Class: Karafka::Pro::Encryption::Ciphers::Direct

Inherits:
Base
  • Object
show all
Defined in:
lib/karafka/pro/encryption/ciphers/direct.rb

Overview

Legacy cipher where the payload is RSA-encrypted directly with PKCS1 v1.5 padding.

RSA can only encrypt data smaller than the key size minus padding (e.g. ~245 bytes for a 2048-bit key, ~501 bytes for a 4096-bit key), so it is unsuitable for larger payloads and remains available only for backwards compatibility with data already encrypted at rest and with fleets not yet fully upgraded.

Instance Method Summary collapse

Methods inherited from Base

#initialize, #warmup

Constructor Details

This class inherits a constructor from Karafka::Pro::Encryption::Ciphers::Base

Instance Method Details

#decrypt(version, content) ⇒ String

Decrypts provided content using the version private key

Parameters:

  • version (String) —

    encryption version

  • content (String) —

    encrypted content

Returns:

  • (String) —

    decrypted content



53
54
55
 
# File 'lib/karafka/pro/encryption/ciphers/direct.rb', line 53

def decrypt(version, content)
  private_pem(version).private_decrypt(content)
end

#encrypt(content) ⇒ String

Encrypts given content with the public key

Parameters:

  • content (String)

Returns:

  • (String) —

    RSA ciphertext, always exactly the key modulus size



45
46
47
 
# File 'lib/karafka/pro/encryption/ciphers/direct.rb', line 45

def encrypt(content)
  public_pem.public_encrypt(content)
end

#owns?(version, content) ⇒ Boolean

Note:

One inherent blind spot: an envelope truncated to exactly the modulus size is indistinguishable from a direct ciphertext. It surfaces as an RSA padding error or - when the PKCS1 v1.5 padding coincidentally validates - as garbage output, never as the envelope diagnostics. The legacy direct format carries no marker that could disambiguate this.

Returns true if the content matches this cipher's format. A valid direct RSA ciphertext is always exactly the key modulus size.

Parameters:

  • version (String) —

    encryption version

  • content (String) —

    encrypted content

Returns:

  • (Boolean) —

    true if the content matches this cipher's format. A valid direct RSA ciphertext is always exactly the key modulus size



67
68
69
 
# File 'lib/karafka/pro/encryption/ciphers/direct.rb', line 67

def owns?(version, content)
  content.bytesize == private_pem(version).n.num_bytes
end