Module: Kinko::Cipher

Extended by:
Cipher
Included in:
Cipher
Defined in:
lib/kinko/cipher.rb

Constant Summary collapse

ALGORITHM = 
"aes-256-gcm"
NONCE_BYTES = 
12
TAG_BYTES = 
16
SEPARATOR = 
":"

Instance Method Summary collapse

Instance Method Details

#decrypt(envelope, type: nil) ⇒ Object 



25
26
27
28
29
30
31
32
33
34
 
# File 'lib/kinko/cipher.rb', line 25

def decrypt(envelope, type: nil)
  version, payload = split(envelope)
  key = decode_key(Kinko.config.key_for(version))
  raw = Base64.strict_decode64(payload)
  nonce, ciphertext, tag = split_payload(raw)
  cipher = new_cipher(:decrypt, key)
  cipher.iv = nonce
  cipher.auth_tag = tag
  deserialize(cipher.update(ciphertext) + cipher.final, type)
end

#encrypt(value, version: Kinko.config.key_version) ⇒ Object 



16
17
18
19
20
21
22
23
 
# File 'lib/kinko/cipher.rb', line 16

def encrypt(value, version: Kinko.config.key_version)
  Kinko.config.require!
  key = decode_key(Kinko.config.key_for(version))
  cipher = new_cipher(:encrypt, key)
  nonce = cipher.random_iv
  ciphertext = cipher.update(serialize(value)) + cipher.final
  envelope(version, nonce + ciphertext + cipher.auth_tag)
end

#recrypt(envelope, version: Kinko.config.key_version) ⇒ Object 



36
37
38
39
40
41
 
# File 'lib/kinko/cipher.rb', line 36

def recrypt(envelope, version: Kinko.config.key_version)
  current, = split(envelope)
  return envelope if current == version.to_s

  encrypt(decrypt(envelope), version:)
end

#version_of(envelope) ⇒ Object 



43
 
# File 'lib/kinko/cipher.rb', line 43

def version_of(envelope) = split(envelope).first