Class: ActiveRecord::Encryption::Cipher::Aes256Gcm
- Inherits:
-
Object
- Object
- ActiveRecord::Encryption::Cipher::Aes256Gcm
- Defined in:
- lib/active_record/encryption/cipher/aes256_gcm.rb
Overview
A 256-GCM cipher.
By default it will use random initialization vectors. For deterministic encryption, it will use a SHA-256 hash of the text to encrypt and the secret.
See Encryptor
Constant Summary collapse
- CIPHER_TYPE =
"aes-256-gcm"
Class Method Summary collapse
Instance Method Summary collapse
- #decrypt(encrypted_message) ⇒ Object
- #encrypt(clear_text) ⇒ Object
-
#initialize(secret, deterministic: false) ⇒ Aes256Gcm
constructor
When iv not provided, it will generate a random iv on each encryption operation (default and recommended operation).
Constructor Details
#initialize(secret, deterministic: false) ⇒ Aes256Gcm
When iv not provided, it will generate a random iv on each encryption operation (default and recommended operation)
30 31 32 33 |
# File 'lib/active_record/encryption/cipher/aes256_gcm.rb', line 30 def initialize(secret, deterministic: false) @secret = secret @deterministic = deterministic end |
Class Method Details
.iv_length ⇒ Object
23 24 25 |
# File 'lib/active_record/encryption/cipher/aes256_gcm.rb', line 23 def iv_length OpenSSL::Cipher.new(CIPHER_TYPE).iv_len end |
.key_length ⇒ Object
19 20 21 |
# File 'lib/active_record/encryption/cipher/aes256_gcm.rb', line 19 def key_length OpenSSL::Cipher.new(CIPHER_TYPE).key_len end |
Instance Method Details
#decrypt(encrypted_message) ⇒ Object
56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 |
# File 'lib/active_record/encryption/cipher/aes256_gcm.rb', line 56 def decrypt() encrypted_data = .payload iv = .headers.iv auth_tag = .headers.auth_tag # Currently the OpenSSL bindings do not raise an error if auth_tag is # truncated, which would allow an attacker to easily forge it. See # https://github.com/ruby/openssl/issues/63 raise ActiveRecord::Encryption::Errors::EncryptedContentIntegrity if auth_tag.nil? || auth_tag.bytes.length != 16 cipher = OpenSSL::Cipher.new(CIPHER_TYPE) cipher.decrypt cipher.key = @secret cipher.iv = iv cipher.auth_tag = auth_tag cipher.auth_data = "" decrypted_data = encrypted_data.empty? ? encrypted_data : cipher.update(encrypted_data) decrypted_data << cipher.final decrypted_data rescue OpenSSL::Cipher::CipherError, TypeError, ArgumentError raise ActiveRecord::Encryption::Errors::Decryption end |
#encrypt(clear_text) ⇒ Object
35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 |
# File 'lib/active_record/encryption/cipher/aes256_gcm.rb', line 35 def encrypt(clear_text) # This code is extracted from +ActiveSupport::MessageEncryptor+. Not using it directly because we want to control # the message format and only serialize things once at the +ActiveRecord::Encryption::Message+ level. Also, this # cipher is prepared to deal with deterministic/non deterministic encryption modes. cipher = OpenSSL::Cipher.new(CIPHER_TYPE) cipher.encrypt cipher.key = @secret iv = generate_iv(cipher, clear_text) cipher.iv = iv encrypted_data = clear_text.empty? ? clear_text.dup : cipher.update(clear_text) encrypted_data << cipher.final ActiveRecord::Encryption::Message.new(payload: encrypted_data).tap do || .headers.iv = iv .headers.auth_tag = cipher.auth_tag end end |