From: Brian Candler <b.candler@...>
Date: 2010-05-02T17:58:51+09:00
Subject: Re: Encrypting/Decrypting files wirh ruby.

ruby's openssl library works fine, but it's quite low level, which means 
that if you don't understand much about cryptography it's easy to write 
an insecure application.

So if you're not an expert I'd suggest using gpg instead. Google "ruby 
gpg" and "ruby gpgme" and you'll find plenty of examples.

I'd say the main weakness of your application is likely to be the key 
storage. That is, if you keep your encryption keys in a file or in a 
database, then anyone who breaks into your box will be able to decrypt 
these encrypted files anyway, in which case the encryption is fairly 
pointless.

You could make your app prompt for the key when it starts up and keep it 
only in RAM. This can make it harder for an attacker to extract the key, 
but it can be awkward to deploy in a Rails app if you are dynamically 
starting worker processes.

Regards,

Brian.
-- 
Posted via http://www.ruby-forum.com/.