Ruby 加密库 Sodium

MIT
Ruby
跨平台
2020-03-25
红薯

疫情之下,程序员如何转型?共享数字化转型加速度,就在微软在线技术峰会>>>

sodium

sodium 是高性能易用的加密库 libsodium  的 Ruby 封装版本。(libsodium 基于 Daniel J. Bernstein 的 NaCl开发). NaCl提供了构建高级加密工具的核心功能。

NaCl improves upon existing libraries with improved security through tight coding standads, improved usability, and significantly boosted performance.

Why Sodium?

sodium exports the functions provided by libsodium in an object-oriented, Rubylike manner using a very thin FFI wrapper. It thus provides all the benefits of using the libsodium C library directly: simplicity, performance, and security.

This library is tightly focused on providing only modern primitives and operations, giving users as few ways as possible to shoot themselves in the foot. While no crypto library can prevent all classes of user error, this library at least attempts to minimize the possibility of known, easily-preventable types of user error such as the use of broken primitives, reliance on non-authenticated encryption modes, and composition of low-level primitives to perform tasks for which well-studied high-level operations already exist.

Libraries like OpenSSL pack in support for every cryptographic primitive, protocol, and operation under the sun. Many of these supported features are cryptographically broken and preserved only so developers can maintain compatibility with older software. This is explicitly not a goal of sodium. While we will provide migration paths away from any primitives discovered to be weak or broken, we will never introduce known-bad primitives (e.g., MD5 or SHA-1) or easy-to-fuck-up operations (e.g., CBC mode) for the sake of interoperability.

Security

The underlying cryptographic functions and APIs have been designed, chosen, and implemented by professional cryptographers. sodium itself, however, has not. No guarantees are made about its security nor suitability for any particular purpose.

If believe you have discovered a security vulnerability in the sodium wrapper, contact me at sodium (at) touset (dot) org. Please encrypt your message using the project's GPG key (fingerprint: 1E71 12A4 9424 2358 F6C8 727D C947 F58B FFCE E0D7).

Supported Platforms

  • MRI 2.0
  • MRI 1.9.3
  • MRI 1.8.7 / REE
  • Rubinius 1.8 / 1.9
  • JRuby 1.8 / 1.9

Support for these platforms is automatically tested using Travis CI.

Windows is also theoretically supported, but is as of yet completely untested. If sodium doesn't work for you on Windows (or any of the other supported platforms, for that matter), please submit a bug.

Installation

Dependencies

sodium depends on the libsodium C library. It can be installed through homebrew on OSX.

brew install libsodium

Ruby Gem

sodium is distributed as a gem of the same name. You can simply install it through the gem command

gem install sodium

or install it through bundler by adding it to your Gemfile and bundling.

echo gem 'sodium' >> Gemfile
bundle

Signed Gem

As of version 0.6.0, the sodium gem will be signed with the project's public key. Ruby support for gem signatures is still in its infancy, but it is functional. You must install our certificate before you can verify the gem signature. Start by downloading the certificate and verifying its checksum.

curl -O https://raw.github.com/stouset/sodium/master/certs/sodium@touset.org.cert
shasum -a 256 --check <(echo "6c731e7872dbfab18397d62ee9aa1215ef186a5f31358d1f041faa49301624a6  sodium@touset.org.cert")

Of course, if our GitHub repo has been compromised, someone can easily replace both the key in the repo and the checksum in these directions. Like I said, gem signatures are still in their infancy. I encourage you to verify this signature through alternate channels. For instance, you can at least examine the git history of the file, and ensure it hasn't been changed (unless otherwise announced).

Once you have the certificate and have confirmed its correctness to your satisfaction, install it and then the gem.

gem cert -a sodium@touset.org.cert
gem install sodium -P HighSecurity

Verifying the gem signature when using bundler is substantially more difficult and will not be covered here until it becomes more practical. If you're curious, feel free to read the relevant literature.

的码云指数为
超过 的项目
加载中

评论(0)

暂无评论

暂无资讯

暂无问答

Entangle 2.0 “Sodium”正式发布

自上次听到Entangle以来已经有一段时间,但今天标志着Entangle 2.0 “Sodium”发布。 Entangle 2.0将其GTK3工具包要求提升至GTK+ 3.22,对其Wayland支持进行了一些更新,提供了各种图像处理改...

2019/02/12 18:47
25
0
Android最佳的开源库(四)

网络 OkHttp:Android的HTTP客户端库。 AndroidAsync:异步通信库。 通知推送 PubNub:用来处理推送通知的通信服务。 Gandalf:给用户发送更新或维护消息库。 支付 Android In-App Billing v...

2016/11/15 11:20
71
0
Redox OS 发布 0.5 版

Redox OS 是一个几乎完全以 Rust 语言编写的通用操作系统及周围生态(例如文件系统、显示服务器及 Rust 版本的 libc)。其遵循微内核架构,在一定程度上兼容于 POSIX。 该项目于日前发布了 ...

2019/05/19 18:30
255
0

没有更多内容

加载失败,请刷新页面

没有更多内容

返回顶部
顶部