scl 0.1.1 → 0.1.2
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/README.md +340 -43
- data/lib/scl/control/controller_module.rb +1 -1
- data/lib/scl/rsa.rb +5 -3
- data/lib/scl/version.rb +1 -1
- data/scl.gemspec +2 -0
- metadata +30 -2
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA1:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: 080e472a9874a3ee618ec91de8fd083825d2d275
|
4
|
+
data.tar.gz: dca1db910c0355c6eec7c51a14d0185ef6578f49
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: 39e48b23ee2164f137a67d62d197d5bbc6a5b2755e2ae12f7f599ae3c1783bacebf39bb21daece408e186daa2c58e1f7cfc08964350513001937b03b9e5766c4
|
7
|
+
data.tar.gz: 75a536626d6845431fc562b5650b89094ccbb2ca0ff2b0ae108972313972c0d2143b0001af84aaac784a380f09fa397e835900ccdf1523ae1ad4527b62ea86c7
|
data/README.md
CHANGED
@@ -1,22 +1,26 @@
|
|
1
1
|
# Scl (Simple Crypto Library)
|
2
2
|
|
3
|
+
[![scl](https://img.shields.io/badge/scl--green.svg)](https://github.com/wouterken/scl)
|
4
|
+
[![Gem Version](https://badge.fury.io/rb/scl.svg)](http://badge.fury.io/rb/scl)
|
5
|
+
[![Downloads](https://img.shields.io/gem/dt/scl/stable.svg)](https://img.shields.io/gem/dt/scl)
|
6
|
+
|
3
7
|
Scl is the Ruby *Simple Cryptography Library*. It comes with both a library for use in a Ruby codebase and a fully featured command line tool for all of your basic cryptography needs.
|
4
8
|
|
5
|
-
As anybody in the crypto
|
9
|
+
As anybody in the crypto space knows, using a cryptography library that has not been extensively audited and battle-tested in a security critical system is asking for trouble, hence:<br/>
|
6
10
|
**This library is intended for use in hobbyist projects or educational purposes. Use at own risk**
|
7
11
|
|
8
|
-
For much of its functionality
|
12
|
+
For much of its functionality the library is simply a fairly thin wrapper over OpenSSL functions and primitives and therefore should be quite robust and performant. It couples this with a clean and easy to use API, making it a fantastic tool to learn about what cryptography has to offer.
|
9
13
|
|
10
14
|
With learning in mind it covers some of the most widely used and exciting functionality offered to us by cryptography.
|
11
15
|
|
12
16
|
* [Diffie Hellman key-exchange](#diffie-hellman-key-exchange)
|
13
|
-
* [Public-key encryption (RSA)](#
|
14
|
-
* [Public-key verification (RSA)](#
|
17
|
+
* [Public-key encryption (RSA)](#rsaencryption)
|
18
|
+
* [Public-key verification (RSA)](#rsaverification)
|
15
19
|
* [Shamirs secret sharing](#shamirs-secret-sharing)
|
16
|
-
* [AES Block Cipher Encryption](#aes-encryption)
|
20
|
+
* [AES Block Cipher Encryption](#aes-cbc-encryption)
|
17
21
|
* [HMAC and Digests](#hmac-and-digests)
|
18
22
|
|
19
|
-
This tool provides basic insight around what each of the above has to offer us
|
23
|
+
This tool provides basic insight around what each of the above has to offer us and how you might potentially use these in unison to offer secure and/or verifiable solutions. Each of the above modules can be used from the command line interface or imported directly into your code.
|
20
24
|
|
21
25
|
## Installation
|
22
26
|
|
@@ -34,6 +38,10 @@ Or install it yourself as:
|
|
34
38
|
|
35
39
|
$ gem install scl
|
36
40
|
|
41
|
+
If you have your Ruby installations `bin` directory added to your path you should now also have access to the `scl` executable. To verify, try and execute
|
42
|
+
|
43
|
+
`scl -h`
|
44
|
+
|
37
45
|
## Usage (per module)
|
38
46
|
|
39
47
|
### Diffie Hellman Key Exchange
|
@@ -42,15 +50,62 @@ Diffie–Hellman key exchange (D–H) is a method of securely exchanging cryptog
|
|
42
50
|
|
43
51
|
#### How do I use it?
|
44
52
|
##### CLI
|
53
|
+
```bash
|
54
|
+
# Help
|
55
|
+
scl dh -h
|
56
|
+
scl dh syn -h
|
57
|
+
scl dh ack -h
|
58
|
+
scl dh fin -h
|
59
|
+
|
60
|
+
syn. Step 1 of a diffie hellman exchange.
