ribbon-encrypted_store 0.1.5 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 1d3aaf094d554be5178e1d81b38408165cd02e88
-  data.tar.gz: 65fd270a315e816a1090f080b80ba9c5dbea421c
+  metadata.gz: 2ed9c1b5768713771553fc0ae858ba9230f12e7a
+  data.tar.gz: 4ca77eb35ee661056d33ad308f9a6132b7ea94d6
 SHA512:
-  metadata.gz: 393874c9a5123284c259e83191b20ae9307bddcee2743f8d446a6bb01b864d68165c0c9beb7f2763b0e0ebe205464c823a0d22d43dd992e141ba315ae68b04eb
-  data.tar.gz: ef0d1e2e453110e96310beb44b0e1d3caedbd87e99ea3b2cc41be99201e8ea7341e07f17c1d8f1cf1847680c0cd0eec3afac6e85206aab8cc650811edf9df66e
+  metadata.gz: 1abc59705a77c7d009823b388681a4e004a472308b6885012e6af6b59b65deeabc09daeddf56594e30affb21de333679bbf7cf84c4157b79d981acb0fa399551
+  data.tar.gz: b626cd351cdffbb155cebdc9c43fc30fed4f6e18c630e32c91ef4106a88ce289e325e5a04f62e9ee40f7784a3ca12d06a1adde53c614ed7bf61c9c5b75cd40bb

data/lib/ribbon/encrypted_store/crypto_hash.rb

@@ -11,32 +11,31 @@ module Ribbon::EncryptedStore
 
     ##
     # Encrypts the hash using the data encryption key and salt.
-    # Returns a blob:
-    #
-    # | Byte 0   |   Byte 1    | Bytes 2...S | Bytes S+1...E  | Bytes E+1..E+4 |
-    # --------------------------------------------------------------------------
-    # | Version  | Salt Length |     Salt    | Encrypted Data |     CRC32      |
     #
-    def encrypt(dek, salt)
+    # Returns a blob:
+    # | Byte 0   |   Byte 1    |        Byte 2       | Bytes 3...S | Bytes S+1...E  | Bytes E+1..E+4 |
+    # ------------------------------------------------------------------------------------------------
+    # | Version  | Salt Length | Iteration Magnitude |     Salt    | Encrypted Data |     CRC32      |
+    def encrypt(dek, salt, iter_mag=10)
       return nil if empty?
-      raise Errors::SaltTooBigError if salt.bytes.length > 255
+      raise Errors::InvalidSaltSize, 'too long' if salt.bytes.length > 255
 
-      key, iv = _keyiv_gen(dek, salt)
+      key, iv = _keyiv_gen(dek, salt, iter_mag)
 
       encryptor = OpenSSL::Cipher::AES256.new(:CBC).encrypt
       encryptor.key = key
       encryptor.iv = iv
 
-      data_packet = _encrypted_data_header(salt) + encryptor.update(self.to_json) + encryptor.final
+      data_packet = _encrypted_data_header_v2(salt, iter_mag) + encryptor.update(self.to_json) + encryptor.final
       _append_crc32(data_packet)
     end
 
     class << self
       def decrypt(dek, data)
         return CryptoHash.new unless data
-        salt, data = _split_binary_data(data)
+        salt, iter_mag, data = _split_binary_data(data)
 
-        key, iv = _keyiv_gen(dek, salt)
+        key, iv = _keyiv_gen(dek, salt, iter_mag)
 
         decryptor = OpenSSL::Cipher::AES256.new(:CBC).decrypt
         decryptor.key = key
@@ -47,12 +46,18 @@ module Ribbon::EncryptedStore
         CryptoHash.new(new_hash)
       end
 
-      def _keyiv_gen(key, salt)
-        digest = OpenSSL::Digest::SHA256.new
-        key_and_iv = OpenSSL::PKCS5.pbkdf2_hmac(key, salt, 4096, 48, digest)
+      def _keyiv_gen(key, salt, iter_mag)
+        if iter_mag == -1
+          raise Errors::InvalidKeySize, 'must be exactly 256 bits' unless key.bytes.length == 32
+          raise Errors::InvalidSaltSize, 'must be exactly 128 bits' unless salt.bytes.length == 16
+          iv = salt
+        else
+          digest = OpenSSL::Digest::SHA256.new
+          key_and_iv = OpenSSL::PKCS5.pbkdf2_hmac(key, salt, 1 << iter_mag, 48, digest)
 
-        key = key_and_iv[0..31]
-        iv  = key_and_iv[32..-1]
+          key = key_and_iv[0..31]
+          iv  = key_and_iv[32..-1]
+        end
 
         [key, iv]
       end
@@ -61,7 +66,18 @@ module Ribbon::EncryptedStore
         # Split encrypted data and CRC
         bytes = encrypted_data.bytes
 
-        version     = bytes[0]
+        version = bytes[0]
+        version_method = "_split_binary_data_v#{version}"
+
+        if respond_to?(version_method)
+          send(version_method, encrypted_data)
+        else
+          raise Errors::UnsupportedVersionError, "Unsupported encrypted data version: #{version}"
+        end
+      end
+
+      def _split_binary_data_v1(encrypted_data)
+        bytes = encrypted_data.bytes
         salt_length = bytes[1]
 
         salt_start_index = 2
@@ -72,9 +88,26 @@ module Ribbon::EncryptedStore
         crc = bytes[-4..-1]
         raise Errors::ChecksumFailedError unless crc == _calc_crc32(encrypted_data[0..-5]).bytes
 
