rom_encrypted_attribute 0.0.2 → 0.0.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a969ae5d8669ac0bba27f0ba1aeb8ad53b42962c4a63dea849033f3398ea0048
-  data.tar.gz: 752b299f84b9a569983e7b937fb8588f404572032d4fd58d64a022399ffbeb98
+  metadata.gz: d8f15d21dd70764715c289e7a5c6bc687066517b188b3457a94fc1913f0d09fd
+  data.tar.gz: e3b106612840731afffb3ea6fc6df41d142e1f68e5f0f3f349a81b8e89338006
 SHA512:
-  metadata.gz: a8a2e9a6dbebf654fff5349968e66b8a77909720ffedafeb1dfa9e7232d789c758123c36f078266fd6895fbacebed1d79a8aa78e439450bcb437cd6cbcdbfe80
-  data.tar.gz: 414fbbf17de5976ec4940f1d4244dc215f1b6ebfb3d4b98d80c2c72ba574c9ebe79a48d5db1b8960ef302f3320afcf1e6e19ee1845d228c81865c4b09587b14e
+  metadata.gz: 4a11a62105323e121bad0b230267ad796233dc7638e2f570bf290ec4c427572db0f93c9f20d8ee44e18984bba32a40b6daedbc5c36ea10efc581c8f272172669
+  data.tar.gz: 4d74d25778f535512b170cfbce064f0fe38861f4e66fd6b86feda8530e981180ca1fe63db24b57125556e18d61c550f8564cc9038df52908f9932da8e2c42dca

data/README.md

@@ -36,13 +36,29 @@ class SecretNotes < ROM::Relation[:sql]
 end
 ```
 
-Of course, you can define it somewhere else and just `include` in the relation or use your custom types code organization.
+By default the gem uses SHA1 for key derivation (same as Rails' default), but you can configure it by passing custom `has_digest_class` option.
+
+``` ruby
+class SecretNotes < ROM::Relation[:sql]
+  EncryptedString, EncryptedStringReader =
+    RomEncryptedAttribute.define_encrypted_attribute_types(
+      primary_key: ENV["ENCRYPTION_PRIMARY_KEY"],
+      key_derivation_salt: ENV["ENCRYPTION_KEY_DERIVATION_SALT"],
+      hash_digest_class: OpenSSL::Digest::SHA256
+    )
+    
+  schema(:secret_notes, infer: true) do
+    attribute :content, EncryptedString, read: EncryptedStringReader
+  end
+end
+
+```
 
 ### Caveats
 
-* Due to a bug in `rom-sql`, reading unencrypted data is turned on by default
-* The gem uses SHA256 for key derivation and it's currently not configurable
+* Due to [a bug](https://github.com/rom-rb/rom-sql/issues/423) in `rom-sql`, reading unencrypted data is always supported, which means that if there's a plain not-encrypted data in your database already, it will be read correctly. This might or might not be desirable, but for the time being there's no choice in cofiguring this behaviour.
 * Support for deterministic encryption from `ActiveRecord::Encryption` is not implemented
+* Support for key rotation is not implemented
 
 ## Contributing
 

data/lib/rom_encrypted_attribute/decryptor.rb

@@ -2,13 +2,12 @@
 
 require "base64"
 require "json"
-require_relative "key_derivator"
 require_relative "payload"
 
 module RomEncryptedAttribute
   class Decryptor
-    def initialize(secret:, salt:)
-      @derivator = KeyDerivator.new(secret: secret, salt: salt)
+    def initialize(derivator:)
+      @derivator = derivator
     end
 
     def decrypt(message)

data/lib/rom_encrypted_attribute/encryptor.rb

@@ -3,13 +3,12 @@
 require "base64"
 require "json"
 require "openssl"
-require_relative "key_derivator"
 require_relative "payload"
 
 module RomEncryptedAttribute
   class Encryptor
-    def initialize(secret:, salt:)
-      @derivator = KeyDerivator.new(secret: secret, salt: salt)
+    def initialize(derivator:)
+      @derivator = derivator
     end
 
     def encrypt(message)

data/lib/rom_encrypted_attribute/key_derivator.rb

@@ -4,16 +4,17 @@ require "openssl"
 
 module RomEncryptedAttribute
   class KeyDerivator
-    DIGEST_CLASS = OpenSSL::Digest::SHA256
+    DEFAULT_DIGEST_CLASS = OpenSSL::Digest::SHA1
     ITERATIONS = 2**16
 
-    def initialize(secret:, salt:)
+    def initialize(secret:, salt:, hash_digest_class: DEFAULT_DIGEST_CLASS)
       @secret = secret
       @salt = salt
+      @hash_digest_class = hash_digest_class
     end
 
     def derive(size)
-      OpenSSL::PKCS5.pbkdf2_hmac(@secret, @salt, ITERATIONS, size, DIGEST_CLASS.new)
+      OpenSSL::PKCS5.pbkdf2_hmac(@secret, @salt, ITERATIONS, size, @hash_digest_class.new)
     end
   end
 end

data/lib/rom_encrypted_attribute/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module RomEncryptedAttribute
-  VERSION = "0.0.2"
+  VERSION = "0.0.3"
 end

data/lib/rom_encrypted_attribute.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require_relative "rom_encrypted_attribute/key_derivator"
 require_relative "rom_encrypted_attribute/decryptor"
 require_relative "rom_encrypted_attribute/encryptor"
 require_relative "rom_encrypted_attribute/version"
@@ -7,13 +8,15 @@ require_relative "rom_encrypted_attribute/version"
 require "dry/types"
 
 module RomEncryptedAttribute
-  def self.define_encrypted_attribute_types(primary_key:, key_derivation_salt:)
+  def self.define_encrypted_attribute_types(primary_key:, key_derivation_salt:, hash_digest_class: OpenSSL::Digest::SHA1)
+    key_derivator = KeyDerivator.new(salt: key_derivation_salt, secret: primary_key, hash_digest_class: hash_digest_class)
+
     reader_type = Dry.Types.Constructor(String) do |value|
-      RomEncryptedAttribute::Decryptor.new(secret: primary_key, salt: key_derivation_salt).decrypt(value)
+      RomEncryptedAttribute::Decryptor.new(derivator: key_derivator).decrypt(value)
     end
 
     writer_type = Dry.Types.Constructor(String) do |value|
-      RomEncryptedAttribute::Encryptor.new(secret: primary_key, salt: key_derivation_salt).encrypt(value)
+      RomEncryptedAttribute::Encryptor.new(derivator: key_derivator).encrypt(value)
     end
 
     [writer_type, reader_type]

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rom_encrypted_attribute
 version: !ruby/object:Gem::Version
-  version: 0.0.2
+  version: 0.0.3
 platform: ruby
 authors:
 - Paweł Świątkowski
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2023-11-12 00:00:00.000000000 Z
+date: 2024-03-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dry-types
@@ -104,7 +104,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.4.21
+rubygems_version: 3.5.6
 signing_key:
 specification_version: 4
 summary: Encrypted attributes for ROM