
Security News
Follow-up and Clarification on Recent Malicious Ruby Gems Campaign
A clarification on our recent research investigating 60 malicious Ruby gems.
Ruby binding for C implementation of twofish from @drewcsillag
Add this line to your application's Gemfile:
gem "zweifische"
or
gem "zweifsiche", git: "https://github.com/fudanchii/zweifische"
And then execute:
$ bundle
All key length (256, 192, and 128 bit) is supported. Each respective class can be used directly.
Zweifische::Cipher128ecb
Zweifische::Cipher192ecb
Zweifische::Cipher256ecb
Zweifische::Cipher128cbc
Zweifische::Cipher192cbc
Zweifische::Cipher256cbc
to use:
require "zweifische"
# ecb mode
# for 128 bit key (16 bytes)
key="0123456789123456"
tf = Zweifische::Cipher128ecb.new(key)
crypted_text = tf.encrypt("plain text to encrypt here", pad: Zweifische::ZeroPadding)
plain_text = tf.decrypt(crypted_text, pad: Zweifische::ZeroPadding)
to encrypt stream use encrypt_update
for each chunks, then encrypt_final
at the end of the stream.
Notice that padding is specified explicitly above, by default encryption and decryption wont expect any padding in exchange of user should explicitly set the data length to be encrypted/decrypted to be a multiple of 16 bytes.
So for example, this will raise RuntimeError:
key="0123456789123456"
tf = Zweifische::Cipher128ecb.new(key)
crypted_text = tf.encrypt("plain text to encrypt here")
Available padding scheme:
Zweifische::AnsiX923Padding
Zweifische::ISOIEC78164Padding
Zweifische::PKC7Padding
Zweifische::ZeroPadding
Just be aware that padding is not bullet-proof, for example using zero bytes padding for data which may contain zero bytes trailer may cause all the trailer to be removed at decryption.
Bug reports and pull requests are welcome on GitHub at https://github.com/fudanchii/zweifische.
FAQs
Unknown package
We found that zweifische demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
A clarification on our recent research investigating 60 malicious Ruby gems.
Security News
ESLint now supports parallel linting with a new --concurrency flag, delivering major speed gains and closing a 10-year-old feature request.
Research
/Security News
A malicious Go module posing as an SSH brute forcer exfiltrates stolen credentials to a Telegram bot controlled by a Russian-speaking threat actor.