Migration tool for upgrading from 0.13 to 0.16 about crypt_keeper HOT 8 CLOSED

It seems weird to use a migration encryptor IMO, since you could end up with data encrypted by either the old or new styles. If I were migrating data from one version to another, I would write a script to do it on all models immediately. I think we should encourage people to do the same.

The code above looks fine, I just think we should make people deal with the migration at once instead of spreading it out until every model has been saved.

from crypt_keeper.

Maybe this could even be packaged as an ActiveRecord::Migration helper. Then you could migrate in two steps:

1. Edit the model and specify the new encryptor
2. Create an irreversible migration with something like crypt_keeper_migrate :table_name, :old_encryptor

from crypt_keeper.

@itspriddle how could the end up with old encryption? Doing Model.all { |m| m.save } would re-encrypt everything with the new encryption.

from crypt_keeper.

@itspriddle I like the idea of db migration, hmmm

from crypt_keeper.

Looks good overall, my only concern is that it seems we will need to keep
the old versions around. If that is the case, maybe we should have some
kind of versioning mechanism?
On Feb 17, 2014 10:39 PM, "Justin Mazzi" [email protected] wrote:

Models can be migrated by use the migrate encryptors. Example:
:migrate_aes or :migrate_mysql_aes. This works by attempting to read the
data using the old encryption method and falling back to the new method.
Encryption always uses the new method

@fabiokr https://github.com/fabiokr @itspriddlehttps://github.com/itspriddlewhat are your thoughts on the below? It's pretty rough but seems to work in
my testing.

require 'digest/sha2'require 'openssl'require 'base64'
module CryptKeeper
module Provider
class OldMysqlAes < CryptKeeper::Provider::MysqlAes
def initialize(options = {})
@key = options.fetch(:key)
end
end

class MigrateMysqlAes
  def initialize(options = {})
    @new_enc = CryptKeeper::Provider::MysqlAes.new(options)
    @old_enc = OldMysqlAes.new(options)
  end

  def decrypt(value)
    plain_text = @old_enc.decrypt(value)

    if plain_text.blank?
      @new_enc.decrypt(value)
    else
      plain_text
    end
  end

  def encrypt(value)
    @new_enc.encrypt(value)
  end
end

class OldAes
  SEPARATOR = ":crypt_keeper:"

  attr_accessor :key
  attr_accessor :aes

  def initialize(options = {})
    @aes         = ::OpenSSL::Cipher::Cipher.new("AES-256-CBC")
    @aes.padding = 1

    key = options.fetch(:key) do
      raise ArgumentError, "Missing :key"
    end

    @key = Digest::SHA256.digest(key)
  end

  def encrypt(value)
    aes.encrypt
    aes.key = key
    Base64::encode64("#{aes.random_iv}#{SEPARATOR}#{aes.update(value.to_s) + aes.final}")
  end

  def decrypt(value)
    iv, value = Base64::decode64(value.to_s).split(SEPARATOR)
    aes.decrypt
    aes.key = key
    aes.iv  = iv
    aes.update(value) + aes.final
  end

  def search(records, field, criteria)
    records.select { |record| record[field] == criteria }
  end
end

class MigrateAes
  def initialize(options = {})
    @new_enc = CryptKeeper::Provider::Aes.new(options)
    @old_enc = OldAes.new(options)
  end

  def decrypt(value)
    plain_text = @old_enc.decrypt(value)

    if plain_text.blank?
      @new_enc.decrypt(value)
    else
      plain_text
    end
  end

  def encrypt(value)
    @new_enc.encrypt(value)
  end
end

endend

Reply to this email directly or view it on GitHubhttps://github.com//issues/63
.

from crypt_keeper.

@itspriddle how could the end up with old encryption? Doing Model.all { |m| m.save } would re-encrypt everything with the new encryption.

That is true – I didn't realize that was your intention. The migrators made it seem like you wanted to re-encrypt on demand.

from crypt_keeper.

My plan was to remove them in 0.17 release

On Feb 18, 2014, at 10:30 AM, Fabio Kreusch [email protected] wrote:

Looks good overall, my only concern is that it seems we will need to keep
the old versions around. If that is the case, maybe we should have some
kind of versioning mechanism?
On Feb 17, 2014 10:39 PM, "Justin Mazzi" [email protected] wrote:

Models can be migrated by use the migrate encryptors. Example:
:migrate_aes or :migrate_mysql_aes. This works by attempting to read the
data using the old encryption method and falling back to the new method.
Encryption always uses the new method

@fabiokr https://github.com/fabiokr @itspriddlehttps://github.com/itspriddlewhat are your thoughts on the below? It's pretty rough but seems to work in
my testing.

require 'digest/sha2'require 'openssl'require 'base64'
module CryptKeeper
module Provider
class OldMysqlAes < CryptKeeper::Provider::MysqlAes
def initialize(options = {})
@key = options.fetch(:key)
end
end

class MigrateMysqlAes
def initialize(options = {})
@new_enc = CryptKeeper::Provider::MysqlAes.new(options)
@old_enc = OldMysqlAes.new(options)
end

def decrypt(value)
plain_text = @old_enc.decrypt(value)

if plain_text.blank?
@new_enc.decrypt(value)
else
plain_text
end
end

def encrypt(value)
@new_enc.encrypt(value)
end
end

class OldAes
SEPARATOR = ":crypt_keeper:"

attr_accessor :key
attr_accessor :aes

def initialize(options = {})
@aes = ::OpenSSL::Cipher::Cipher.new("AES-256-CBC")
@aes.padding = 1

key = options.fetch(:key) do
raise ArgumentError, "Missing :key"
end

@key = Digest::SHA256.digest(key)
end

def encrypt(value)
aes.encrypt
aes.key = key
Base64::encode64("#{aes.random_iv}#{SEPARATOR}#{aes.update(value.to_s) + aes.final}")
end

def decrypt(value)
iv, value = Base64::decode64(value.to_s).split(SEPARATOR)
aes.decrypt
aes.key = key
aes.iv = iv
aes.update(value) + aes.final
end

def search(records, field, criteria)
records.select { |record| record[field] == criteria }
end
end

class MigrateAes
def initialize(options = {})
@new_enc = CryptKeeper::Provider::Aes.new(options)
@old_enc = OldAes.new(options)
end

def decrypt(value)
plain_text = @old_enc.decrypt(value)

if plain_text.blank?
@new_enc.decrypt(value)
else
plain_text
end
end

def encrypt(value)
@new_enc.encrypt(value)
end
end
endend

Reply to this email directly or view it on GitHubhttps://github.com//issues/63
.

—
Reply to this email directly or view it on GitHub.

from crypt_keeper.

Closed via #67

from crypt_keeper.