CryptKeeper

Provides transparent encryption for ActiveRecord. It is encryption agnostic. You can guard your data with any encryption algorithm you want. All you need is a simple class that does 3 things.

1. Takes a hash argument for initialize
2. Provides an encrypt method that returns the encrypted string
3. Provides a decrypt method that returns the plaintext

Note: Any options defined using crypt_keeper will be passed to new as a hash.

You can see an AES example here.

Why?

The options available were either too complicated under the hood or had weird edge cases that made the library hard to use. I wanted to write something simple that just works.

Usage

class MyModel < ActiveRecord::Base
  crypt_keeper :field, :other_field, :encryptor => :aes, :key => 'super_good_password'
end

model = MyModel.new(field: 'sometext')
model.save! #=> Your data is now encrypted
model.field #=> 'sometext'

It works with all persistences methods: update_attributes, create, save etc.

Note: update_attribute is deprecated in ActiveRecord 3.2.7. It is superseded by update_column which skips all validations, callbacks.

That means using update_column will not perform any encryption. This is expected behavior, and has its use cases. An example would be migrating from one type of encryption to another. Using update_column would allow you to update the content without going through the current encryptor.

Creating your own encryptor

Creating your own encryptor is easy. All you have to do is create a class under the CryptKeeper::Provider namespace, like this:

module CryptKeeper
  module Provider
    class MyEncryptor
      def initialize(options = {})
      end

      def encrypt(value)
      end

      def decrypt(value)
      end
    end
  end
end

Just require your code and setup your model to use it. Just pass the class name as a string or an underscored symbol

class MyModel < ActiveRecord::Base
  crypt_keeper :field, :other_field, :encryptor => :my_encryptor, :key => 'super_good_password'
end

Available Encryptors

There are two included encryptors.

• AES

  • Encryption is peformed using AES-256 via OpenSSL.

• MySQL AES

  • Encryption is peformed MySQL's native AES functions.
  • ActiveRecord logs are automatically filtered for you to protect senitive data from being logged.

• PostgreSQL PGP.

  • Encryption is performed using PostgresSQL's native PGP functions.
  • It requires the pgcrypto PostgresSQL extension: CREATE EXTENSION IF NOT EXISTS pgcrypto
  • ActiveRecord logs are automatically filtered for you to protect senitive data from being logged.
  • Custom options can be set through the :pgcrypto_options. E.g. `crypt_keeper :field, encryptor: :postgres_pgp, pgcrypto_options: 'compress-level=9'

Requirements

CryptKeeper has been tested against ActiveRecord 3.0, 3.1, 3.2 using ruby 1.9.3 and jruby in 1.9 mode.

ActiveRecord 4.0 is supported starting with v0.11.0.

Installation

Add this line to your application's Gemfile:

gem 'crypt_keeper'

And then execute:

$ bundle

Or install it yourself as:

$ gem install crypt_keeper

Contributing

1. Fork it
2. Create your feature branch (git checkout -b my-new-feature)
3. Commit your changes (git commit -am 'Add some feature')
4. Push to the branch (git push origin my-new-feature)
5. Create new Pull Request