README.md in lockbox-0.6.2 vs README.md in lockbox-0.6.3
- old
+ new
@@ -70,11 +70,11 @@
## Active Record
Create a migration with:
```ruby
-class AddEmailCiphertextToUsers < ActiveRecord::Migration[6.0]
+class AddEmailCiphertextToUsers < ActiveRecord::Migration[6.1]
def change
add_column :users, :email_ciphertext, :text
end
end
```
@@ -246,11 +246,11 @@
**Note:** Action Text uses direct uploads for files, which cannot be encrypted with application-level encryption like Lockbox. This only encrypts the database field.
Create a migration with:
```ruby
-class AddBodyCiphertextToRichTexts < ActiveRecord::Migration[6.0]
+class AddBodyCiphertextToRichTexts < ActiveRecord::Migration[6.1]
def change
add_column :action_text_rich_texts, :body_ciphertext, :text
end
end
```
@@ -377,11 +377,11 @@
Encryption is applied to all versions after processing.
You can mount the uploader [as normal](https://github.com/carrierwaveuploader/carrierwave#activerecord). With Active Record, this involves creating a migration:
```ruby
-class AddLicenseToUsers < ActiveRecord::Migration[6.0]
+class AddLicenseToUsers < ActiveRecord::Migration[6.1]
def change
add_column :users, :license, :string
end
end
```
@@ -566,16 +566,14 @@
Update your model:
```ruby
class User < ApplicationRecord
- encrypts :email, previous_versions: [{key: previous_key}]
+ encrypts :email, previous_versions: [{master_key: previous_key}]
end
```
-Use `master_key` instead of `key` if passing the master key.
-
To rotate existing records, use:
```ruby
Lockbox.rotate(User, attributes: [:email])
```
@@ -585,15 +583,13 @@
### Action Text
Update your initializer:
```ruby
-Lockbox.encrypts_action_text_body(previous_versions: [{key: previous_key}])
+Lockbox.encrypts_action_text_body(previous_versions: [{master_key: previous_key}])
```
-Use `master_key` instead of `key` if passing the master key.
-
To rotate existing records, use:
```ruby
Lockbox.rotate(ActionText::RichText, attributes: [:body])
```
@@ -604,16 +600,14 @@
Update your model:
```ruby
class User < ApplicationRecord
- encrypts_attached :license, previous_versions: [{key: previous_key}]
+ encrypts_attached :license, previous_versions: [{master_key: previous_key}]
end
```
-Use `master_key` instead of `key` if passing the master key.
-
To rotate existing files, use:
```ruby
User.with_attached_license.find_each do |user|
user.license.rotate_encryption!
@@ -626,16 +620,14 @@
Update your model:
```ruby
class LicenseUploader < CarrierWave::Uploader::Base
- encrypt previous_versions: [{key: previous_key}]
+ encrypt previous_versions: [{master_key: previous_key}]
end
```
-Use `master_key` instead of `key` if passing the master key.
-
To rotate existing files, use:
```ruby
User.find_each do |user|
user.license.rotate_encryption!
@@ -706,11 +698,11 @@
- an IETF standard
- fast thanks to a [dedicated instruction set](https://en.wikipedia.org/wiki/AES_instruction_set)
Lockbox uses 256-bit keys.
-**For users who do a lot of encryptions:** You should rotate an individual key after 2 billion encryptions to minimize the chance of a [nonce collision](https://www.cryptologie.net/article/402/is-symmetric-security-solved/), which will expose the key. Each database field and file uploader use a different key (derived from the master key) to extend this window.
+**For users who do a lot of encryptions:** You should rotate an individual key after 2 billion encryptions to minimize the chance of a [nonce collision](https://www.cryptologie.net/article/402/is-symmetric-security-solved/), which will expose the authentication key. Each database field and file uploader use a different key (derived from the master key) to extend this window.
### XSalsa20
You can also use XSalsa20, which uses an extended nonce so you don’t have to worry about nonce collisions. First, [install Libsodium](https://github.com/crypto-rb/rbnacl/wiki/Installing-libsodium). For Homebrew, use:
@@ -995,11 +987,11 @@
## Binary Columns
You can use `binary` columns for the ciphertext instead of `text` columns.
```ruby
-class AddEmailCiphertextToUsers < ActiveRecord::Migration[6.0]
+class AddEmailCiphertextToUsers < ActiveRecord::Migration[6.1]
def change
add_column :users, :email_ciphertext, :binary
end
end
```
@@ -1040,11 +1032,11 @@
```
Create a migration with:
```ruby
-class MigrateToLockbox < ActiveRecord::Migration[6.0]
+class MigrateToLockbox < ActiveRecord::Migration[6.1]
def change
add_column :users, :name_ciphertext, :text
add_column :users, :email_ciphertext, :text
end
end
@@ -1073,10 +1065,10 @@
```
Then remove the previous gem from your Gemfile and drop its columns.
```ruby
-class RemovePreviousEncryptedColumns < ActiveRecord::Migration[6.0]
+class RemovePreviousEncryptedColumns < ActiveRecord::Migration[6.1]
def change
remove_column :users, :encrypted_name, :text
remove_column :users, :encrypted_name_iv, :text
remove_column :users, :encrypted_email, :text
remove_column :users, :encrypted_email_iv, :text