Module: PQCrypto::Seal

Defined in:
lib/pq_crypto/seal.rb,
lib/pq_crypto/seal/io.rb,
lib/pq_crypto/seal/core.rb,
lib/pq_crypto/seal/files.rb,
lib/pq_crypto/seal/binary.rb,
lib/pq_crypto/seal/errors.rb,
lib/pq_crypto/seal/format.rb,
lib/pq_crypto/seal/models.rb,
lib/pq_crypto/seal/native.rb,
lib/pq_crypto/seal/padding.rb,
lib/pq_crypto/seal/secrets.rb,
lib/pq_crypto/seal/version.rb,
lib/pq_crypto/seal/envelope.rb,
lib/pq_crypto/seal/streaming.rb,
lib/pq_crypto/seal/io_helpers.rb,
lib/pq_crypto/seal/recipients.rb,
lib/pq_crypto/seal/resource_limits.rb,
ext/pq_crypto_seal/pq_crypto_seal.c

Defined Under Namespace

Modules: Binary, Format, IOAPI, Padding Classes: AmbiguousRecipientStanzas, AuthenticationError, Credentials, DekRotator, Error, FormatError, Inspection, InvalidConfigurationError, OneShotEncryptor, OneShotOpener, Opened, RecipientCapacityExceeded, RecipientNotFoundError, RecipientRebuilder, ResourceLimitError, UnsupportedSuiteError

Constant Summary collapse

IO_DELEGATES = 
%i[
  encrypt_io decrypt_io encrypt_frame_io decrypt_frame_io
  encrypt_file decrypt_file rebuild_recipients_file
  add_recipient_file rotate_dek_file
  inspect_file
].freeze
PUBLIC_API = 
%i[
  credentials encrypt decrypt open inspect_envelope digest
  rebuild_recipients add_recipient rotate_dek
].freeze
VERSION = 
"0.1.2"
WRAP_KEM_ALGORITHM = 
:ml_kem_768_x25519_xwing

Class Method Summary collapse

Class Method Details

.add_recipient(envelope, with:, recipient:, current_recipients:, **limit_options) ⇒ Object 



215
216
217
218
219
220
221
222
 
# File 'lib/pq_crypto/seal/core.rb', line 215

def add_recipient(envelope, with:, recipient:, current_recipients:, **limit_options)
  rebuild_recipients(
    envelope,
    with: with,
    recipients: Array(current_recipients) + [recipient],
    **limit_options
  )
end

.build_recipient_section(**options) ⇒ Object 



246
247
248
 
# File 'lib/pq_crypto/seal/core.rb', line 246

def build_recipient_section(**options)
  RecipientSectionBuilder.new(**options).call
end

.credentials(secret_key:, public_key:) ⇒ Object 



167
168
169
 
# File 'lib/pq_crypto/seal/core.rb', line 167

def credentials(secret_key:, public_key:)
  KeyMaterial.build_credentials(secret_key: secret_key, public_key: public_key)
end

.decrypt(envelope, with:, required_padding: :from_header, **limit_options) ⇒ Object 



185
186
187
 
# File 'lib/pq_crypto/seal/core.rb', line 185

def decrypt(envelope, with:, required_padding: :from_header, **limit_options)
  open(envelope, with: with, required_padding: required_padding, **limit_options).data
end

.digest(envelope) ⇒ Object 



202
203
204
 
# File 'lib/pq_crypto/seal/core.rb', line 202

def digest(envelope)
  Native.sha256(String(envelope).b)
end

.encrypt(data, to:, metadata: "".b, public_metadata: "".b, recipient_capacity: Format::DEFAULT_RECIPIENT_CAPACITY, slot_size: Format::DEFAULT_SLOT_SIZE, padding: :padme) ⇒ Object 



171
172
173
174
175
176
177
178
179
180
181
182
183
 
# File 'lib/pq_crypto/seal/core.rb', line 171

def encrypt(data, to:, metadata: "".b, public_metadata: "".b,
            recipient_capacity: Format::DEFAULT_RECIPIENT_CAPACITY,
            slot_size: Format::DEFAULT_SLOT_SIZE, padding: :padme)
  OneShotEncryptor.new(
    data,
    to: to,
    metadata: metadata,
    public_metadata: public_metadata,
    recipient_capacity: recipient_capacity,
    slot_size: slot_size,
    padding: padding
  ).call
end

.inspect_envelope(envelope, **limit_options) ⇒ Object 



198
199
200
 
# File 'lib/pq_crypto/seal/core.rb', line 198

def inspect_envelope(envelope, **limit_options)
  Envelope.parse(envelope, limits: ResourceLimits.resolve(limit_options)).inspection
end

.open(envelope, with:, required_padding: :from_header, **limit_options) ⇒ Object 



189
190
191
192
193
194
195
196
 
# File 'lib/pq_crypto/seal/core.rb', line 189

def open(envelope, with:, required_padding: :from_header, **limit_options)
  OneShotOpener.new(
    envelope,
    credentials: with,
    required_padding: required_padding,
    limits: ResourceLimits.resolve(limit_options)
  ).call
end

.parse_envelope(bytes) ⇒ Object 



237
238
239
240
 
# File 'lib/pq_crypto/seal/core.rb', line 237

def parse_envelope(bytes)
  envelope = Envelope.parse(bytes)
  [envelope.header, envelope.section, envelope.ciphertext, envelope.tag]
end

.rebuild_recipients(envelope, with:, recipients:, **limit_options) ⇒ Object 



206
207
208
209
210
211
212
213
 
# File 'lib/pq_crypto/seal/core.rb', line 206

def rebuild_recipients(envelope, with:, recipients:, **limit_options)
  RecipientRebuilder.new(
    envelope,
    credentials: with,
    recipients: recipients,
    limits: ResourceLimits.resolve(limit_options)
  ).call
end

.rotate_dek(envelope, with:, recipients:, padding: :preserve, recipient_capacity: nil, slot_size: nil, **limit_options) ⇒ Object 



224
225
226
227
228
229
230
231
232
233
234
235
 
# File 'lib/pq_crypto/seal/core.rb', line 224

def rotate_dek(envelope, with:, recipients:, padding: :preserve,
               recipient_capacity: nil, slot_size: nil, **limit_options)
  DekRotator.new(
    envelope,
    credentials: with,
    recipients: recipients,
    padding: padding,
    recipient_capacity: recipient_capacity,
    slot_size: slot_size,
    limits: ResourceLimits.resolve(limit_options)
  ).call
end

.unwrap_dek(header, section, credentials) ⇒ Object 



242
243
244
 
# File 'lib/pq_crypto/seal/core.rb', line 242

def unwrap_dek(header, section, credentials)
  RecipientSectionOpener.new(header, section, credentials).call
end

.wipe_string!(value) ⇒ Object 



250
251
252
 
# File 'lib/pq_crypto/seal/core.rb', line 250

def wipe_string!(value)
  Secrets.wipe!(value)
end