|
61
|
+
Generates a private and public key and der to be used to generate a symmetric key with a second party.
|
62
|
+
|
63
|
+
e.g
|
64
|
+
>> Using public key (Saves to [filename].enc by default, unless -o is used)
|
65
|
+
scl dh syn
|
66
|
+
scl dh syn -fbase64
|
67
|
+
scl dh syn -o ./dhell
|
68
|
+
|
69
|
+
ack. Step 2 of a diffie hellman exchange.
|
70
|
+
Requires the public output of step 1 (The der and public key)
|
71
|
+
Generates a private and public key and der to be used to generate a symmetric key with a second party.
|
72
|
+
|
73
|
+
The output [output_file].key contains the secret key generated by the DH exchange.
|
74
|
+
The public output [output_file].dh2.pub must be passed back to the first party to complete the exchange
|
75
|
+
e.g
|
76
|
+
>> Using public key (Saves to [filename].enc by default, unless -o is used)
|
77
|
+
scl dh ack ./dh-key-exchange.dh1.pub
|
78
|
+
scl dh ack ./dhell.dh1.pub -o ./dhell
|
79
|
+
|
80
|
+
|
81
|
+
fin. Step 3 and final step of a diffie hellman exchange.
|
82
|
+
Requires the private output of step 1 (The der and private key) and the public key from step 2
|
83
|
+
Generates a secret key shared with the second party
|
84
|
+
|
85
|
+
The output [output_file].key contains the secret key generated by the DH exchange.
|
86
|
+
|
87
|
+
e.g
|
88
|
+
>> Using public key (Saves to [filename].enc by default, unless -o is used)
|
89
|
+
scl dh fin ./dh-key-exchange.dh1.priv ./dh-key-exchange.dh2.pub
|
90
|
+
scl dh fin ./dhell.dh1.priv ./dhell.dh2.pub -o ./dhell
|
91
|
+
```
|
45
92
|
##### Library
|
93
|
+
```ruby
|
94
|
+
dh1 = Scl::DH.new
|
95
|
+
dh2 = Scl::DH.new # Could be on a different machine
|
96
|
+
syn = dh1.syn
|
97
|
+
ack = dh2.ack(syn[:public])
|
98
|
+
key_1 = ack[:private][:shared_key]
|
99
|
+
fin = dh1.fin(ack[:public].merge(syn[:private]))
|
100
|
+
key_2 = fin[:private][:shared_key]
|
101
|
+
key_2 == key_1
|
102
|
+
```
|
46
103
|
#### Why is it great?
|
47
104
|
* You can agree on a shared secret on a public-channel without exposing anything to an eavesdropper.
|
48
105
|
* This means you do not need to trust your communication channel for it to be effective! (You could securely communicate using snail mail, smoke signals, carrier pigeons) and as long as both parties to the transmission properly secure the generated private and shared keys of the exchange you can know your communication is secure and private
|
49
106
|
* You do not need to share any secrets to complete the exchange.
|
50
107
|
* You can negotitate a new secret per transmission for perfect forward secrecy
|
51
108
|
|
52
|
-
#### How does it work?
|
53
|
-
|
54
109
|
### RSA(Encryption)
|
55
110
|
#### What is it?
|
56
111
|
RSA can be used to encrypt and decrypt messages utilising public-key cryptography.
|
@@ -59,15 +114,64 @@ Public key cryptography, or asymmetrical cryptography, is any cryptographic syst
|
|
59
114
|
|
60
115
|
#### How do I use it?
|
61
116
|
##### CLI
|
117
|
+
|
118
|
+
```bash
|
119
|
+
scl rsa generate -h
|
120
|
+
scl rsa encrypt -h
|
121
|
+
scl rsa decrypt -h
|
122
|
+
|
123
|
+
generate.
