README.md in lockbox-0.6.2 vs README.md in lockbox-0.6.3

- old
+ new

@@ -70,11 +70,11 @@ ## Active Record Create a migration with: ```ruby -class AddEmailCiphertextToUsers < ActiveRecord::Migration[6.0] +class AddEmailCiphertextToUsers < ActiveRecord::Migration[6.1] def change add_column :users, :email_ciphertext, :text end end ``` @@ -246,11 +246,11 @@ **Note:** Action Text uses direct uploads for files, which cannot be encrypted with application-level encryption like Lockbox. This only encrypts the database field. Create a migration with: ```ruby -class AddBodyCiphertextToRichTexts < ActiveRecord::Migration[6.0] +class AddBodyCiphertextToRichTexts < ActiveRecord::Migration[6.1] def change add_column :action_text_rich_texts, :body_ciphertext, :text end end ``` @@ -377,11 +377,11 @@ Encryption is applied to all versions after processing. You can mount the uploader [as normal](https://github.com/carrierwaveuploader/carrierwave#activerecord). With Active Record, this involves creating a migration: ```ruby -class AddLicenseToUsers < ActiveRecord::Migration[6.0] +class AddLicenseToUsers < ActiveRecord::Migration[6.1] def change add_column :users, :license, :string end end ``` @@ -566,16 +566,14 @@ Update your model: ```ruby class User < ApplicationRecord - encrypts :email, previous_versions: [{key: previous_key}] + encrypts :email, previous_versions: [{master_key: previous_key}] end ``` -Use `master_key` instead of `key` if passing the master key. - To rotate existing records, use: ```ruby Lockbox.rotate(User, attributes: [:email]) ``` @@ -585,15 +583,13 @@ ### Action Text Update your initializer: ```ruby -Lockbox.encrypts_action_text_body(previous_versions: [{key: previous_key}]) +Lockbox.encrypts_action_text_body(previous_versions: [{master_key: previous_key}]) ``` -Use `master_key` instead of `key` if passing the master key. - To rotate existing records, use: ```ruby Lockbox.rotate(ActionText::RichText, attributes: [:body]) ``` @@ -604,16 +600,14 @@ Update your model: ```ruby class User < ApplicationRecord - encrypts_attached :license, previous_versions: [{key: previous_key}] + encrypts_attached :license, previous_versions: [{master_key: previous_key}] end ``` -Use `master_key` instead of `key` if passing the master key. - To rotate existing files, use: ```ruby User.with_attached_license.find_each do |user| user.license.rotate_encryption! @@ -626,16 +620,14 @@ Update your model: ```ruby class LicenseUploader < CarrierWave::Uploader::Base - encrypt previous_versions: [{key: previous_key}] + encrypt previous_versions: [{master_key: previous_key}] end ``` -Use `master_key` instead of `key` if passing the master key. - To rotate existing files, use: ```ruby User.find_each do |user| user.license.rotate_encryption! @@ -706,11 +698,11 @@ - an IETF standard - fast thanks to a [dedicated instruction set](https://en.wikipedia.org/wiki/AES_instruction_set) Lockbox uses 256-bit keys. -**For users who do a lot of encryptions:** You should rotate an individual key after 2 billion encryptions to minimize the chance of a [nonce collision](https://www.cryptologie.net/article/402/is-symmetric-security-solved/), which will expose the key. Each database field and file uploader use a different key (derived from the master key) to extend this window. +**For users who do a lot of encryptions:** You should rotate an individual key after 2 billion encryptions to minimize the chance of a [nonce collision](https://www.cryptologie.net/article/402/is-symmetric-security-solved/), which will expose the authentication key. Each database field and file uploader use a different key (derived from the master key) to extend this window. ### XSalsa20 You can also use XSalsa20, which uses an extended nonce so you don’t have to worry about nonce collisions. First, [install Libsodium](https://github.com/crypto-rb/rbnacl/wiki/Installing-libsodium). For Homebrew, use: @@ -995,11 +987,11 @@ ## Binary Columns You can use `binary` columns for the ciphertext instead of `text` columns. ```ruby -class AddEmailCiphertextToUsers < ActiveRecord::Migration[6.0] +class AddEmailCiphertextToUsers < ActiveRecord::Migration[6.1] def change add_column :users, :email_ciphertext, :binary end end ``` @@ -1040,11 +1032,11 @@ ``` Create a migration with: ```ruby -class MigrateToLockbox < ActiveRecord::Migration[6.0] +class MigrateToLockbox < ActiveRecord::Migration[6.1] def change add_column :users, :name_ciphertext, :text add_column :users, :email_ciphertext, :text end end @@ -1073,10 +1065,10 @@ ``` Then remove the previous gem from your Gemfile and drop its columns. ```ruby -class RemovePreviousEncryptedColumns < ActiveRecord::Migration[6.0] +class RemovePreviousEncryptedColumns < ActiveRecord::Migration[6.1] def change remove_column :users, :encrypted_name, :text remove_column :users, :encrypted_name_iv, :text remove_column :users, :encrypted_email, :text remove_column :users, :encrypted_email_iv, :text