class Epithet::Keygen

Key derivation helper

Constants

DEFAULT_SCRYPT_PARAMS

Default parameters for scrypt.

DEFAULT_SCRYPT_PARAMS = {
  provider: Epithet::Scrypt,
  salt: 'epithet-default',
  N: 1 << 17,
  r: 8,
  p: 1,
  length: 32
}.freeze

Public Class Methods

new (ikm: nil, passphrase: nil, digest: 'sha256', scrypt: {})

Source

# File lib/epithet/keygen.rb, line 45
def initialize(ikm: nil, passphrase: nil, digest: 'sha256', scrypt: {})
  raise ArgumentError, 'keygen requires either ikm or passphrase' unless passphrase.nil? ^ ikm.nil?

  @ikm = (ikm&.b || build_scrypt(Hash(scrypt)).ikm(passphrase)).freeze
  @digest = -String(digest)
  freeze
end

Create a new key generator from a supplied passphrase, or from high-entropy initial key material if already prepared. The passphrase will be hashed with scrypt. Supplied scrypt params, if any, are merged over DEFAULT_SCRYPT_PARAMS, so this works:

Epithet::Keygen.new(
  passphrase: ENV.fetch('EPITHET_PASSPHRASE'),
  scrypt: { salt: "#{MyApp.name}/#{MyApp.env}" }
)

A scrypt provider will be chosen by Epithet::Scrypt. To override automatic selection and use a specific scrypt provider class, pass it as provider in the scrypt parameters:

kg = Epithet::Keygen.new(passphrase: 'pw', scrypt: { provider: Epithet::Scrypt::OpenSSL })

but this should be unnecessary in the common case.

Public Instance Methods

generate (info, salt, length)

Source

# File lib/epithet/keygen.rb, line 58
def generate(info, salt, length)
  OpenSSL::KDF.hkdf(@ikm, hash: @digest, info:, salt:, length:)
end

Derive a key via HKDF.

inspect ()

Source

# File lib/epithet/keygen.rb, line 53
def inspect
  "#<#{self.class}:#{'%#016x' % (object_id << 1)} digest=#{@digest}>"
end