|
124
|
+
Usage: scl rsa generate (options)
|
125
|
+
|
126
|
+
Generates an RSA keypair
|
127
|
+
e.g
|
128
|
+
>> Generates a key-pair and prints to stdout
|
129
|
+
$ scl rsa generate
|
130
|
+
|
131
|
+
>> Generates a key-pair and saves to the filesystem
|
132
|
+
$ scl rsa generate -o /path/to/file
|
133
|
+
|
134
|
+
encrypt.
|
135
|
+
Encrypts a file.
|
136
|
+
e.g
|
137
|
+
>> Using public key (Saves to [filename].enc by default, unless -o is used)
|
138
|
+
scl rsa encrypt -p /path/to/public_key /path/to/file
|
139
|
+
scl rsa encrypt --pub-key /path/to/public_key /path/to/file
|
140
|
+
|
141
|
+
>> Using public key (Saves to [filename].enc by default, unless -o is used)
|
142
|
+
scl rsa encrypt -Z /path/to/private_key /path/to/file
|
143
|
+
scl rsa encrypt --priv-key /path/to/private_key /path/to/file
|
144
|
+
|
145
|
+
decrypt.
|
146
|
+
Decrypts a file.
|
147
|
+
e.g
|
148
|
+
>> Using public key (Writes to stdout unless -o is used)
|
149
|
+
scl rsa decrypt -p /path/to/public_key /path/to/file.enc
|
150
|
+
scl rsa decrypt --pub-key /path/to/public_key /path/to/file.enc
|
151
|
+
|
152
|
+
>> Using public key (Writes to stdout unless -o is used)
|
153
|
+
scl rsa decrypt -Z /path/to/private_key /path/to/file.enc
|
154
|
+
scl rsa decrypt --priv-key /path/to/private_key /path/to/file.enc
|
155
|
+
|
156
|
+
```
|
62
157
|
##### Library
|
158
|
+
```ruby
|
159
|
+
key_pair = Scl::RSA.generate(1024)
|
160
|
+
signature = key_pair.private.sign('Some value')
|
161
|
+
key_pair.public.verify(signature, 'Other Value')
|
162
|
+
# => false
|
163
|
+
key_pair.public.verify(signature, 'Some value')
|
164
|
+
# => true
|
165
|
+
|
166
|
+
key_pair.save('/Users/pico/Desktop', 'keypair')
|
167
|
+
key_pair2 = Scl::RSA.new(file: '/Users/pico/Desktop/keypair') # loads [file].pub and/or [file].priv. Both keys do not need to be present
|
168
|
+
```
|
63
169
|
#### Why is it great?
|
64
170
|
* You can use your private key to prove a message came from you
|
65
171
|
* Anyone can use your public key to construct a message for your eyes only
|
66
172
|
* You can establish secure communications between two or more parties without the need to engage in a key-negotiation process
|
67
173
|
* See also RSA(Verification)
|
68
174
|
|
69
|
-
#### How does it work?
|
70
|
-
|
71
175
|
### RSA(Verification)
|
72
176
|
#### What is it?
|
73
177
|
RSA can be used to generate digital signatures for a message and to compare a given signature with one generated from a digital message.
|
@@ -75,67 +179,255 @@ RSA can be used to generate digital signatures for a message and to compare a gi
|
|
75
179
|
A digital signature is a mathematical scheme for demonstrating the authenticity of digital messages or documents. A valid digital signature gives a recipient reason to believe that the message was created by a known sender (authentication), that the sender cannot deny having sent the message (non-repudiation), and that the message was not altered in transit (integrity)<sup>[[3]]</sup>
|
76
180
|
#### How do I use it?
|
77
181
|
##### CLI
|
182
|
+
```bash
|
183
|
+
scl rsa generate -h
|
184
|
+
scl rsa sign -h
|
185
|
+
scl rsa verify -h
|
186
|
+
|
187
|
+
generate.
