium_constant :BYTES, name: :SIGNATUREBYTES
|
|
16
16
|
end
|
|
17
17
|
end
|
|
18
18
|
end
|
data/lib/rbnacl/sodium.rb
CHANGED
|
@@ -8,7 +8,7 @@ module RbNaCl
|
|
|
8
8
|
module Sodium
|
|
9
9
|
def self.extended(klass)
|
|
10
10
|
klass.extend FFI::Library
|
|
11
|
-
klass.ffi_lib "sodium"
|
|
11
|
+
klass.ffi_lib ["sodium", "libsodium.so.18", "libsodium.so.23"]
|
|
12
12
|
end
|
|
13
13
|
|
|
14
14
|
def sodium_type(type = nil)
|
|
@@ -29,14 +29,19 @@ module RbNaCl
|
|
|
29
29
|
sodium_primitive
|
|
30
30
|
end
|
|
31
31
|
|
|
32
|
-
def sodium_constant(constant, name
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
32
|
+
def sodium_constant(constant, name: constant, fallback: nil)
|
|
33
|
+
fn_name_components = ["crypto", sodium_type, sodium_primitive, constant.to_s.downcase]
|
|
34
|
+
fn_name = fn_name_components.compact.join("_")
|
|
35
|
+
|
|
36
|
+
begin
|
|
37
|
+
attach_function fn_name, [], :size_t
|
|
38
|
+
rescue FFI::NotFoundError
|
|
39
|
+
raise if fallback.nil?
|
|
40
|
+
|
|
41
|
+
define_singleton_method fn_name, -> { fallback }
|
|
42
|
+
end
|
|
43
|
+
|
|
44
|
+
const_set(name, public_send(fn_name))
|
|
40
45
|
end
|
|
41
46
|
|
|
42
47
|
def sodium_function(name, function, arguments)
|
data/lib/rbnacl/version.rb
CHANGED
|
@@ -0,0 +1,63 @@
|
|
|
1
|
+
# encoding: binary
|
|
2
|
+
# frozen_string_literal: true
|
|
3
|
+
|
|
4
|
+
RSpec.describe RbNaCl::SealedBox do
|
|
5
|
+
let(:alicepk) { vector :alice_public }
|
|
6
|
+
let(:alicesk) { vector :alice_private }
|
|
7
|
+
let(:alice_pubkey) { RbNaCl::PublicKey.new(alicepk) }
|
|
8
|
+
let(:alice_privkey) { RbNaCl::PrivateKey.new(alicesk) }
|
|
9
|
+
|
|
10
|
+
context "new" do
|
|
11
|
+
it "accepts public key strings" do
|
|
12
|
+
expect do
|
|
13
|
+
RbNaCl::SealedBox.from_public_key(alicepk)
|
|
14
|
+
end.to_not raise_error
|
|
15
|
+
end
|
|
16
|
+
|
|
17
|
+
it "accepts public KeyPairs" do
|
|
18
|
+
expect do
|
|
19
|
+
RbNaCl::SealedBox.from_public_key(alice_pubkey)
|
|
20
|
+
end.to_not raise_error
|
|
21
|
+
end
|
|
22
|
+
|
|
23
|
+
it "accepts private key strings" do
|
|
24
|
+
expect do
|
|
25
|
+
RbNaCl::SealedBox.from_private_key(alicepk)
|
|
26
|
+
end.to_not raise_error
|
|
27
|
+
end
|
|
28
|
+
|
|
29
|
+
it "accepts private KeyPairs" do
|
|
30
|
+
expect do
|
|
31
|
+
RbNaCl::SealedBox.from_private_key(alice_privkey)
|
|
32
|
+
end.to_not raise_error
|
|
33
|
+
end
|
|
34
|
+
|
|
35
|
+
it "raises TypeError on a nil public key" do
|
|
36
|
+
expect do
|
|
37
|
+
RbNaCl::SealedBox.from_public_key(nil)
|
|
38
|
+
end.to raise_error(TypeError)
|
|
39
|
+
end
|
|
40
|
+
|
|
41
|
+
it "raises RbNaCl::LengthError on an invalid public key" do
|
|
42
|
+
expect do
|
|
43
|
+
RbNaCl::SealedBox.from_public_key("hello")
|
|
44
|
+
end.to raise_error(RbNaCl::LengthError, /Public key was 5 bytes \(Expected 32\)/)
|
|
45
|
+
end
|
|
46
|
+
|
|
47
|
+
it "raises TypeError on a nil private key" do
|
|
48
|
+
expect do
|
|
49
|
+
RbNaCl::SealedBox.from_private_key(nil)
|
|
50
|
+
end.to raise_error(TypeError)
|
|
51
|
+
end
|
|
52
|
+
|
|
53
|
+
it "raises RbNaCl::LengthError on an invalid private key" do
|
|
54
|
+
expect do
|
|
55
|
+
RbNaCl::SealedBox.from_private_key("hello")
|
|
56
|
+
