Ruby binding for libsodium, a fork of the Networking and Cryptography library.
NaCl is a different kind of cryptographic library. In the past crypto libraries were kitchen sinks of little bits and pieces, like ciphers, MACs, signature algorithms, and hash functions. To accomplish anything you had to make a lot of decisions about which specific pieces to use, and if any of your decisions were wrong, the result was an insecure system. The choices are also not easy: EAX? GCM? CCM? AES-CTR? CMAC? OMAC1? AEAD? NIST? CBC? CFB? CTR? ECB? OMGWTFBBQ!
NaCl puts cryptography on Rails! Instead of making you choose which cryptographic primitives to use, NaCl provides convention over configuration in the form of expertly-assembled high-level cryptographic APIs that ensure not only the confidentiality of your data, but also detect tampering. These high-level, easy-to-use APIs are designed to be hard to attack by default in ways primitives exposed by libraries like OpenSSL are not.
This approach makes NaCl a lot closer to a system like GPG than it is to the cryptographic primitive APIs in a library like OpenSSL. In addition, NaCl also uses state-of-the-art encryption, including Curve25519 elliptic curves and the XSalsa20 stream cipher. This means with NaCl you not only get a system which is designed to be secure-by-default, you also get one which is extremely fast with comparatively small cryptographic keys.
You can use RbNaCl on platforms libsodium is supported (see below).
This library aims to support and is tested against the following Ruby versions:
If something doesn't work on one of these versions, it's a bug.
Note: Windows installation instructions are available.
To use RbNaCl, you will need to install libsodium:
https://github.com/jedisct1/libsodium
At least version 1.0.0 is required.
For OS X users, libsodium is available via homebrew and can be installed with:
brew install libsodium
For FreeBSD users, libsodium is available both via pkgng and ports. To install a binary package:
pkg install libsodium
To install from ports on FreeBSD, use your favorite ports front end (e.g. portmaster or portupgrade), or use make as follows:
cd /usr/ports/security/libsodium; make install clean
Once you have libsodium installed, add this line to your application's Gemfile:
gem 'rbnacl'
And then execute:
$ bundle
Or install it yourself as:
$ gem install rbnacl
Inside of your Ruby program do:
require 'rbnacl'
...to pull it in as a dependency.
RbNaCl's documentation can be found in the Wiki. The following features are supported:
Additional power-user features are available. Please see the Wiki for further information.
YARD API documentation is also available.
While NaCl has designed to be easier-than-usual to use for a crypto library, cryptography is an incredibly difficult subject and it's always helpful to know as much as you can about it before applying it to a particular use case. That said, the creator of NaCl, Dan Bernstein, has published a number of papers about NaCl. If you are interested in learning more about how NaCl works, it's recommended that you read them:
For more information on libsodium, please check out the Introducing Sodium blog post
Have a general interest in cryptography? Check out the free course Coursera offers from Stanford University Professor Dan Boneh:
Only if your military understands twisted Edwards curves
No, that means 3DES, which this library doesn't support, sorry
Sure, here you go:
Copyright (c) 2012-2018 Tony Arcieri, Jonathan Stott. Distributed under the MIT License. See LICENSE.txt for further details.
FAQs
Unknown package
We found that rbnacl demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.
Security News
Research
Socket researchers found a malicious Maven package impersonating the legitimate ‘XZ for Java’ library, introducing a backdoor for remote code execution.