rijn 0.4.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: b05fbe9b7b93479f4b3d616eb912861ffb0b6b4c2e07fe5f08855fa0573aa910
+  data.tar.gz: ad55b729ca1f5340b631e4478dcc705963b00106e6a9881e1b30849c83cc8ab8
+SHA512:
+  metadata.gz: ece30634d9831a34c2930be796ad886856020e6ffbc558990c745f54e712aa8619690f8488587b40dd92a12cdaf5e751f3cd8d6f863e14bf2622c11fc6fecc75
+  data.tar.gz: 05f419640048b8c140b816bc10864f6ca8141f07e7c990ae29363e555b8da6a952ed5f2aa7339261aadf9813b565e562da8a4258f116e6c75a561e8015047d30

data/LICENSE.md

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Matthew Moritz
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

data/bin/rijn

@@ -0,0 +1,8 @@
+#!/usr/bin/env ruby
+
+$LOAD_PATH.unshift File.expand_path("../lib", __dir__)
+
+require "rijn_cli"
+
+Signal.trap("INT") { puts; exit 130 }
+RijnCLI.start(ARGV)

data/lib/rijn/crypto.rb

@@ -0,0 +1,116 @@
+require "base64"
+require "openssl"
+require "securerandom"
+
+module Rijn
+  KEY_LENGTHS = {
+    128 => 16,
+    192 => 24,
+    256 => 32
+  }.freeze
+
+  CIPHERS = {
+    16 => "aes-128-gcm",
+    24 => "aes-192-gcm",
+    32 => "aes-256-gcm"
+  }.freeze
+
+  # Rijn uses a 12-byte nonce for AES-GCM.
+  NONCE_LENGTH = 12
+
+  # Rijn stores a 16-byte authentication tag.
+  AUTH_TAG_LENGTH = 16
+
+  # Generates a cryptographically secure AES-GCM encryption key.
+  #
+  # @param bits [Integer] key size in bits; must be 128, 192, or 256
+  # @return [String] Base64-encoded encryption key
+  # @raise [InvalidKeyError] if the key size is unsupported
+  def self.generate_key(bits = 256)
+    length = KEY_LENGTHS.fetch(bits) do
+      raise InvalidKeyError, "Key must be 128, 192, or 256 bits."
+    end
+
+    Base64.strict_encode64(SecureRandom.random_bytes(length))
+  end
+
+  # Encrypts a value using AES-GCM.
+  #
+  # @param value [String] the plaintext value to encrypt
+  # @param key [String] Base64-encoded encryption key (128, 192, or 256 bits)
+  # @return [String] Base64-encoded encrypted value
+  # @raise [InvalidKeyError] if the key is invalid
+  def self.encrypt(value, key)
+    key = decode_key(key)
+    validate_key!(key)
+
+    cipher = cipher_for(key)
+    cipher.encrypt
+
+    nonce = SecureRandom.random_bytes(NONCE_LENGTH)
+
+    cipher.key = key
+    cipher.iv = nonce
+
+    ciphertext = cipher.update(value) + cipher.final
+
+    tag = cipher.auth_tag
+
+    Base64.strict_encode64(nonce + ciphertext + tag)
+  end
+
+  # Decrypts a value encrypted with AES-GCM.
+  #
+  # @param encrypted_value [String] Base64-encoded encrypted value
+  # @param key [String] Base64-encoded encryption key (128, 192, or 256 bits)
+  # @return [String] the decrypted plaintext value
+  # @raise [InvalidKeyError] if the key is invalid
+  # @raise [AuthenticationError] if the encrypted value fails authentication
+  def self.decrypt(encrypted_value, key)
+    key = decode_key(key)
+    validate_key!(key)
+
+    # Rijn stores encrypted values as:
+    #
+    #   nonce (12 bytes) + ciphertext + authentication tag (16 bytes)
+    #
+    # The nonce is not secret and is required for decryption.
+    # The authentication tag is used by AES-GCM to verify the ciphertext.
+    decoded = Base64.strict_decode64(encrypted_value)
+
+    nonce = decoded.byteslice(0, NONCE_LENGTH)
+    ciphertext = decoded.byteslice(NONCE_LENGTH...-AUTH_TAG_LENGTH)
+    tag = decoded.byteslice(-AUTH_TAG_LENGTH, AUTH_TAG_LENGTH)
+
+    cipher = cipher_for(key)
+    cipher.decrypt
+
+    cipher.key = key
+    cipher.iv = nonce
+    cipher.auth_tag = tag
+
+    begin
+      cipher.update(ciphertext) + cipher.final
+    rescue OpenSSL::Cipher::CipherError
+      raise AuthenticationError, "Unable to decrypt value."
+    end
+  end
+
+  private
+
+  def self.decode_key(key)
+    Base64.strict_decode64(key)
+  rescue ArgumentError
+    raise InvalidKeyError, "Key is not valid Base64."
+  end
+
+  def self.validate_key!(key)
+    unless KEY_LENGTHS.value?(key.bytesize)
+      raise InvalidKeyError, "Key must be 128, 192, or 256 bits."
+    end
+  end
+
+  def self.cipher_for(key)
+    OpenSSL::Cipher.new(CIPHERS.fetch(key.bytesize))
+  end
+end

