Sodium 正在参加 2020 年度 OSC 中国开源项目评选,请投票支持!
Sodium 在 2020 年度 OSC 中国开源项目评选 中已获得 {{ projectVoteCount }} 票,请投票支持!
投票让它出道
已投票
授权协议: MIT
开发语言: Ruby
操作系统: 跨平台
收录时间: 2020-03-25
提 交 者: 红薯

sodium 是高性能易用的加密库 libsodium  的 Ruby 封装版本。(libsodium 基于 Daniel J. Bernstein 的 NaCl开发). NaCl提供了构建高级加密工具的核心功能。

NaCl improves upon existing libraries with improved security through tight coding standads, improved usability, and significantly boosted performance.

Why Sodium?

sodium exports the functions provided by libsodium in an object-oriented, Rubylike manner using a very thin FFI wrapper. It thus provides all the benefits of using the libsodium C library directly: simplicity, performance, and security.

This library is tightly focused on providing only modern primitives and operations, giving users as few ways as possible to shoot themselves in the foot. While no crypto library can prevent all classes of user error, this library at least attempts to minimize the possibility of known, easily-preventable types of user error such as the use of broken primitives, reliance on non-authenticated encryption modes, and composition of low-level primitives to perform tasks for which well-studied high-level operations already exist.

Libraries like OpenSSL pack in support for every cryptographic primitive, protocol, and operation under the sun. Many of these supported features are cryptographically broken and preserved only so developers can maintain compatibility with older software. This is explicitly not a goal of sodium. While we will provide migration paths away from any primitives discovered to be weak or broken, we will never introduce known-bad primitives (e.g., MD5 or SHA-1) or easy-to-fuck-up operations (e.g., CBC mode) for the sake of interoperability.

Security

The underlying cryptographic functions and APIs have been designed, chosen, and implemented by professional cryptographers. sodium itself, however, has not. No guarantees are made about its security nor suitability for any particular purpose.

If believe you have discovered a security vulnerability in the sodium wrapper, contact me at sodium (at) touset (dot) org. Please encrypt your message using the project's GPG key (fingerprint: 1E71 12A4 9424 2358 F6C8 727D C947 F58B FFCE E0D7).

Supported Platforms

  • MRI 2.0
  • MRI 1.9.3
  • MRI 1.8.7 / REE
  • Rubinius 1.8 / 1.9
  • JRuby 1.8 / 1.9

Support for these platforms is automatically tested using Travis CI.

Windows is also theoretically supported, but is as of yet completely untested. If sodium doesn't work for you on Windows (or any of the other supported platforms, for that matter), please submit a bug.

Installation

Dependencies

sodium depends on the libsodium C library. It can be installed through homebrew on OSX.

brew install libsodium

Ruby Gem

sodium is distributed as a gem of the same name. You can simply install it through the gem command

gem install sodium

or install it through bundler by adding it to your Gemfile and bundling.

echo gem 'sodium' >> Gemfile
bundle

Signed Gem

As of version 0.6.0, the sodium gem will be signed with the project's public key. Ruby support for gem signatures is still in its infancy, but it is functional. You must install our certificate before you can verify the gem signature. Start by downloading the certificate and verifying its checksum.

curl -O https://raw.github.com/stouset/sodium/master/certs/sodium@touset.org.cert
shasum -a 256 --check <(echo "6c731e7872dbfab18397d62ee9aa1215ef186a5f31358d1f041faa49301624a6  sodium@touset.org.cert")

Of course, if our GitHub repo has been compromised, someone can easily replace both the key in the repo and the checksum in these directions. Like I said, gem signatures are still in their infancy. I encourage you to verify this signature through alternate channels. For instance, you can at least examine the git history of the file, and ensure it hasn't been changed (unless otherwise announced).

Once you have the certificate and have confirmed its correctness to your satisfaction, install it and then the gem.

gem cert -a sodium@touset.org.cert
gem install sodium -P HighSecurity

Verifying the gem signature when using bundler is substantially more difficult and will not be covered here until it becomes more practical. If you're curious, feel free to read the relevant literature.

展开阅读全文

代码

的 Gitee 指数为
超过 的项目

Sodium 的相关资讯

还没有任何资讯

Sodium 的相关博客

Suramin sodium salt苏拉明钠

  Suramin sodium salt (Suramin hexasodium salt) 是一种可逆的竞争性蛋白酪氨酸磷酸酶 (PTPases) 抑制剂。Suramin s...

Entangle 2.0 “Sodium”正式发布

自上次听到Entangle以来已经有一段时间,但今天标志着Entangle 2.0 “Sodium”发布。 Entangle 2.0将其GTK3工具包要求提升至G...

Entangle 2.0 “Sodium”正式发布

Entangle是一款自由而开源的软件,可让您从Linux控制DSLR相机。 使用各种尼康和佳能数码单反相机,可以查看实时预览,自动下载...

微信退款通知,退款回调数据解密.SHA256签名AEAD_AES_256_GCM解密

$xmlResult = file_get_contents("php://input");//获取微信的数据 $result = $this->xmlToArray($xmlResult);//将xml转成数组...

项目中使用libsodium扩展

前段时间研究了微信小微商户,地址:https://pay.weixin.qq.com/wiki/doc/api/xiaowei.php?chapter=19_11 其接口操作中需要下...

第二章 创建和销毁对象

1.考虑用静态工厂方法代替构造器 优势: 有名称,易于理解 可以重复利用对象,避免创建重复的对象 可以返回原返回类型的任何子...

Java 使用Builder解决构造函数参数过多的问题

原文:https://blog.csdn.net/michael_f2008/article/details/77715075 //Builder Pattern public class NutritionFacts{ ...

对比OpenDaylight Neon SR1与SR2

这篇文章之前在PPANTHEON.tech发布。 OpenDaylight Sodium版本的发展已经产生了显著的进步,其中一些将包含在即将发布的Neon服...

Ubuntu安装shadow$ocks-libev

参考 ubuntu16.04 配置shadowsocks及使用教程,支持chacha20-ietf-poly1305加密方式 安装shadow$ocks-libev sudo apt-get in...

Sodium 的相关问答

还没有任何问答,马上提问

评论 (0)

加载中
更多评论
0 评论
0 收藏
分享
返回顶部
顶部