Add AEAD encryption by jcmfernandes · Pull Request #23 · rack/rack-session · GitHub
Skip to content

Add AEAD encryption - #23

Merged
ioquatix merged 11 commits into
rack:mainfrom
jcmfernandes:aead
Jun 9, 2023
Merged

ioquatix merged 11 commits into
rack:mainfrom
jcmfernandes:aead

Conversation

@jcmfernandes

@jcmfernandes jcmfernandes commented Apr 9, 2023 •

Copy link
Copy Markdown
Contributor

As explained in #22, I know I'm not the first bringing this up, but almost 6 years have passed since that thread was created, and, IMHO, the landscape has changed enough to consider once again adding AEAD encryption to rack-session.

Here's a benchmark I wrote:

#!/usr/bin/env ruby

require 'benchmark/ips'
require 'securerandom'

require_relative '../lib/rack/session'
require_relative '../lib/rack/session/encryptor'

DATA = SecureRandom.alphanumeric(4 * 2**10).slice!(0, 4096)

SECRET = SecureRandom.random_bytes(64)
CONFIG = {}

ENCRYPTOR_V1 = Rack::Session::Encryptor::V1.new(SECRET, CONFIG)
ENCRYPTOR_V2 = Rack::Session::Encryptor::V2.new(SECRET, CONFIG)

Benchmark.ips do |x|
  x.report('v1 encrypt') do
    ENCRYPTOR_V1.encrypt(DATA)
  end

  x.report('v2 encrypt') do
    ENCRYPTOR_V2.encrypt(DATA)
  end

  x.compare!
end

ENCRYPTED_DATA_V1 = ENCRYPTOR_V1.encrypt(DATA)
ENCRYPTED_DATA_V2 = ENCRYPTOR_V2.encrypt(DATA)

Benchmark.ips do |x|
  x.report('v1 decrypt') do
    ENCRYPTOR_V1.decrypt(ENCRYPTED_DATA_V1)
  end

  x.report('v2 decrypt') do
    ENCRYPTOR_V2.decrypt(ENCRYPTED_DATA_V2)
  end

  x.compare!
end

TARGET = -1
ENCRYPTED_DATA_V1[TARGET] = "\0"
ENCRYPTED_DATA_V2[TARGET] = "\0"

Benchmark.ips do |x|
  x.report('v1 decrypt tampered') do
    ENCRYPTOR_V1.decrypt(ENCRYPTED_DATA_V1)
  rescue Rack::Session::Encryptor::Error
    nil
  else
    raise "Shouldn't be here!"
  end

  x.report('v2 decrypt tampered') do
    ENCRYPTOR_V2.decrypt(ENCRYPTED_DATA_V2)
  rescue Rack::Session::Encryptor::Error
    nil
  else
    raise "Shouldn't be here!"
  end

  x.compare!
end

and got these results:

Warming up --------------------------------------
          v1 encrypt     2.991k i/100ms
          v2 encrypt     3.756k i/100ms
Calculating -------------------------------------
          v1 encrypt     29.661k (± 1.6%) i/s -    149.550k in   5.043342s
          v2 encrypt     37.928k (± 1.7%) i/s -    191.556k in   5.052004s

Comparison:
          v2 encrypt:    37927.9 i/s
          v1 encrypt:    29660.9 i/s - 1.28x  slower

Warming up --------------------------------------
          v1 decrypt     2.999k i/100ms
          v2 decrypt     4.857k i/100ms
Calculating -------------------------------------
          v1 decrypt     31.843k (± 0.9%) i/s -    161.946k in   5.086207s
          v2 decrypt     50.303k (± 3.1%) i/s -    252.564k in   5.025839s

Comparison:
          v2 decrypt:    50302.8 i/s
          v1 decrypt:    31842.9 i/s - 1.58x  slower

Warming up --------------------------------------
 v1 decrypt tampered    10.339k i/100ms
 v2 decrypt tampered    24.053k i/100ms
Calculating -------------------------------------
 v1 decrypt tampered    103.586k (± 0.6%) i/s -    527.289k in   5.090543s
 v2 decrypt tampered    240.950k (± 0.4%) i/s -      1.227M in   5.091206s

Comparison:
 v2 decrypt tampered:   240949.6 i/s
 v1 decrypt tampered:   103585.8 i/s - 2.33x  slower

@jcmfernandes

Copy link
Copy Markdown
Contributor Author

@ioquatix

Copy link
Copy Markdown
Member

It would help a lot to split out cosmetic changes into separate PRs. i.e. the missing file, syntax/formatting changes, etc.

@dentarg

dentarg commented Jan 17, 2024

Copy link
Copy Markdown
Contributor

Unfortunately this PR brought jruby/jruby-openssl#290 for JRuby users

@jcmfernandes

Copy link
Copy Markdown
Contributor Author

ioquatix pushed a commit that referenced this pull request Jan 4, 2025
ioquatix pushed a commit that referenced this pull request May 6, 2025
ioquatix pushed a commit that referenced this pull request May 9, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants