Module: BlindIndex
- Defined in:
- lib/blind_index.rb,
lib/blind_index/model.rb,
lib/blind_index/mongoid.rb,
lib/blind_index/version.rb,
lib/blind_index/backfill.rb,
lib/blind_index/extensions.rb,
lib/blind_index/key_generator.rb
Defined Under Namespace
Modules: Extensions, Model, Mongoid Classes: Backfill, Error, KeyGenerator
Constant Summary collapse
- VERSION =
"2.0.1"
Class Attribute Summary collapse
-
.default_options ⇒ Object
Returns the value of attribute default_options.
- .master_key ⇒ Object
Class Method Summary collapse
- .backfill(relation, columns: nil, batch_size: 1000) ⇒ Object
- .decode_key(key) ⇒ Object
- .generate_bidx(value, key:, **options) ⇒ Object
- .generate_key ⇒ Object
- .index_key(table:, bidx_attribute:, master_key: nil, encode: true) ⇒ Object
Class Attribute Details
.default_options ⇒ Object
Returns the value of attribute default_options.
16 17 18 |
# File 'lib/blind_index.rb', line 16 def @default_options end |
.master_key ⇒ Object
21 22 23 |
# File 'lib/blind_index.rb', line 21 def self.master_key @master_key ||= ENV["BLIND_INDEX_MASTER_KEY"] || (defined?(Lockbox.master_key) && Lockbox.master_key) end |
Class Method Details
.backfill(relation, columns: nil, batch_size: 1000) ⇒ Object
132 133 134 |
# File 'lib/blind_index.rb', line 132 def self.backfill(relation, columns: nil, batch_size: 1000) Backfill.new(relation, columns: columns, batch_size: batch_size).perform end |
.decode_key(key) ⇒ Object
120 121 122 123 124 125 126 127 128 129 130 |
# File 'lib/blind_index.rb', line 120 def self.decode_key(key) # decode hex key if key.encoding != Encoding::BINARY && key =~ /\A[0-9a-f]{64}\z/i key = [key].pack("H*") end raise BlindIndex::Error, "Key must use binary encoding" if key.encoding != Encoding::BINARY raise BlindIndex::Error, "Key must be 32 bytes" if key.bytesize != 32 key end |
.generate_bidx(value, key:, **options) ⇒ Object
25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 |
# File 'lib/blind_index.rb', line 25 def self.generate_bidx(value, key:, **) = { encode: true }.merge().merge() # apply expression value = [:expression].call(value) if [:expression] unless value.nil? algorithm = ([:algorithm] || ([:legacy] ? :pbkdf2_sha256 : :argon2id)).to_sym algorithm = :pbkdf2_sha256 if algorithm == :pbkdf2_hmac algorithm = :argon2i if algorithm == :argon2 key = key.call if key.respond_to?(:call) raise BlindIndex::Error, "Missing key for blind index" unless key key = key.to_s unless [:insecure_key] && algorithm == :pbkdf2_sha256 key = decode_key(key) end # gist to compare algorithm results # https://gist.github.com/ankane/fe3ac63fbf1c4550ee12554c664d2b8c = [:cost] || {} # check size size = ([:size] || 32).to_i raise BlindIndex::Error, "Size must be between 1 and 32" unless (1..32).include?(size) value = value.to_s value = case algorithm when :argon2id t = ([:t] || ([:slow] ? 4 : 3)).to_i # use same bounds as rbnacl raise BlindIndex::Error, "t must be between 3 and 10" if t < 3 || t > 10 # m is memory in kibibytes (1024 bytes) m = ([:m] || ([:slow] ? 15 : 12)).to_i # use same bounds as rbnacl raise BlindIndex::Error, "m must be between 3 and 22" if m < 3 || m > 22 Argon2::KDF.argon2id(value, salt: key, t: t, m: m, p: 1, length: size) when :pbkdf2_sha256 iterations = [:iterations] || [:iterations] || ([:slow] ? 100000 : 10000) OpenSSL::PKCS5.pbkdf2_hmac(value, key, iterations, size, "sha256") when :argon2i t = ([:t] || 3).to_i # use same bounds as rbnacl raise BlindIndex::Error, "t must be between 3 and 10" if t < 3 || t > 10 # m is memory in kibibytes (1024 bytes) m = ([:m] || 12).to_i # use same bounds as rbnacl raise BlindIndex::Error, "m must be between 3 and 22" if m < 3 || m > 22 Argon2::KDF.argon2i(value, salt: key, t: t, m: m, p: 1, length: size) when :scrypt n = [:n] || 4096 r = [:r] || 8 cp = [:p] || 1 SCrypt::Engine.scrypt(value, key, n, r, cp, size) else raise BlindIndex::Error, "Unknown algorithm" end encode = [:encode] if encode if encode.respond_to?(:call) encode.call(value) else [value].pack([:legacy] ? "m" : "m0") end else value end end end |
.generate_key ⇒ Object
105 106 107 108 109 |
# File 'lib/blind_index.rb', line 105 def self.generate_key require "securerandom" # force encoding to make JRuby consistent with MRI SecureRandom.hex(32).force_encoding(Encoding::US_ASCII) end |
.index_key(table:, bidx_attribute:, master_key: nil, encode: true) ⇒ Object
111 112 113 114 115 116 117 118 |
# File 'lib/blind_index.rb', line 111 def self.index_key(table:, bidx_attribute:, master_key: nil, encode: true) master_key ||= BlindIndex.master_key raise BlindIndex::Error, "Missing master key" unless master_key key = BlindIndex::KeyGenerator.new(master_key).index_key(table: table, bidx_attribute: bidx_attribute) key = key.unpack("H*").first if encode key end |