Skip to content

Commit e379cc0

Browse files
authored
[DOC] remove top-level example for OpenSSL::Cipher#pkcs5_keyivgen (#647)
OpenSSL::Cipher#pkcs5_keyivgen should only be used when it is absolutely necessary for compatibility with ancient applications. Having an example can be misleading. We already have another example for OpenSSL::Cipher in which PBKDF2 is used to derive a key. As described in the rdoc of OpenSSL::Cipher#pkcs5_keyivgen, it is compatible with PKCS#5 PBES1 (PKCS#5 v1.5) only when used in combination of a hash function MD2, MD5, or SHA-1, and a cipher DES-CBC or RC2-CBC. This example uses MD5 as the hash function and combines it with AES. This is considered insecure and also using a non-standard technique to derive longer keys.
1 parent 3f29525 commit e379cc0

File tree

1 file changed

+0
-39
lines changed

1 file changed

+0
-39
lines changed

ext/openssl/ossl.c

Lines changed: 0 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -827,45 +827,6 @@ ossl_crypto_fixed_length_secure_compare(VALUE dummy, VALUE str1, VALUE str2)
827827
* decrypted = cipher.update encrypted
828828
* decrypted << cipher.final
829829
*
830-
* == PKCS #5 Password-based Encryption
831-
*
832-
* PKCS #5 is a password-based encryption standard documented at
833-
* RFC2898[http://www.ietf.org/rfc/rfc2898.txt]. It allows a short password or
834-
* passphrase to be used to create a secure encryption key. If possible, PBKDF2
835-
* as described above should be used if the circumstances allow it.
836-
*
837-
* PKCS #5 uses a Cipher, a pass phrase and a salt to generate an encryption
838-
* key.
839-
*
840-
* pass_phrase = 'my secure pass phrase goes here'
841-
* salt = '8 octets'
842-
*
843-
* === Encryption
844-
*
845-
* First set up the cipher for encryption
846-
*
847-
* encryptor = OpenSSL::Cipher.new 'aes-256-cbc'
848-
* encryptor.encrypt
849-
* encryptor.pkcs5_keyivgen pass_phrase, salt
850-
*
851-
* Then pass the data you want to encrypt through
852-
*
853-
* encrypted = encryptor.update 'top secret document'
854-
* encrypted << encryptor.final
855-
*
856-
* === Decryption
857-
*
858-
* Use a new Cipher instance set up for decryption
859-
*
860-
* decryptor = OpenSSL::Cipher.new 'aes-256-cbc'
861-
* decryptor.decrypt
862-
* decryptor.pkcs5_keyivgen pass_phrase, salt
863-
*
864-
* Then pass the data you want to decrypt through
865-
*
866-
* plain = decryptor.update encrypted
867-
* plain << decryptor.final
868-
*
869830
* == X509 Certificates
870831
*
871832
* === Creating a Certificate

0 commit comments

Comments
 (0)