2 files changed, 9 insertions, 14 deletions
diff --git a/railties/lib/rails/commands/secrets/secrets_command.rb b/railties/lib/rails/commands/secrets/secrets_command.rb
index 65db81ac73..b9ae5d8b3b 100644
--- a/railties/lib/rails/commands/secrets/secrets_command.rb
+++ b/railties/lib/rails/commands/secrets/secrets_command.rb
@@ -18,7 +18,7 @@ module Rails
       end
 
       def edit
-        if ENV["EDITOR"].empty?
+        if ENV["EDITOR"].to_s.empty?
           say "No $EDITOR to open decrypted secrets in. Assign one like this:"
           say ""
           say %(EDITOR="mate --wait" bin/rails secrets:edit)
diff --git a/railties/lib/rails/secrets.rb b/railties/lib/rails/secrets.rb
index a083914109..2a95712cd9 100644
--- a/railties/lib/rails/secrets.rb
+++ b/railties/lib/rails/secrets.rb
@@ -1,4 +1,5 @@
 require "yaml"
+require "active_support/message_encryptor"
 
 module Rails
   # Greatly inspired by Ara T. Howard's magnificent sekrets gem. 😘
@@ -12,6 +13,7 @@ module Rails
       end
     end
 
+    @cipher = "aes-128-gcm"
     @read_encrypted_secrets = false
     @root = File # Wonky, but ensures `join` uses the current directory.
 
@@ -30,20 +32,19 @@ module Rails
       end
 
       def generate_key
-        cipher = new_cipher
-        SecureRandom.hex(cipher.key_len)[0, cipher.key_len]
+        SecureRandom.hex(OpenSSL::Cipher.new(@cipher).key_len)
       end
 
       def key
         ENV["RAILS_MASTER_KEY"] || read_key_file || handle_missing_key
       end
 
-      def encrypt(text)
-        cipher(:encrypt, text)
+      def encrypt(data)
+        encryptor.encrypt_and_sign(data)
       end
 
       def decrypt(data)
-        cipher(:decrypt, data)
+        encryptor.decrypt_and_verify(data)
       end
 
       def read
@@ -97,14 +98,8 @@ module Rails
           end
         end
 
-        def new_cipher
-          OpenSSL::Cipher.new("aes-256-cbc")
-        end
-
-        def cipher(mode, data)
-          cipher = new_cipher.public_send(mode)
-          cipher.key = key
-          cipher.update(data) << cipher.final
+        def encryptor
+          @encryptor ||= ActiveSupport::MessageEncryptor.new([ key ].pack("H*"), cipher: @cipher)
         end
     end
   end