feat: derive a key of the correct length based on the cipher

Derive a key of the appropriate length instead of default 32-byte digest from SHA256.

Author: rubysamurai

lib/cryptology.rb

@@ -6,7 +6,8 @@ module Cryptology
   def self.encrypt(data:, key:, salt: nil, iter: 10_000, cipher: 'AES-256-CBC', iv: nil)
     salt ||= OpenSSL::Random.random_bytes(16)
     iv ||= OpenSSL::Cipher.new(cipher).random_iv
-    encrypted = encrypt_data(data.to_s, digest_key(key, salt, iter), cipher, iv)
+    derived_key = digest_key(key, salt, iter, OpenSSL::Cipher.new(cipher).key_len)
+    encrypted = encrypt_data(data.to_s, derived_key, cipher, iv)
     { 'cipher' => cipher,
       'salt' => salt,
       'iter' => iter,
@@ -16,7 +17,8 @@ def self.encrypt(data:, key:, salt: nil, iter: 10_000, cipher: 'AES-256-CBC', iv
 
   def self.decrypt(data:, key:, salt:, iter: 10_000, cipher: 'AES-256-CBC', iv:)
     base64_decoded = ::Base64.decode64(data.to_s)
-    decrypt_data(base64_decoded, digest_key(key, salt, iter), cipher, iv)
+    derived_key = digest_key(key, salt, iter, OpenSSL::Cipher.new(cipher).key_len)
+    decrypt_data(base64_decoded, derived_key, cipher, iv)
       .force_encoding('UTF-8').encode
   end
 
@@ -42,10 +44,9 @@ def self.decrypt_data(data, key, cipher, iv)
     decipher.update(data) + decipher.final
   end
 
-  def self.digest_key(key, salt, iter)
-    digest = OpenSSL::Digest::SHA256.new
-    len = digest.digest_length
-    OpenSSL::PKCS5.pbkdf2_hmac(key, salt, iter, len, digest)
+  def self.digest_key(key, salt, iter, key_len)
+    digest = OpenSSL::Digest.new('SHA256')
+    OpenSSL::PKCS5.pbkdf2_hmac(key, salt, iter, key_len, digest)
   end
 
   private_class_method :encrypt_data, :decrypt_data, :digest_key

spec/cryptology_spec.rb

@@ -1,33 +1,96 @@
-CIPHERS = %w[AES-128-XTS
+CIPHERS = %w[AES-128-CBC
+             AES-128-CFB
+             AES-128-CFB1
+             AES-128-CFB8
+             AES-128-CTR
+             AES-128-ECB
+             AES-128-OFB
+             AES-128-XTS
+             AES-192-CBC
+             AES-192-CFB
+             AES-192-CFB1
+             AES-192-CFB8
+             AES-192-CTR
+             AES-192-ECB
+             AES-192-OFB
              AES-256-CBC
              AES-256-CFB
              AES-256-CFB1
              AES-256-CFB8
              AES-256-CTR
              AES-256-ECB
              AES-256-OFB
+             AES-256-XTS
+             AES128
+             AES192
              AES256
 
+             ARIA-128-CBC
+             ARIA-128-CFB
+             ARIA-128-CFB1
+             ARIA-128-CFB8
+             ARIA-128-CTR
+             ARIA-128-ECB
+             ARIA-128-OFB
+             ARIA-192-CBC
+             ARIA-192-CFB
+             ARIA-192-CFB1
+             ARIA-192-CFB8
+             ARIA-192-CTR
+             ARIA-192-ECB
+             ARIA-192-OFB
              ARIA-256-CBC
              ARIA-256-CFB
              ARIA-256-CFB1
              ARIA-256-CFB8
              ARIA-256-CTR
              ARIA-256-ECB
              ARIA-256-OFB
+             ARIA128
+             ARIA192
              ARIA256
 
+             CAMELLIA-128-CBC
+             CAMELLIA-128-CFB
+             CAMELLIA-128-CFB1
+             CAMELLIA-128-CFB8
+             CAMELLIA-128-CTR
+             CAMELLIA-128-ECB
+             CAMELLIA-128-OFB
+             CAMELLIA-192-CBC
+             CAMELLIA-192-CFB
+             CAMELLIA-192-CFB1
+             CAMELLIA-192-CFB8
+             CAMELLIA-192-CTR
+             CAMELLIA-192-ECB
+             CAMELLIA-192-OFB
              CAMELLIA-256-CBC
              CAMELLIA-256-CFB
              CAMELLIA-256-CFB1
              CAMELLIA-256-CFB8
              CAMELLIA-256-CTR
              CAMELLIA-256-ECB
              CAMELLIA-256-OFB
+             CAMELLIA128
+             CAMELLIA192
              CAMELLIA256
 
              CHACHA20
-             CHACHA20-POLY1305].freeze
+             CHACHA20-POLY1305
+
+             DES-EDE
+             DES-EDE-CBC
+             DES-EDE-CFB
+             DES-EDE-ECB
+             DES-EDE-OFB
+             DES-EDE3
+             DES-EDE3-CBC
+             DES-EDE3-CFB
+             DES-EDE3-CFB1
+             DES-EDE3-CFB8
+             DES-EDE3-ECB
+             DES-EDE3-OFB
+             DES3].freeze
 
 RSpec.describe Cryptology do
   let(:data) { 'Very confidential data with UTF-8 symbols: ♠ я ü æ' }
@@ -195,7 +258,7 @@
                                 key: key,
                                 salt: salt,
                                 iter: iter,
-                                cipher: 'AES-256-CBC',
+                                cipher: 'AES-128-CCM',
                                 iv: iv)
       ).to be false
     end