|
188
|
+
Usage: scl rsa generate (options)
|
189
|
+
|
190
|
+
Generates an RSA keypair
|
191
|
+
e.g
|
192
|
+
>> Generates a key-pair and prints to stdout
|
193
|
+
$ scl rsa generate
|
194
|
+
|
195
|
+
>> Generates a key-pair and saves to the filesystem
|
196
|
+
$ scl rsa generate -o /path/to/file
|
197
|
+
|
198
|
+
sign.
|
199
|
+
Usage: scl rsa sign (options)
|
200
|
+
|
201
|
+
Signs a file using an RSA private key.
|
202
|
+
This file can then be verified using the corresponding public-key or the same private-key
|
203
|
+
e.g
|
204
|
+
>> Sign [file] using private key
|
205
|
+
$ scl rsa sign file -Z /path/to/private/key
|
206
|
+
|
207
|
+
verify.
|
208
|
+
Usage: scl rsa verify (options)
|
209
|
+
|
210
|
+
Verifies a file matches a signature for an RSA private key
|
211
|
+
Verification can be performed using the corresponding public-key or the same private-key that generated the signature
|
212
|
+
e.g
|
213
|
+
|
214
|
+
>> Verify [file] using public key
|
215
|
+
$ scl rsa verify -p /path/to/private/key file file.sig
|
216
|
+
$ scl rsa verify --pub-key /path/to/private/key file file.sig
|
217
|
+
|
218
|
+
>> Verify [file] using private key
|
219
|
+
$ scl rsa verify -Z /path/to/private/key file file.sig
|
220
|
+
|
221
|
+
|
222
|
+
```
|
78
223
|
##### Library
|
224
|
+
```ruby
|
225
|
+
key_pair = Scl::RSA.generate(1024)
|
226
|
+
encrypted = key_pair.public.encrypt('Some message')
|
227
|
+
decrypted = key_pair.private.decrypt(encrypted)
|
228
|
+
# => "Some Message"
|
229
|
+
|
230
|
+
key_pair.save('/Users/pico/Desktop', 'keypair')
|
231
|
+
key_pair2 = Scl::RSA.new(file: '/Users/pico/Desktop/keypair') # loads [file].pub and/or [file].priv. Both keys do not need to be present
|
232
|
+
|
233
|
+
```
|
79
234
|
#### Why is it great?
|
80
235
|
* See also RSA(Encryption)
|
81
236
|
#### How does it work?
|
82
237
|
|
83
238
|
### Shamir's Secret Sharing
|
84
239
|
#### What is it?
|
240
|
+
This algorithm is a form of secret sharing, where a secret is divided into parts, giving each participant its own unique part, where some of the parts or all of them are needed in order to reconstruct the secret.
|
241
|
+
|
242
|
+
Counting on all participants to combine the secret might be impractical, and therefore sometimes the threshold scheme is used where any <i>k</i> of the parts are sufficient to reconstruct the original secret. <sup>[[4]]</sup>
|
85
243
|
#### How do I use it?
|
86
244
|
##### CLI
|
245
|
+
```bash
|
246
|
+
scl generate -h
|
247
|
+
scl combine -h
|
248
|
+
|
249
|
+
generate.
|
250
|
+
Usage: scl sss generate (options)
|
251
|
+
|
252
|
+
generate. Generate a set of shares for a shared secret
|
253
|
+
Arguments are the total number of shares to generate, and the number of shares required to unlock
|
254
|
+
the secret.
|
255
|
+
e.g
|
256
|
+
scl sss generate -m 3 -n 5
|
257
|
+
scl sss generate --min-shares=11 --num-shares=14 -o output_file
|
258
|
+
|
259
|
+
Large secrets are encoded using multiple blocks, which can create large shares.
|
260
|
+
An alternative, more space efficient approach to this is to encode a shorter key using secret sharing,
|
261
|
+
and to then encrypt the large secret using this key and a block-cipher
|
262
|
+
|
263
|
+
|
264
|
+
combine.
|
265
|
+
Usage: scl sss combine (options)
|
266
|
+
|
267
|
+
combine. Combines a set of shares for a shared secret
|
268
|
+
Expects as an argument a file of "
|
269
|
+
" separate secret shares
|
270
|
+
e.g
|
271
|
+
scl sss combine shares.txt
|
272
|
+
```
|
87
273
|
##### Library
|
274
|
+
```ruby
|
275
|
+
sss = Scl::SecretShare.new(3, 5) # generate 5 shares, of which 3
|
276
|
+
# will be required to reconstruct the secret
|
277
|
+
message = "A super secret message"
|
278
|
+
shares = sss.generate(message)
|
279
|
+
Scl::SecretShare.combine(shares) == message
|
280
|
+
# => true
|
281
|
+
Scl::SecretShare.combine(shares.sample(3)) == message
|
282
|
+
# => true
|
283
|
+
Scl::SecretShare.combine(shares.sample(2)) == message
|
284
|
+
# => false
|
285
|
+
```
|
88
286
|
#### Why is it great?
|
89
|
-
|
287
|
+
Secret sharing algorithms like this have recently seen a surge in popularity due to their usage in multi-signature wallet implementations for various cryptocurrencies. In short, this algorithm allows you to secure a secret so that at least <i>K</i> participants are required to unlock it. This is in contrast to simply XORing secret keys which we can easily use to ensure every participant is required to unlock a secret.
|
90
288
|
|
91
|
-
### AES Encryption
|
289
|
+
### AES-CBC Encryption
|
92
290
|
#### What is it?
|
291
|
+
Aes is a specification for the encryption of electronic data established by the U.S. National Institute of Standards and Technology (NIST) in 2001.[7]
|
292
|
+
|
293
|
+
Cipher block chaining (CBC) a block cipher mode of operation is an algorithm that uses a block cipher to provide an information service such as confidentiality or authenticity. A mode of operation describes how repeatedly to apply a cipher's single-block operation securely to transform amounts of data larger than a block. <sup>[[5]]</sup>
|
93
294
|
#### How do I use it?
|
94
295
|
##### CLI
|
296
|
+
```bash
|
297
|
+
scl aes ciphers -h
|
298
|
+
scl aes encrypt -h
|
299
|
+
scl aes decrypt -h
|
300
|
+
|
301
|
+
ciphers.
|
302
|
+
Usage: scl aes ciphers (options)
|
303
|
+
|
304
|
+
ciphers. Prints a list of supported ciphers
|
305
|
+
|
306
|
+
e.g
|
307
|
+
scl aes ciphers
|
308
|
+
|
309
|
+
encrypt.
|
310
|
+
Usage: scl aes encrypt (options)
|
311
|
+
|
312
|
+
encrypt. Encrypt a given file.
|
313
|
+
Can optionally be given an existing key, otherwise a unique one will be generated alongside
|
314
|
+
the cipher text.
|
315
|
+
e.g
|
316
|
+
scl aes encrypt somefile
|
317
|
+
scl aes encrypt somefile -k somekey
|
318
|
+
|
319
|
+
decrypt.
|
320
|
+
Usage: scl aes decrypt (options)
|
321
|
+
|
322
|
+
decrypt. Decrypt a given file.
|
323
|
+
Must be given a key using -k/--key-path
|
324
|
+
e.g
|
325
|
+
scl aes decrypt somefile.enc -k somekey.key
|
326
|
+
scl aes decrypt somefile.enc -k somekey.key -o output.txt
|
327
|
+
```
|
95
328
|
##### Library
|
329
|
+
```ruby
|
330
|
+
aes = Scl::AES.new
|
331
|
+
# => #<Scl::AES:0x007fcc53c90988 @block_cipher=:CBC, @block_size=256>
|
332
|
+
ciphertext, key, iv = aes.encrypt("Some content")
|
333
|
+
# => ["\xD8\xFD[\xE1O\xDF\xEE\xCAB\xC8\x02Fb\xC52\x86", "\"v\x99U\xD9\xE5\xF3\x10\e\a\xE0\xE9M\xA0\r\x87\xA5\xDC0\x18E\x91\xC5I\xBB\xB1x\xC9\xDD\a\xC8-", "Z\x98A\xE0\xA51\x17CV\x90\xF9\x95\xDEo2z"]
|
334
|
+
aes.decrypt(ciphertext, key, iv)
|
335
|
+
# => "Some content"
|
336
|
+
```
|
96
337
|
#### Why is it great?
|
97
|
-
|
338
|
+
Using a secure encryption standard with a block cipher mode of operation allows us to encrypt data that is larger than our block-size. You can use this in conjunction with keys generated using Diffie Hellman key exchange, RSA or keys protected using Shamirs Secret sharing to transmit large quantities of data without needing to send manage large keys of similar size.
|
98
339
|
|
99
340
|
### HMAC and Digests
|
100
341
|
#### What is it?
|
342
|
+
A cryptographic hash function, is a one-way function to generates a pseudo-unique fixed-size signature for a message.
|
343
|
+
The hash function is simply to verify but intractable to reverse, allowing it to be used to verify authenticity of the underlying message. A valid digital signature gives a recipient reason to believe that the message in question is the same as one seen by a known counter-party that publishes the signature alongside the message.
|
344
|
+
|
345
|
+
The use of the secret cryptographic key provides an additional level of protection over simply using a cryptographic hash
|
346
|
+
A keyed-hash message authentication code (HMAC) is a specific type of message authentication code (MAC) involving a cryptographic hash function and a secret cryptographic key. The function uses two passes of hash computation utilising the secret-key as a means for protection against length-extension attacks
|
101
347
|
#### How do I use it?
|
102
348
|
##### CLI
|
103
|
-
|
104
|
-
|
105
|
-
|
349
|
+
```bash
|
350
|
+
scl digest list -h
|
351
|
+
scl digest sign -h
|
352
|
+
scl digest verify -h
|
353
|
+
scl digest hmac -h
|
354
|
+
scl digest hmac_verify -h
|
106
355
|
|
107
|
-
|
356
|
+
list.
|
357
|
+
=======
|
358
|
+
Usage: scl digest list (options)
|
359
|
+
|
360
|
+
list. List supported hash algorithms
|
361
|
+
e.g.
|
362
|
+
scl digest list
|
363
|
+
|
364
|
+
sign.
|
365
|
+
======
|
366
|
+
Usage: scl digest sign (options)
|
367
|
+
|
368
|
+
sign. Signs a file using a support hash algorithm. Defaults to sha256
|
369
|
+
e.g
|
370
|
+
scl digest sign /path/to/file
|
371
|
+
scl digest sign /path/to/file -o stdout
|
372
|
+
scl digest sign /path/to/file -d sha512
|
373
|
+
|
374
|
+
|
375
|
+
verify.
|
376
|
+
=======
|
377
|
+
Usage: scl digest verify (options)
|
378
|
+
|
379
|
+
verify
|
380
|
+
e.g.
|
381
|
+
scl digest verify file signature
|
382
|
+
scl digest verify file signature -d sha512
|
383
|
+
|
384
|
+
hmac.
|
385
|
+
=======
|
386
|
+
Usage: scl digest hmac (options)
|
108
387
|
|
109
|
-
|
388
|
+
hmac. Generates an HMAC for a file, can be given an optional key or alternately one will be
|
389
|
+
generated for you. Keep hold of this key for verifying signatures in the future
|
390
|
+
e.g.
|
391
|
+
scl hmac file # Generates both a digest and a secure random key
|
392
|
+
scl hmac file -k keyfile # Generates a digest using an existing key
|
393
|
+
scl hmac file -d sha512 # Provide alternate digest algorithm
|
394
|
+
|
395
|
+
hmac_verify.
|
396
|
+
=======
|
397
|
+
Usage: scl digest hmac_verify (options)
|
398
|
+
|
399
|
+
hmac. Verifies the contents of a file match an HMAC signature (using a given key)
|
400
|
+
e.g.
