Class: PQCrypto::Seal::DekRotator

Inherits:
Object
  • Object
show all
Defined in:
lib/pq_crypto/seal/core.rb

Instance Method Summary collapse

Constructor Details

#initialize(envelope, credentials:, recipients:, padding:, limits:, recipient_capacity: nil, slot_size: nil) ⇒ DekRotator

Returns a new instance of DekRotator.



120
121
122
123
124
125
126
127
128
129
 
# File 'lib/pq_crypto/seal/core.rb', line 120

def initialize(envelope, credentials:, recipients:, padding:, limits:,
               recipient_capacity: nil, slot_size: nil)
  @envelope = Envelope.parse(envelope, limits: limits)
  @credentials = credentials
  @recipients = recipients
  @padding = padding == :preserve ? { to: @envelope.size } : padding
  @limits = limits
  @recipient_capacity = recipient_capacity
  @slot_size = slot_size
end

Instance Method Details

#call ⇒ Object 



131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
 
# File 'lib/pq_crypto/seal/core.rb', line 131

def call
  dek = @envelope.unwrap_dek(@credentials)
  inner_bytes = @envelope.decrypt_inner(dek)
  inner = Format::InnerCodec.parse(inner_bytes)
  @limits.check_plaintext!(inner.content.bytesize)
  OneShotEncryptor.new(
    inner.content,
    to: @recipients,
    metadata: inner.metadata,
    public_metadata: @envelope.header.public_metadata,
    recipient_capacity: capacity_for_reencrypt,
    slot_size: slot_size_for_reencrypt,
    padding: @padding
  ).call
ensure
  Secrets.wipe_each!(dek, inner_bytes)
  Secrets.wipe_each!(inner.content, inner.metadata) if inner
end