module YamlRecrypt::Eyaml

Public Class Methods

decrypt(ct, eyaml_pub_key, eyaml_prv_key) click to toggle source
# File lib/yaml_recrypt/eyaml.rb, line 26
def self.decrypt(ct, eyaml_pub_key, eyaml_prv_key)
  private_key_pem = File.read eyaml_prv_key
  private_key_rsa = OpenSSL::PKey::RSA.new( private_key_pem )

  public_key_pem = File.read eyaml_pub_key
  public_key_x509 = OpenSSL::X509::Certificate.new( public_key_pem )

  pkcs7 = OpenSSL::PKCS7.new( ct )
  pkcs7.decrypt(private_key_rsa, public_key_x509)
end
encrypt(pt, eyaml_pub_key) click to toggle source
# File lib/yaml_recrypt/eyaml.rb, line 8
def self.encrypt(pt, eyaml_pub_key)
  public_key_pem = File.read eyaml_pub_key
  public_key_x509 = OpenSSL::X509::Certificate.new( public_key_pem )

  cipher = OpenSSL::Cipher::AES.new(256, :CBC)
  OpenSSL::PKCS7::encrypt([public_key_x509], pt, cipher, OpenSSL::PKCS7::BINARY).to_der
end
encrypt_and_encode(pt, eyaml_pub_key) click to toggle source
# File lib/yaml_recrypt/eyaml.rb, line 16
def self.encrypt_and_encode(pt, eyaml_pub_key)
  # eyaml has its own YAML encryption standard which we must cludge/copy ;-)
  # basically we wedge the cyphertext inside `ENC[...]` with some metadata
  # see /lib/hiera/backend/eyaml/parser/encrypted_tokens.rb (to_encrypted)
  ct = encrypt(pt, eyaml_pub_key)
  ct64 = Base64.encode64(ct).strip
  return "ENC[PKCS7,#{ct64}]"
end