end.to raise_error(RbNaCl::LengthError, /Private key was 5 bytes \(Expected 32\)/)
|
|
57
|
+
end
|
|
58
|
+
end
|
|
59
|
+
|
|
60
|
+
include_examples "sealed_box" do
|
|
61
|
+
let(:box) { RbNaCl::SealedBox.new(alicepk, alicesk) }
|
|
62
|
+
end
|
|
63
|
+
end
|
|
@@ -0,0 +1,51 @@
|
|
|
1
|
+
RSpec.describe RbNaCl::Sodium do
|
|
2
|
+
subject(:sodium_class) do
|
|
3
|
+
class SodiumExtendedClass
|
|
4
|
+
extend RbNaCl::Sodium
|
|
5
|
+
|
|
6
|
+
sodium_type :auth
|
|
7
|
+
sodium_primitive :hmacsha512
|
|
8
|
+
# sodium_constant :BYTES
|
|
9
|
+
# sodium_constant :KEYBYTES
|
|
10
|
+
end
|
|
11
|
+
SodiumExtendedClass
|
|
12
|
+
end
|
|
13
|
+
|
|
14
|
+
context ".sodium_constant" do
|
|
15
|
+
it "retrieves the libsodium constant" do
|
|
16
|
+
sodium_class.sodium_constant :BYTES
|
|
17
|
+
expect(sodium_class::BYTES).to eq(64)
|
|
18
|
+
end
|
|
19
|
+
|
|
20
|
+
context "with alternate constant name" do
|
|
21
|
+
it "sets the alternate constant name" do
|
|
22
|
+
sodium_class.sodium_constant :BYTES, name: :COOL_BYTES
|
|
23
|
+
expect(sodium_class::COOL_BYTES).to eq(64)
|
|
24
|
+
end
|
|
25
|
+
end
|
|
26
|
+
|
|
27
|
+
context "when libsodium does not define the constant" do
|
|
28
|
+
it "raises an exception" do
|
|
29
|
+
expect do
|
|
30
|
+
sodium_class.sodium_constant :MIN_DANCING_PARTNERS
|
|
31
|
+
end.to raise_error(FFI::NotFoundError)
|
|
32
|
+
end
|
|
33
|
+
end
|
|
34
|
+
|
|
35
|
+
context "with fallback" do
|
|
36
|
+
context "when libsodium defines the constant" do
|
|
37
|
+
it "return the libsodium value" do
|
|
38
|
+
sodium_class.sodium_constant :BYTES, fallback: 888
|
|
39
|
+
expect(sodium_class::BYTES).to eq(64)
|
|
40
|
+
end
|
|
41
|
+
end
|
|
42
|
+
|
|
43
|
+
context "when libsodium does not define the constant" do
|
|
44
|
+
it "uses the fallback" do
|
|
45
|
+
sodium_class.sodium_constant :MAX_PANDAS, fallback: 24
|
|
46
|
+
expect(sodium_class::MAX_PANDAS).to eq(24)
|
|
47
|
+
end
|
|
48
|
+
end
|
|
49
|
+
end
|
|
50
|
+
end
|
|
51
|
+
end
|
|
@@ -0,0 +1,29 @@
|
|
|
1
|
+
# encoding: binary
|
|
2
|
+
# frozen_string_literal: true
|
|
3
|
+
|
|
4
|
+
RSpec.shared_examples "sealed_box" do
|
|
5
|
+
let(:message) { vector :box_message }
|
|
6
|
+
let(:ciphertext) { vector :box_ciphertext }
|
|
7
|
+
let(:corrupt_ciphertext) { ciphertext[80] = " " } # picked at random by fair diceroll
|
|
8
|
+
|
|
9
|
+
context "box" do
|
|
10
|
+
it "roundtrips" do
|
|
11
|
+
ciphertext = box.box(message)
|
|
12
|
+
expect(box.open(ciphertext)).to eq message
|
|
13
|
+
end
|
|
14
|
+
end
|
|
15
|
+
|
|
16
|
+
context "open" do
|
|
17
|
+
it "raises on a truncated message to decrypt" do
|
|
18
|
+
expect do
|
|
19
|
+
box.open(ciphertext[0, 64])
|
|
20
|
+
end.to raise_error(RbNaCl::CryptoError, /Decryption failed. Ciphertext failed verification./)
|
|
21
|
+
end
|
|
22
|
+
|
|
23
|
+
it "raises on a corrupt ciphertext" do
|
|
24
|
+
expect do
|
|
25
|
+
box.open(corrupt_ciphertext)
|
|
26
|
+
end.to raise_error(RbNaCl::CryptoError, /Decryption failed. Ciphertext failed verification./)
|
|
27
|
+
end
|
|
28
|
+
end
|
|
29
|
+
end
|
data/spec/spec_helper.rb
CHANGED
metadata
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: rbnacl
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 6.0.
