Module: PQCrypto::Seal

Defined in:
lib/pq_crypto/seal.rb,
lib/pq_crypto/seal/io.rb,
lib/pq_crypto/seal/core.rb,
lib/pq_crypto/seal/files.rb,
lib/pq_crypto/seal/binary.rb,
lib/pq_crypto/seal/errors.rb,
lib/pq_crypto/seal/format.rb,
lib/pq_crypto/seal/models.rb,
lib/pq_crypto/seal/native.rb,
lib/pq_crypto/seal/padding.rb,
lib/pq_crypto/seal/secrets.rb,
lib/pq_crypto/seal/version.rb,
lib/pq_crypto/seal/envelope.rb,
lib/pq_crypto/seal/streaming.rb,
lib/pq_crypto/seal/io_helpers.rb,
lib/pq_crypto/seal/recipients.rb,
lib/pq_crypto/seal/resource_limits.rb,
ext/pq_crypto_seal/pq_crypto_seal.c

Defined Under Namespace

Modules: Binary, Format, IOAPI, Padding Classes: AmbiguousRecipientStanzas, AuthenticationError, Credentials, DekRotator, Error, FormatError, Inspection, InvalidConfigurationError, OneShotEncryptor, OneShotOpener, Opened, RecipientCapacityExceeded, RecipientNotFoundError, RecipientRebuilder, ResourceLimitError, UnsupportedSuiteError

Constant Summary collapse

IO_DELEGATES = 
%i[
  encrypt_io decrypt_io encrypt_frame_io decrypt_frame_io
  encrypt_file decrypt_file rebuild_recipients_file
  add_recipient_file drop_recipient_stanza_file rotate_dek_file
  inspect_file
].freeze
PUBLIC_API = 
%i[
  credentials encrypt decrypt open inspect_envelope digest
  rebuild_recipients add_recipient drop_recipient_stanza rotate_dek
].freeze
VERSION = 
"0.1.1"
WRAP_KEM_ALGORITHM = 
:ml_kem_768_x25519_xwing

Class Method Summary collapse

Class Method Details

.add_recipient(envelope, with:, recipient:, current_recipients:, **limit_options) ⇒ Object 



198
199
200
201
202
203
204
205
 
# File 'lib/pq_crypto/seal/core.rb', line 198

def add_recipient(envelope, with:, recipient:, current_recipients:, **limit_options)
  rebuild_recipients(
    envelope,
    with: with,
    recipients: Array(current_recipients) + [recipient],
    **limit_options
  )
end

.build_recipient_section(**options) ⇒ Object 



230
231
232
 
# File 'lib/pq_crypto/seal/core.rb', line 230

def build_recipient_section(**options)
  RecipientSectionBuilder.new(**options).call
end

.credentials(secret_key:, public_key:) ⇒ Object 



150
151
152
 
# File 'lib/pq_crypto/seal/core.rb', line 150

def credentials(secret_key:, public_key:)
  KeyMaterial.build_credentials(secret_key: secret_key, public_key: public_key)
end

.decrypt(envelope, with:, required_padding: nil, **limit_options) ⇒ Object 



168
169
170
 
# File 'lib/pq_crypto/seal/core.rb', line 168

def decrypt(envelope, with:, required_padding: nil, **limit_options)
  open(envelope, with: with, required_padding: required_padding, **limit_options).data
end

.digest(envelope) ⇒ Object 



185
186
187
 
# File 'lib/pq_crypto/seal/core.rb', line 185

def digest(envelope)
  Native.sha256(String(envelope).b)
end

.drop_recipient_stanza(envelope, with:, remaining_recipients:, **limit_options) ⇒ Object 



207
208
209
 
# File 'lib/pq_crypto/seal/core.rb', line 207

def drop_recipient_stanza(envelope, with:, remaining_recipients:, **limit_options)
  rebuild_recipients(envelope, with: with, recipients: remaining_recipients, **limit_options)
end

.encrypt(data, to:, metadata: "".b, public_metadata: "".b, recipient_capacity: Format::DEFAULT_RECIPIENT_CAPACITY, slot_size: Format::DEFAULT_SLOT_SIZE, padding: :padme) ⇒ Object 



154
155
156
157
158
159
160
161
162
163
164
165
166
 
# File 'lib/pq_crypto/seal/core.rb', line 154

def encrypt(data, to:, metadata: "".b, public_metadata: "".b,
            recipient_capacity: Format::DEFAULT_RECIPIENT_CAPACITY,
            slot_size: Format::DEFAULT_SLOT_SIZE, padding: :padme)
  OneShotEncryptor.new(
    data,
    to: to,
    metadata: metadata,
    public_metadata: public_metadata,
    recipient_capacity: recipient_capacity,
    slot_size: slot_size,
    padding: padding
  ).call
end

.inspect_envelope(envelope, **limit_options) ⇒ Object 



181
182
183
 
# File 'lib/pq_crypto/seal/core.rb', line 181

def inspect_envelope(envelope, **limit_options)
  Envelope.parse(envelope, limits: ResourceLimits.resolve(limit_options)).inspection
end

.open(envelope, with:, required_padding: nil, **limit_options) ⇒ Object 



172
173
174
175
176
177
178
179
 
# File 'lib/pq_crypto/seal/core.rb', line 172

def open(envelope, with:, required_padding: nil, **limit_options)
  OneShotOpener.new(
    envelope,
    credentials: with,
    required_padding: required_padding,
    limits: ResourceLimits.resolve(limit_options)
  ).call
end

.parse_envelope(bytes) ⇒ Object 



221
222
223
224
 
# File 'lib/pq_crypto/seal/core.rb', line 221

def parse_envelope(bytes)
  envelope = Envelope.parse(bytes)
  [envelope.header, envelope.section, envelope.ciphertext, envelope.tag]
end

.rebuild_recipients(envelope, with:, recipients:, **limit_options) ⇒ Object 



189
190
191
192
193
194
195
196
 
# File 'lib/pq_crypto/seal/core.rb', line 189

def rebuild_recipients(envelope, with:, recipients:, **limit_options)
  RecipientRebuilder.new(
    envelope,
    credentials: with,
    recipients: recipients,
    limits: ResourceLimits.resolve(limit_options)
  ).call
end

.rotate_dek(envelope, with:, recipients:, padding: :preserve, **limit_options) ⇒ Object 



211
212
213
214
215
216
217
218
219
 
# File 'lib/pq_crypto/seal/core.rb', line 211

def rotate_dek(envelope, with:, recipients:, padding: :preserve, **limit_options)
  DekRotator.new(
    envelope,
    credentials: with,
    recipients: recipients,
    padding: padding,
    limits: ResourceLimits.resolve(limit_options)
  ).call
end

.unwrap_dek(header, section, credentials) ⇒ Object 



226
227
228
 
# File 'lib/pq_crypto/seal/core.rb', line 226

def unwrap_dek(header, section, credentials)
  RecipientSectionOpener.new(header, section, credentials).call
end

.wipe_string!(value) ⇒ Object 



234
235
236
 
# File 'lib/pq_crypto/seal/core.rb', line 234

def wipe_string!(value)
  Secrets.wipe!(value)
end