Class: SymmetricEncryption::Keystore::File

Inherits:
Object
  • Object
show all
Defined in:
lib/symmetric_encryption/keystore/file.rb

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(key_filename:, key_encrypting_key: nil) ⇒ File

Stores the Encryption key in a file. Secures the Encryption key by encrypting it with a key encryption key.



41
42
43
44
 
# File 'lib/symmetric_encryption/keystore/file.rb', line 41

def initialize(key_filename:, key_encrypting_key: nil)
  @file_name          = key_filename
  @key_encrypting_key = key_encrypting_key
end

Instance Attribute Details

#file_name ⇒ Object

Returns the value of attribute file_name.



4
5
6
 
# File 'lib/symmetric_encryption/keystore/file.rb', line 4

def file_name
  @file_name
end

#key_encrypting_key ⇒ Object

Returns the value of attribute key_encrypting_key.



4
5
6
 
# File 'lib/symmetric_encryption/keystore/file.rb', line 4

def key_encrypting_key
  @key_encrypting_key
end

Class Method Details

.generate_data_key(key_path:, cipher_name:, app_name:, environment:, version: 0, dek: nil, **args) ⇒ Object

Returns [Hash] a new keystore configuration after generating the data key.

Increments the supplied version number by 1.



9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
 
# File 'lib/symmetric_encryption/keystore/file.rb', line 9

def self.generate_data_key(key_path:, cipher_name:, app_name:, environment:, version: 0, dek: nil, **args)
  version >= 255 ? (version = 1) : (version += 1)

  dek ||= SymmetricEncryption::Key.new(cipher_name: cipher_name)
  kek   = SymmetricEncryption::Key.new(cipher_name: cipher_name)
  kekek = SymmetricEncryption::Key.new(cipher_name: cipher_name)

  dek_file_name = ::File.join(key_path, "#{app_name}_#{environment}_v#{version}.encrypted_key")
  new(key_filename: dek_file_name, key_encrypting_key: kek).write(dek.key)

  kekek_file_name = ::File.join(key_path, "#{app_name}_#{environment}_v#{version}.kekek")
  new(key_filename: kekek_file_name).write(kekek.key)

  {
    keystore:           :file,
    cipher_name:        dek.cipher_name,
    version:            version,
    key_filename:       dek_file_name,
    iv:                 dek.iv,
    key_encrypting_key: {
      encrypted_key:      kekek.encrypt(kek.key),
      iv:                 kek.iv,
      key_encrypting_key: {
        key_filename: kekek_file_name,
        iv:           kekek.iv
      }
    }
  }
end

Instance Method Details

#read ⇒ Object

Returns the Encryption key in the clear.

Raises:



47
48
49
50
51
52
53
54
55
56
 
# File 'lib/symmetric_encryption/keystore/file.rb', line 47

def read
  raise(SymmetricEncryption::ConfigError,
        "Symmetric Encryption key file: '#{file_name}' not found") unless ::File.exists?(file_name)
  raise(SymmetricEncryption::ConfigError,
        "Symmetric Encryption key file '#{file_name}' has the wrong "\
        "permissions: #{::File.stat(file_name).mode.to_s(8)}. Expected 100600.") unless correct_permissions?

  data = read_from_file
  key_encrypting_key ? key_encrypting_key.decrypt(data) : data
end

#write(key) ⇒ Object

Encrypt and write the key to file.



59
60
61
62
 
# File 'lib/symmetric_encryption/keystore/file.rb', line 59

def write(key)
  data = key_encrypting_key ? key_encrypting_key.encrypt(key) : key
  write_to_file(data)
end