Module: Lich::Common::GUI::PasswordCipher Private

Defined in:
documented/common/gui/password_cipher.rb

This module is part of a private API. You should avoid using this module if possible, as it may be removed or be changed in the future.

Defined Under Namespace

Classes: DecryptionError

Constant Summary collapse

CIPHER_ALGORITHM =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

AES cipher algorithm

'AES-256-CBC'
KEY_ITERATIONS =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

PBKDF2 iteration count for key derivation

10_000
KEY_LENGTH =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

Key length for AES-256 (32 bytes = 256 bits)

32

Class Method Summary collapse

Class Method Details

.decrypt(encrypted_password, mode:, account_name: nil, master_password: nil) ⇒ String

This method is part of a private API. You should avoid using this method if possible, as it may be removed or be changed in the future.

Decrypts an encrypted password using the specified mode and optional parameters.

Examples:

Decrypt a password in enhanced mode

decrypted_password = Lich::Common::GUI::PasswordCipher.decrypt(encrypted_password, mode: :enhanced, master_password: "my_master_password")

Parameters:

  • encrypted_password (String) —

    the Base64 encoded encrypted password to decrypt

  • mode (Symbol) —

    the encryption mode, either :standard or :enhanced

  • account_name (String, nil) (defaults to: nil) —

    the account name for standard mode (required if mode is :standard)

  • master_password (String, nil) (defaults to: nil) —

    the master password for enhanced mode (required if mode is :enhanced)

Returns:

  • (String) —

    the decrypted password

Raises:

  • ArgumentError if the parameters are invalid

  • DecryptionError if decryption fails



65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
 
# File 'documented/common/gui/password_cipher.rb', line 65

def self.decrypt(encrypted_password, mode:, account_name: nil, master_password: nil)
  validate_encryption_params(mode, , master_password)

  # Derive decryption key based on mode
  key = derive_key(mode, , master_password)

  # Decode from Base64
  encrypted_data = Base64.strict_decode64(encrypted_password)

  # Extract IV and ciphertext
  cipher = OpenSSL::Cipher.new(CIPHER_ALGORITHM)
  iv_length = cipher.iv_len
  iv = encrypted_data[0...iv_length]
  ciphertext = encrypted_data[iv_length..]

  # Initialize cipher for decryption
  cipher.decrypt
  cipher.key = key
  cipher.iv = iv

  # Decrypt password
  decrypted = cipher.update(ciphertext) + cipher.final
  decrypted.force_encoding('UTF-8')
rescue OpenSSL::Cipher::CipherError, ArgumentError => e
  raise DecryptionError, "Failed to decrypt password: #{e.message}"
end

.encrypt(password, mode:, account_name: nil, master_password: nil) ⇒ String

This method is part of a private API. You should avoid using this method if possible, as it may be removed or be changed in the future.

Encrypts a password using the specified mode and optional parameters.

Examples:

Encrypt a password in standard mode

encrypted_password = Lich::Common::GUI::PasswordCipher.encrypt("my_password", mode: :standard, account_name: "my_account")

Parameters:

  • password (String) —

    the password to encrypt

  • mode (Symbol) —

    the encryption mode, either :standard or :enhanced

  • account_name (String, nil) (defaults to: nil) —

    the account name for standard mode (required if mode is :standard)

  • master_password (String, nil) (defaults to: nil) —

    the master password for enhanced mode (required if mode is :enhanced)

Returns:

  • (String) —

    the Base64 encoded encrypted password

Raises:

  • ArgumentError if the parameters are invalid



33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
 
# File 'documented/common/gui/password_cipher.rb', line 33

def self.encrypt(password, mode:, account_name: nil, master_password: nil)
  validate_encryption_params(mode, , master_password)

  # Derive encryption key based on mode
  key = derive_key(mode, , master_password)

  # Initialize cipher
  cipher = OpenSSL::Cipher.new(CIPHER_ALGORITHM)
  cipher.encrypt
  cipher.key = key

  # Generate random IV
  iv = cipher.random_iv

  # Encrypt password
  encrypted = cipher.update(password) + cipher.final

  # Combine IV + encrypted data and encode as Base64
  Base64.strict_encode64(iv + encrypted)
end