|
401
|
+
scl hmac_verify file signature -k keyfile
|
110
402
|
|
111
|
-
Example usage:
|
112
403
|
|
113
404
|
```
|
114
|
-
|
115
|
-
|
116
|
-
|
117
|
-
|
118
|
-
|
119
|
-
|
120
|
-
|
121
|
-
|
122
|
-
|
123
|
-
|
124
|
-
|
125
|
-
encrypt and decrypt both accept optional --cipher-size/-cs arguments
|
126
|
-
All rsa actions accept --format/--input-format/--output-format -f/-if/-of arguments
|
127
|
-
|
128
|
-
DH:
|
129
|
-
scl dh ping # Start a diffie hellman key-generation
|
130
|
-
scl dh pong [der] [public-key] # Complete side-1 of a diffie hellman key-generation
|
131
|
-
scl dh done [der] [public-key] [priv-key] # Complete side-2 of a diffie hellman key-generation
|
132
|
-
|
133
|
-
AES:
|
134
|
-
scl aes encrypt # Encrypt from stdin
|
135
|
-
scl aes encrypt [file] # Encrypt from file
|
136
|
-
scl aes encrypt --key="abc" [file] # Enc
|
405
|
+
##### Library
|
406
|
+
```ruby
|
407
|
+
Scl::Digest.digest('sha256', 'Sign here')
|
408
|
+
# Always the same
|
409
|
+
# => "aee6760ca427dd06f9622ef1f238bdd672bdfdf25f1aced851d3c2f80aa7e740"
|
410
|
+
digest1, key1 = Scl::Digest.hmac('sha256', 'Sign here')
|
411
|
+
# Always different
|
412
|
+
# => [digest, key]
|
413
|
+
digest2, key2 = Scl::Digest.hmac('sha256', 'Sign here', ke1)
|
414
|
+
digest2 == digest2
|
415
|
+
# => true
|
137
416
|
```
|
417
|
+
#### Why is it great?
|
418
|
+
* Cryptographic hash function - Prove that a message has not been tampered with since a signature was generated
|
419
|
+
* HMAC - Similar to the benefits of the hash function with the added protection against length-extension attacks
|
138
420
|
|
421
|
+
## CLI
|
422
|
+
|
423
|
+
SCL Comes with a command line interface that allows you to perform basic encryption, decryption, key generation and key negotiation operations. Specific examples of this functionality are documented above.
|
424
|
+
To learn more about the CLI use the in-built help functionality
|
425
|
+
|
426
|
+
```bash
|
427
|
+
scl -h # top level help
|
428
|
+
scl [module] -h # Help on a specific module
|
429
|
+
scl [module] [command] -h # Help on a specific command for a module
|
430
|
+
```
|
139
431
|
|
140
432
|
## Development
|
141
433
|
|
@@ -143,6 +435,9 @@ After checking out the repo, run `bin/setup` to install dependencies. You can al
|
|
143
435
|
|
144
436
|
To install this gem onto your local machine, run `bundle exec rake install`. To release a new version, update the version number in `version.rb`, and then run `bundle exec rake release`, which will create a git tag for the version, push git commits and tags, and push the `.gem` file to [rubygems.org](https://rubygems.org).
|
145
437
|
|
438
|
+
## Testing
|
439
|
+
Run `rake test` from the repository root (Ensure you have performed a bundle install)
|
440
|
+
|
146
441
|
## Contributing
|
147
442
|
|
148
443
|
Bug reports and pull requests are welcome on GitHub at https://github.com/[USERNAME]/scl. This project is intended to be a safe, welcoming space for collaboration, and contributors are expected to adhere to the [Contributor Covenant](http://contributor-covenant.org) code of conduct.