|
|
4
|
+
version: 6.0.1
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- Tony Arcieri
|
|
@@ -9,7 +9,7 @@ authors:
|
|
|
9
9
|
autorequire:
|
|
10
10
|
bindir: bin
|
|
11
11
|
cert_chain: []
|
|
12
|
-
date:
|
|
12
|
+
date: 2019-01-27 00:00:00.000000000 Z
|
|
13
13
|
dependencies:
|
|
14
14
|
- !ruby/object:Gem::Dependency
|
|
15
15
|
name: ffi
|
|
@@ -73,6 +73,7 @@ files:
|
|
|
73
73
|
- lib/rbnacl/boxes/curve25519xsalsa20poly1305.rb
|
|
74
74
|
- lib/rbnacl/boxes/curve25519xsalsa20poly1305/private_key.rb
|
|
75
75
|
- lib/rbnacl/boxes/curve25519xsalsa20poly1305/public_key.rb
|
|
76
|
+
- lib/rbnacl/boxes/sealed.rb
|
|
76
77
|
- lib/rbnacl/group_elements/curve25519.rb
|
|
77
78
|
- lib/rbnacl/hash.rb
|
|
78
79
|
- lib/rbnacl/hash/blake2b.rb
|
|
@@ -108,6 +109,7 @@ files:
|
|
|
108
109
|
- spec/rbnacl/boxes/curve25519xsalsa20poly1305/private_key_spec.rb
|
|
109
110
|
- spec/rbnacl/boxes/curve25519xsalsa20poly1305/public_key_spec.rb
|
|
110
111
|
- spec/rbnacl/boxes/curve25519xsalsa20poly1305_spec.rb
|
|
112
|
+
- spec/rbnacl/boxes/sealed_spec.rb
|
|
111
113
|
- spec/rbnacl/group_element_spec.rb
|
|
112
114
|
- spec/rbnacl/hash/blake2b_spec.rb
|
|
113
115
|
- spec/rbnacl/hash_spec.rb
|
|
@@ -121,12 +123,14 @@ files:
|
|
|
121
123
|
- spec/rbnacl/signatures/ed25519/signing_key_spec.rb
|
|
122
124
|
- spec/rbnacl/signatures/ed25519/verify_key_spec.rb
|
|
123
125
|
- spec/rbnacl/simple_box_spec.rb
|
|
126
|
+
- spec/rbnacl/sodium_spec.rb
|
|
124
127
|
- spec/rbnacl/util_spec.rb
|
|
125
128
|
- spec/shared/aead.rb
|
|
126
129
|
- spec/shared/authenticator.rb
|
|
127
130
|
- spec/shared/box.rb
|
|
128
131
|
- spec/shared/hmac.rb
|
|
129
132
|
- spec/shared/key_equality.rb
|
|
133
|
+
- spec/shared/sealed_box.rb
|
|
130
134
|
- spec/shared/serializable.rb
|
|
131
135
|
- spec/spec_helper.rb
|
|
132
136
|
- tasks/rspec.rake
|
|
@@ -163,6 +167,7 @@ test_files:
|
|
|
163
167
|
- spec/rbnacl/boxes/curve25519xsalsa20poly1305/private_key_spec.rb
|
|
164
168
|
- spec/rbnacl/boxes/curve25519xsalsa20poly1305/public_key_spec.rb
|
|
165
169
|
- spec/rbnacl/boxes/curve25519xsalsa20poly1305_spec.rb
|
|
170
|
+
- spec/rbnacl/boxes/sealed_spec.rb
|
|
166
171
|
- spec/rbnacl/group_element_spec.rb
|
|
167
172
|
- spec/rbnacl/hash/blake2b_spec.rb
|
|
168
173
|
- spec/rbnacl/hash_spec.rb
|
|
@@ -176,11 +181,13 @@ test_files:
|
|
|
176
181
|
- spec/rbnacl/signatures/ed25519/signing_key_spec.rb
|
|
177
182
|
- spec/rbnacl/signatures/ed25519/verify_key_spec.rb
|
|
178
183
|
- spec/rbnacl/simple_box_spec.rb
|
|
184
|
+
- spec/rbnacl/sodium_spec.rb
|
|
179
185
|
- spec/rbnacl/util_spec.rb
|
|
180
186
|
- spec/shared/aead.rb
|
|
181
187
|
- spec/shared/authenticator.rb
|
|
182
188
|
- spec/shared/box.rb
|
|
183
189
|
- spec/shared/hmac.rb
|
|
184
190
|
- spec/shared/key_equality.rb
|
|
191
|
+
- spec/shared/sealed_box.rb
|
|
185
192
|
- spec/shared/serializable.rb
|
|
186
193
|
- spec/spec_helper.rb
|