class ActiveRecord::Encryption::Cipher

The algorithm used for encrypting and decrypting Message objects.

It uses AES-256-GCM. It will generate a random IV for non deterministic encryption (default) or derive an initialization vector from the encrypted content for deterministic encryption.

See Cipher::Aes256Gcm.

Constants

DEFAULT_ENCODING

Public Instance Methods

decrypt(encrypted_message, key:) click to toggle source

Decrypt the provided Message.

When key is an Array, it will try all the keys raising a ActiveRecord::Encryption::Errors::Decryption if none works.

# File lib/active_record/encryption/cipher.rb, line 25
def decrypt(encrypted_message, key:)
  try_to_decrypt_with_each(encrypted_message, keys: Array(key)).tap do |decrypted_text|
    decrypted_text.force_encoding(encrypted_message.headers.encoding || DEFAULT_ENCODING)
  end
end
encrypt(clean_text, key:, deterministic: false) click to toggle source

Encrypts the provided text and return an encrypted Message.

# File lib/active_record/encryption/cipher.rb, line 15
def encrypt(clean_text, key:, deterministic: false)
  cipher_for(key, deterministic: deterministic).encrypt(clean_text).tap do |message|
    message.headers.encoding = clean_text.encoding.name unless clean_text.encoding == DEFAULT_ENCODING
  end
end
iv_length() click to toggle source
# File lib/active_record/encryption/cipher.rb, line 35
def iv_length
  Aes256Gcm.iv_length
end
key_length() click to toggle source
# File lib/active_record/encryption/cipher.rb, line 31
def key_length
  Aes256Gcm.key_length
end

Private Instance Methods

cipher_for(secret, deterministic: false) click to toggle source
# File lib/active_record/encryption/cipher.rb, line 48
def cipher_for(secret, deterministic: false)
  Aes256Gcm.new(secret, deterministic: deterministic)
end
try_to_decrypt_with_each(encrypted_text, keys:) click to toggle source
# File lib/active_record/encryption/cipher.rb, line 40
def try_to_decrypt_with_each(encrypted_text, keys:)
  keys.each.with_index do |key, index|
    return cipher_for(key).decrypt(encrypted_text)
  rescue ActiveRecord::Encryption::Errors::Decryption
    raise if index == keys.length - 1
  end
end