-        [salt, data]
+        [salt, 12, data]
+      end
+
+      def _split_binary_data_v2(encrypted_data)
+        bytes = encrypted_data.bytes
+        salt_length = bytes[1]
+        iter_mag    = bytes[2].chr.unpack('c').first
+
+        salt_start_index = 3
+        salt_end_index   = salt_start_index + salt_length - 1
+        salt = bytes[salt_start_index..salt_end_index].pack('c*')
+        data = bytes[salt_end_index+1..-5].pack('c*')
+
+        crc = bytes[-4..-1]
+        raise Errors::ChecksumFailedError unless crc == _calc_crc32(encrypted_data[0..-5]).bytes
+
+        [salt, iter_mag, data]
       end
 
+
       def _calc_crc32(data)
         [Zlib.crc32(data)].pack('N')
       end
@@ -83,17 +116,27 @@ module Ribbon::EncryptedStore
     private
 
     ##
-    # Generates the encrypted data header:
+    # Generates the version 1 encrypted data header:
     # |     Byte 0     |     Byte 1     |  Bytes 2...S
     # ---------------------------------------------------
     # |    Version     |   Salt Length  |     Salt
     #
-    def _encrypted_data_header(salt)
+    def _encrypted_data_header_v1(salt)
       "\x01" + salt.bytes.length.chr + salt
     end
 
-    def _keyiv_gen(key, salt)
-      self.class._keyiv_gen(key, salt)
+    ##
+    # Generates the version 2 encrypted data header:
+    # |     Byte 0     |     Byte 1     |         Byte 2       | Bytes 3...S
+    # ----------------------------------------------------------------------
+    # |    Version     |   Salt Length  |  Iteration Magnitude |    Salt
+    #
+    def _encrypted_data_header_v2(salt, iter_mag)
+      "\x02" + salt.bytes.length.chr + [iter_mag].pack('c') + salt
+    end
+
+    def _keyiv_gen(key, salt, iter_mag)
+      self.class._keyiv_gen(key, salt, iter_mag)
     end
 
     def _append_crc32(data)

data/lib/ribbon/encrypted_store/errors.rb

@@ -9,6 +9,8 @@ module Ribbon::EncryptedStore
     # CryptoHash Errors
     class CryptoHashError < Error; end
     class ChecksumFailedError < CryptoHashError; end
-    class SaltTooBigError < CryptoHashError; end
+    class InvalidSaltSize < CryptoHashError; end
+    class InvalidKeySize < CryptoHashError; end
+    class UnsupportedVersionError < CryptoHashError; end
   end # Errors
-end # Ribbon::EncryptedStore
+end # Ribbon::EncryptedStore

data/lib/ribbon/encrypted_store/mixins/active_record_mixin.rb

@@ -35,7 +35,7 @@ module Ribbon::EncryptedStore
 
         def attr_encrypted(*args)
           # Store attrs in class data
-          _encrypted_store_data[:encrypted_attributes] = args
+          _encrypted_store_data[:encrypted_attributes] = args.map(&:to_sym)
 
           args.each { |arg|
             define_method(arg) { _encrypted_store_get(arg) }
@@ -83,7 +83,7 @@ module Ribbon::EncryptedStore
       end
 
       def _encrypted_store_save
-        if !(self.changed & _encrypted_store_data[:encrypted_attributes]).empty? || @_reencrypting
+        if !(self.changed.map(&:to_sym) & _encrypted_store_data[:encrypted_attributes]).empty? || @_reencrypting
           # Obtain a lock without overriding attribute values for this record.
           record = self.class.unscoped { self.class.lock.find(id) } unless new_record?
 
@@ -91,8 +91,16 @@ module Ribbon::EncryptedStore
             self.encryption_key_id = record.encryption_key_id if record && record.encryption_key_id
           end
 
+          iter_mag = Ribbon::EncryptedStore.config.iteration_magnitude? ?
+                     Ribbon::EncryptedStore.config.iteration_magnitude  :
+                     -1
+
           @_reencrypting = false
-          self.encrypted_store = _crypto_hash.encrypt(_decrypted_key, EncryptionKeySalt.generate_salt(_encryption_key_id))
+          self.encrypted_store = _crypto_hash.encrypt(
+            _decrypted_key,
+            EncryptionKeySalt.generate_salt(_encryption_key_id),
+            iter_mag
+          )
         end
       end
     end # ActiveRecordMixin

data/lib/ribbon/encrypted_store/version.rb

@@ -1,5 +1,5 @@
 module Ribbon
   module EncryptedStore
-    VERSION = '0.1.5'
+    VERSION = '0.2.0'
   end # EncryptedStore
 end # Ribbon

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ribbon-encrypted_store
 version: !ruby/object:Gem::Version
-  version: 0.1.5
+  version: 0.2.0
 platform: ruby
 authors:
 - Robert Honer
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-07-24 00:00:00.000000000 Z
+date: 2015-10-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bcrypt