Add option to configure digest in ActiveRecord Encryption, default to SHA256

[jorgemanrubia]

Rails 7 uses SHA256 as the new default digest. With this change, Active Record Encryption will enforce using SHA256 too. Before, it was initializing with SHA1 due to the initialization sequence described in #42922.

The new option can be configured with:

config.active_record.encryption.hash_digest_class = OpenSSL::Digest::SHA1

I added a separated option for Active Record encryption because we need it to be stable. If not, it could happen that, if we set a new default for Rails, it would invalidate existing encrypted data (which is essentially what happened when we changed the default digest for 6.1 apps using encryption). We use the digest to derive keys so, if it changes, keys change and existing data can't be decrypted.

SHA256 is the new default in Rails 7.0 so we adopt it for Active Record encryption, which is a 7.0 feature. I am also setting it retroactively to SHA1 for 6.0 defaults, so that early adopters of encryption before the default changed don't have to tweak the new config to decrypt with existing data.

Fix #42922

cc @ghiculescu @boomer196

[jorgemanrubia]

Big diff because I formatted the markdown table. It's only adding the last line (hash_digest_class)

[boomer196]

@jorgemanrubia - Thanks for looking into the #42922 issue report and turning a PR around so quickly!

A couple of questions/comments:

• Do you want to also include iterations in the options hash used in the call to ActiveSupport::KeyGenerator.new in ActiveRecord::Encryption::KeyGenerator#derive_key_from just for completeness of the ActiveSupport::KeyGenerator API (even if you don't allow configuration)?
• Do you need the backwards compatibility with Rails 6 since I believe this is a new feature in Rails 7?

[jorgemanrubia]

Do you want to also include iterations in the options hash used in the call to ActiveSupport::KeyGenerator.new in ActiveRecord::Encryption::KeyGenerator#derive_key_from just for completeness of the ActiveSupport::KeyGenerator API (even if you don't allow configuration)?

Yes, good idea! I added the iterations param as a fixed value for now.

Do you need the backwards compatibility with Rails 6 since I believe this is a new feature in Rails 7?

This is the current case of HEY: it's loading 6.0 defaults but runs on Rails edge and it uses Active Record encryption. I imagine there can be more apps in this situation: early adopters of AR encryption that, after upgrading, would see existing encryption broken. They would have to add this to fix the problem:

config.active_record.encryption.hash_digest_class = OpenSSL::Digest::SHA1

The new 6.0 default is intended to cover this case.

[jcmfernandes]

Sorry in advance for hijacking the conversation to ask the following (I tried my best to find the answer on github and the ML but without success): will we also want ActiveSupport::MessageVerifier to default to SHA-256? It still defaults to SHA-1.

[jorgemanrubia]

hey @ghiculescu could we get this merged please? Thanks!

[jorgemanrubia]

Thanks for the review @rafaelfranca @marivaldo. I think I addressed all the comments.

[rails-bot]

This pull request has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs.
Thank you for your contributions.

[rmm5t]

@jorgemanrubia @ghiculescu @rafaelfranca @marivaldo It doesn't look like this was merged before the 7.0 release. Was the underlying issue handled elsewhere? Shouldn't this PR be reopened?
/cc @boomer196