data/lib/rijn/errors.rb

@@ -0,0 +1,9 @@
+module Rijn
+  # Raised when an encryption key is invalid.
+  class InvalidKeyError < StandardError
+  end
+
+  # Raised when an encrypted value cannot be authenticated during decryption.
+  class AuthenticationError < StandardError
+  end
+end

data/lib/rijn/version.rb

@@ -0,0 +1,4 @@
+module Rijn
+  # The current version of the Rijn library.
+  VERSION = "0.4.0"
+end

data/lib/rijn.rb

@@ -0,0 +1,3 @@
+require "rijn/version"
+require "rijn/errors"
+require "rijn/crypto"

data/lib/rijn_cli.rb

@@ -0,0 +1,71 @@
+require "rijn"
+require "pastel"
+require "thor"
+require "tty-prompt"
+
+PROMPT = TTY::Prompt.new(interrupt: -> { puts; exit(130) })
+PASTEL = Pastel.new
+
+class RijnCLI < Thor
+  def self.exit_on_failure?
+    true
+  end
+
+  desc "version", "Display the version."
+  def version
+    write_info(Rijn::VERSION)
+  end
+
+  desc "decrypt", "Decrypt an AES-GCM value."
+  option :value, aliases: "-v"
+  option :key, aliases: "-k"
+  def decrypt
+    value = options[:value] || prompt_ask("What's the value?")
+    key = options[:key] || prompt_mask("What's the key?")
+
+    write_info(Rijn.decrypt(value, key))
+  rescue Rijn::InvalidKeyError, Rijn::AuthenticationError => e
+    write_error(e.message)
+    exit 1
+  end
+
+  desc "encrypt", "Encrypt a value using AES-GCM."
+  option :value, aliases: "-v"
+  option :key, aliases: "-k"
+  def encrypt
+    value = options[:value] || prompt_ask("What's the value?")
+    key = options[:key] || prompt_mask("What's the key?")
+
+    write_info(Rijn.encrypt(value, key))
+  rescue Rijn::InvalidKeyError, Rijn::AuthenticationError => e
+    write_error(e.message)
+    exit 1
+  end
+
+  desc "keygen", "Generate a new encryption key."
+  option :bits, aliases: "-b", type: :numeric, default: 256, desc: "The number of bits for the key (128, 192, or 256)."
+  def keygen
+    write_info(Rijn.generate_key(options[:bits]))
+  rescue Rijn::InvalidKeyError => e
+    write_error(e.message)
+    exit 1
+  end
+
+  private
+
+  def prompt_ask(message)
+    PROMPT.ask(PASTEL.cyan(message))
+  end
+
+  def prompt_mask(message)
+    PROMPT.mask(PASTEL.cyan(message))
+  end
+
+  def write_info(message)
+    puts message
+  end
+
+  def write_error(message)
+    $stderr.puts PASTEL.red("Error: #{message}")
+  end
+end

metadata

@@ -0,0 +1,106 @@
+--- !ruby/object:Gem::Specification
+name: rijn
+version: !ruby/object:Gem::Version
+  version: 0.4.0
+platform: ruby
+authors:
+- matthew-moritz
+bindir: bin
+cert_chain: []
+date: 1980-01-02 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: base64
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: pastel
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: thor
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: tty-prompt
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+description: A small Ruby library and CLI for AES-GCM encryption, supporting 128-bit,
+  192-bit, and 256-bit keys.
+executables:
+- rijn
+extensions: []
+extra_rdoc_files: []
+files:
+- LICENSE.md
+- bin/rijn
+- lib/rijn.rb
+- lib/rijn/crypto.rb
+- lib/rijn/errors.rb
+- lib/rijn/version.rb
+- lib/rijn_cli.rb
+homepage: https://github.com/matthew-moritz/rijn
+licenses:
+- MIT
+metadata:
+  source_code_uri: https://github.com/matthew-moritz/rijn
+  bug_tracker_uri: https://github.com/matthew-moritz/rijn/issues
+  rubygems_mfa_required: 'true'
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '3.4'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 4.0.18
+specification_version: 4
+summary: A small CLI for AES-GCM encryption
+test_files: []