From 07abc5efe1bc71902b0c517ef97dcb36564f2336 Mon Sep 17 00:00:00 2001
From: Michael Koziarski <michael@koziarski.com>
Date: Tue, 25 Nov 2008 20:27:54 +0100
Subject: Add a MessageEncryptor, just like MessageVerifier but using symmetric
 key encryption.

The use of encryption prevents people from seeing any potentially secret values you've used.  It also supports and encrypt_and_sign model to prevent people from tampering with the bits and creating random junk that gets fed to

A motivated coder could use this to add an :encrypt=>true option to the cookie store.
---
 .../lib/active_support/message_encryptor.rb        | 69 ++++++++++++++++++++++
 1 file changed, 69 insertions(+)
 create mode 100644 activesupport/lib/active_support/message_encryptor.rb

(limited to 'activesupport/lib/active_support/message_encryptor.rb')

diff --git a/activesupport/lib/active_support/message_encryptor.rb b/activesupport/lib/active_support/message_encryptor.rb
new file mode 100644
index 0000000000..de2b4bee76
--- /dev/null
+++ b/activesupport/lib/active_support/message_encryptor.rb
@@ -0,0 +1,69 @@
+require 'openssl'
+
+module ActiveSupport
+  # MessageEncryptor is a simple way to encrypt values which get stored somewhere 
+  # you don't trust.
+  # 
+  # The cipher text and initialization vector are base64 encoded and returned to you.
+  #
+  # This can be used in situations similar to the MessageVerifier, but where you don't
+  # want users to be able to determine the value of the payload.
+  class MessageEncryptor
+    class InvalidMessage < StandardError; end
+    
+    def initialize(secret, cipher = 'aes-256-cbc')
+      @secret = secret
+      @cipher = cipher
+    end
+    
+    def encrypt(value)
+      cipher = new_cipher
+      # Rely on OpenSSL for the initialization vector
+      iv = cipher.random_iv
+      
+      cipher.encrypt 
+      cipher.key = @secret
+      cipher.iv  = iv
+      
+      encrypted_data = cipher.update(Marshal.dump(value)) 
+      encrypted_data << cipher.final
+
+      [encrypted_data, iv].map {|v| ActiveSupport::Base64.encode64s(v)}.join("--")
+    end
+    
+    def decrypt(encrypted_message)
+      cipher = new_cipher
+      encrypted_data, iv = encrypted_message.split("--").map {|v| ActiveSupport::Base64.decode64(v)}
+      
+      cipher.decrypt
+      cipher.key = @secret
+      cipher.iv  = iv
+
+      decrypted_data = cipher.update(encrypted_data)
+      decrypted_data << cipher.final
+      
+      Marshal.load(decrypted_data)
+    rescue OpenSSL::CipherError, TypeError
+      raise InvalidMessage
+    end
+    
+    def encrypt_and_sign(value)
+      verifier.generate(encrypt(value))
+    end
+    
+    def decrypt_and_verify(value)
+      decrypt(verifier.verify(value))
+    end
+    
+    
+    
+    private 
+      def new_cipher
+        OpenSSL::Cipher::Cipher.new(@cipher)
+      end
+      
+      def verifier
+        MessageVerifier.new(@secret)
+      end
+  end
+end
\ No newline at end of file
-- 
cgit v1.2.3


From d1213fa4024143edaa060ee0ed326d9d2fcbe919 Mon Sep 17 00:00:00 2001
From: Jeremy Kemper <jeremy@bitsweat.net>
Date: Tue, 25 Nov 2008 23:36:33 -0800
Subject: Rescue OpenSSL::Cipher::CipherError or OpenSSL::CipherError depending
 on which is present

---
 activesupport/lib/active_support/message_encryptor.rb | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

(limited to 'activesupport/lib/active_support/message_encryptor.rb')

diff --git a/activesupport/lib/active_support/message_encryptor.rb b/activesupport/lib/active_support/message_encryptor.rb
index de2b4bee76..347af9dc76 100644
--- a/activesupport/lib/active_support/message_encryptor.rb
+++ b/activesupport/lib/active_support/message_encryptor.rb
@@ -10,7 +10,8 @@ module ActiveSupport
   # want users to be able to determine the value of the payload.
   class MessageEncryptor
     class InvalidMessage < StandardError; end
-    
+    OpenSSLCipherError = OpenSSL::Cipher.const_defined?(:CipherError) ? OpenSSL::Cipher::CipherError : OpenSSL::CipherError
+
     def initialize(secret, cipher = 'aes-256-cbc')
       @secret = secret
       @cipher = cipher
@@ -43,7 +44,7 @@ module ActiveSupport
       decrypted_data << cipher.final
       
       Marshal.load(decrypted_data)
-    rescue OpenSSL::CipherError, TypeError
+    rescue OpenSSLCipherError, TypeError
       raise InvalidMessage
     end
     
@@ -66,4 +67,4 @@ module ActiveSupport
         MessageVerifier.new(@secret)
       end
   end
-end
\ No newline at end of file
+end
-- 
cgit v1.2.3