|
@@ -153,4 +448,6 @@ Everyone interacting in the Scl project’s codebases, issue trackers, chat room
|
|
153
448
|
|
154
449
|
[1]: https://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exchange
|
155
450
|
[2]: https://en.wikipedia.org/wiki/Public-key_cryptography
|
156
|
-
[3]: https://en.wikipedia.org/wiki/Digital_signature
|
451
|
+
[3]: https://en.wikipedia.org/wiki/Digital_signature
|
452
|
+
[4]: https://en.wikipedia.org/wiki/Advanced_Encryption_Standard
|
453
|
+
[5]: https://en.wikipedia.org/wiki/Block_cipher_mode_of_operation
|
data/lib/scl/rsa.rb
CHANGED
@@ -1,6 +1,8 @@
|
|
1
1
|
module Scl
|
2
2
|
class RSA
|
3
3
|
attr_reader :private, :public
|
4
|
+
DELIMITER = "\x0::\x0"
|
5
|
+
|
4
6
|
def initialize(file: nil, public: nil, private: nil, input_encoder: Format::BINARY, output_encoder: Format::BINARY)
|
5
7
|
if file
|
6
8
|
@public = OpenSSL::PKey::RSA.new(encoder.decode(IO.read("#{file}.pub"))) if File.exists?("#{file}.pub")
|
@@ -20,7 +22,7 @@ module Scl
|
|
20
22
|
dir
|
21
23
|
end
|
22
24
|
|
23
|
-
def self.generate(key_size)
|
25
|
+
def self.generate(key_size=1024)
|
24
26
|
rsa_pair = OpenSSL::PKey::RSA.new(key_size || 2048)
|
25
27
|
RSA.new(public: rsa_pair.public_key, private: rsa_pair)
|
26
28
|
end
|
@@ -52,11 +54,11 @@ module Scl
|
|
52
54
|
when rsa.private? then rsa.private_encrypt(key)
|
53
55
|
else rsa.public_encrypt(key)
|
54
56
|
end
|
55
|
-
[encrypted_key, iv, ciphertext].join(
|
57
|
+
[encrypted_key, iv, ciphertext].join(DELIMITER)
|
56
58
|
end
|
57
59
|
|
58
60
|
def decrypt(ciphertext)
|
59
|
-
encrypted_key, iv, ciphertext = ciphertext.split(
|
61
|
+
encrypted_key, iv, ciphertext = ciphertext.split(DELIMITER, 3)
|
60
62
|
decrypted_key =
|
61
63
|
case
|
62
64
|
when rsa.private? then rsa.private_decrypt(encrypted_key)
|
data/lib/scl/version.rb
CHANGED
data/scl.gemspec
CHANGED
@@ -22,4 +22,6 @@ Gem::Specification.new do |spec|
|
|
22
22
|
spec.add_development_dependency "bundler", "~> 1.15"
|
23
23
|
spec.add_development_dependency "rake", "~> 10.0"
|
24
24
|
spec.add_development_dependency "pry-byebug"
|
25
|
+
spec.add_development_dependency 'simplecov'
|
26
|
+
spec.add_development_dependency 'minitest'
|
25
27
|
end
|
metadata
CHANGED
@@ -1,14 +1,14 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: scl
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 0.1.
|
4
|
+
version: 0.1.2
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- Wouter Coppieters
|
8
8
|
autorequire:
|
9
9
|
bindir: exe
|
10
10
|
cert_chain: []
|
11
|
-
date: 2017-11-
|
11
|
+
date: 2017-11-14 00:00:00.000000000 Z
|
12
12
|
dependencies:
|
13
13
|
- !ruby/object:Gem::Dependency
|
14
14
|
name: bundler
|
@@ -52,6 +52,34 @@ dependencies:
|
|
52
52
|
- - ">="
|
53
53
|
- !ruby/object:Gem::Version
|
54
54
|
version: '0'
|
55
|
+
- !ruby/object:Gem::Dependency
|
56
|
+
name: simplecov
|
57
|
+
requirement: !ruby/object:Gem::Requirement
|
58
|
+
requirements:
|
59
|
+
- - ">="
|
60
|
+
- !ruby/object:Gem::Version
|
61
|
+
version: '0'
|
62
|
+
type: :development
|
63
|
+
prerelease: false
|
64
|
+
version_requirements: !ruby/object:Gem::Requirement
|
65
|
+
requirements:
|
66
|
+
- - ">="
|
67
|
+
- !ruby/object:Gem::Version
|
68
|
+
version: '0'
|
69
|
+
- !ruby/object:Gem::Dependency
|
70
|
+
name: minitest
|
71
|
+
requirement: !ruby/object:Gem::Requirement
|
72
|
+
requirements:
|
73
|
+
- - ">="
|
74
|
+
- !ruby/object:Gem::Version
|
75
|
+
version: '0'
|
76
|
+
type: :development
|
77
|
+
prerelease: false
|
78
|
+
version_requirements: !ruby/object:Gem::Requirement
|
79
|
+
requirements:
|
80
|
+
- - ">="
|
81
|
+
- !ruby/object:Gem::Version
|
82
|
+
version: '0'
|
55
83
|
description: Simple crypto library
|
56
84
|
email:
|
57
85
|
- wouter@youdo.co.nz
|