Module: DiscordStore::Cipher

Defined in:
lib/discord_store/cipher.rb

Overview

Payload encryption.

Discord's own Developer Terms require that end-user data stored off-platform be encrypted at rest, so a library that stores data on the platform has no excuse for shipping plaintext as the default. Encryption is also the only thing standing between your records and every member of the guild who can scroll up.

AES-256-GCM, not the AES-256-CBC that earlier Discord filesystems used: GCM authenticates, so a member with Manage Messages who edits one of our messages produces a decryption failure rather than silently corrupted data.

Defined Under Namespace

Classes: AES256GCM, Null

Constant Summary collapse

VERSION_TAG =

Envelope prefix, so the format can change without ambiguity later.

"ds1"
SEPARATOR = 
"."
IV_BYTES = 
12
TAG_BYTES = 
16
ALGORITHM = 
"aes-256-gcm"

Class Method Summary collapse

Class Method Details

.build(config) ⇒ #seal, #open

Builds the cipher named by config.

Parameters:

Returns:

  • (#seal, #open) 


31
32
33
34
35
36
37
38
 
# File 'lib/discord_store/cipher.rb', line 31

def self.build(config)
  case config.cipher
  when :none then Null.new
  when :aes_256_gcm then AES256GCM.new(config.secret_key_bytes)
  else
    raise ConfigurationError, "unknown cipher #{config.cipher.inspect}"
  end
end

.generate_key ⇒ String

Generates a fresh key, base64-encoded and ready to paste into an environment variable.

Returns:

  • (String) 


44
45
46
 
# File 'lib/discord_store/cipher.rb', line 44

def self.generate_key
  Base64.strict_encode64(SecureRandom.bytes(32))
end