README.md in symmetric-encryption-0.3.0 vs README.md in symmetric-encryption-0.3.1

- old
+ new

@@ -135,13 +135,12 @@ --- # For the development and test environments the test symmetric encryption keys # can be placed directly in the source code. # And therefore no RSA private key is required development: &development_defaults - symmetric_key: 1234567890ABCDEF1234567890ABCDEF - symmetric_iv: 1234567890ABCDEF - encoding: base64 + key: 1234567890ABCDEF1234567890ABCDEF + iv: 1234567890ABCDEF cipher: aes-128-cbc test: <<: *development_defaults @@ -180,45 +179,17 @@ PnGA91G9MVikYapgI0VYBHQOTsz8rTIUzsKwXG+TIaK+W84nxH5y6jUkjqwxZmAz r1URaMAun2PfAB4g2N/kEZTExgeOGqXjFhvvjdzl97ux2cTyZhaTXg== -----END RSA PRIVATE KEY----- # List Symmetric Key files in the order of current / latest first - files: + ciphers: - # Filename containing Symmetric Encryption Key encrypted using the # RSA public key derived from the private key above - symmetric_key_filename: /etc/rails/.rails.key - symmetric_iv_filename: /etc/rails/.rails.iv + key_filename: /etc/rails/.rails.key + iv_filename: /etc/rails/.rails.iv - # By adding a version indicator all encrypted data will include - # an additional first Byte that includes this version number to - # assist with speeding up decryption when adding new encryption keys - # and to support old data decryption using older keys - # - # By not specifying a version, or setting it to 0 will disable version - # identification prior to decrypting data - # During decryption these Keys will be tried in the order listed in the - # configuration file starting with the first in the list - # Slower since a decryption attempt is made for every key until the - # correct key is located. However, all encrypted data does not require - # the 1 Byte version header prefix - # - # Default: 0 - version: 0 - - # Set the way the encrypted data is encoded: - # base64 - # Encrypted data is returned in base64 encoding format - # Symmetric::Encryption.decrypt will also base64 decode any data prior - # to decrypting it - # binary - # Encrypted data is returned as raw binary - # Although smaller than base64 it cannot be stored in MySQL text columns - # It can only be held in binary columns such as BINARY or BLOB - # Default: base64 - encoding: base64 - # Encryption cipher # Recommended values: # aes-256-cbc # 256 AES CBC Algorithm. Very strong # Ruby 1.8.7 MRI Approximately 100,000 encryptions or decryptions per second @@ -238,13 +209,13 @@ The symmetric encryption key consists of the key itself and an optional initialization vector. To generate the keys run the following Rake task in each environment: - RAILS_ENV=release rake symmetric_encryption:generate_symmetric_keys + RAILS_ENV=production rake symmetric_encryption:generate_symmetric_keys -Replace 'release' as necessary for each environment. +Replace 'production' as necessary for each environment. Make sure that the current user has read and write access to the folder listed in the configuration option symmetric_key_filename above. Once the Symmetric Encryption keys have been generated, secure them further by @@ -282,11 +253,11 @@ * Filename of the configuration file created above * Name of the environment to load the configuration for ## Supporting Multiple Encryption Keys -According to the PCI Compliace documentation: "Cryptographic keys must be changed on an annual basis." +According to the PCI Compliance documentation: "Cryptographic keys must be changed on an annual basis." During the transition period of moving from one encryption key to another symmetric-encryption supports multiple Symmetric Encryption keys. If decryption with the current key fails, any previous keys will also be tried automatically. @@ -306,13 +277,12 @@ --- # For the development and test environments the test symmetric encryption keys # can be placed directly in the source code. # And therefore no RSA private key is required development: &development_defaults - symmetric_key: 1234567890ABCDEF1234567890ABCDEF - symmetric_iv: 1234567890ABCDEF - encoding: base64 + key: 1234567890ABCDEF1234567890ABCDEF + iv: 1234567890ABCDEF cipher: aes-128-cbc test: <<: *development_defaults @@ -351,45 +321,17 @@ PnGA91G9MVikYapgI0VYBHQOTsz8rTIUzsKwXG+TIaK+W84nxH5y6jUkjqwxZmAz r1URaMAun2PfAB4g2N/kEZTExgeOGqXjFhvvjdzl97ux2cTyZhaTXg== -----END RSA PRIVATE KEY----- # List Symmetric Key files in the order of current / latest first - files: + ciphers: - # Filename containing Symmetric Encryption Key encrypted using the # RSA public key derived from the private key above - symmetric_key_filename: /etc/rails/.rails.key - symmetric_iv_filename: /etc/rails/.rails.iv + key_filename: /etc/rails/.rails.key + iv_filename: /etc/rails/.rails.iv - # By adding a version indicator all encrypted data will include - # an additional first Byte that includes this version number to - # assist with speeding up decryption when adding new encryption keys - # and to support old data decryption using older keys - # - # By not specifying a version, or setting it to 0 will disable version - # identification prior to decrypting data - # During decryption these Keys will be tried in the order listed in the - # configuration file starting with the first in the list - # Slower since a decryption attempt is made for every key until the - # correct key is located. However, all encrypted data does not require - # the 1 Byte version header prefix - # - # Default: 0 - version: 0 - - # Set the way the encrypted data is encoded: - # base64 - # Encrypted data is returned in base64 encoding format - # Symmetric::Encryption.decrypt will also base64 decode any data prior - # to decrypting it - # binary - # Encrypted data is returned as raw binary - # Although smaller than base64 it cannot be stored in MySQL text columns - # It can only be held in binary columns such as BINARY or BLOB - # Default: base64 - encoding: base64 - # Encryption cipher # Recommended values: # aes-256-cbc # 256 AES CBC Algorithm. Very strong # Ruby 1.8.7 MRI Approximately 100,000 encryptions or decryptions per second @@ -397,21 +339,19 @@ # aes-128-cbc # 128 AES CBC Algorithm. Less strong. # Ruby 1.8.7 MRI Approximately 100,000 encryptions or decryptions per second # JRuby 1.6.7 with Ruby 1.8.7 Approximately 22,000 encryptions or decryptions per second cipher: aes-256-cbc - + - # OPTIONAL: # # Any previous Symmetric Encryption Keys # # Only used when old data still exists that requires old decryption keys # to be used - symmetric_key_filename: /etc/rails/.rails_old.key - symmetric_iv_filename: /etc/rails/.rails_old.iv - version: 0 - encoding: base64 + key_filename: /etc/rails/.rails_old.key + iv_filename: /etc/rails/.rails_old.iv cipher: aes-256-cbc ## Possible Future Enhancements Submit an issue ticket to request any of the following features: