Encryption-Decryption in Rails

Question

Hi All,

I am using require 'digest/sha1' to encrypt my password and save into database. During login I authenticate by matching the encrypted password saved in database and again encrypted the one use enter in password field. As of now everything works fine but now I want to do 'Forgot Password' functionality. To do this I need to decrypt the password which is saved in database to find original one. How to decrypt using digest/sha1? Or does anyone know any algorithm which supports encryption & decryption as well?

I am using ruby on rails so I need Ruby way to accomplish it.

Answer 1

don't encrypt a password. instead, stored the hash of a password (better with a salt).

to forget a password usually means (re-)authentication via another channel, say, an email notification of password reset.

watch http://railscasts.com/episodes/209-introducing-devise if you need something already pre-built.

edit: if you really need encryption, google "openssl ruby"

there is never a simple solution for secure work. how good your implementation is determined by the weakness link.

so, my recommendation is, don't count on a short answer on SO ;-)

Answer 2

SHA1 is a one way function you can't reverse it.

This may be of interest re password resets: http://www.binarylogic.com/2008/11/16/tutorial-reset-passwords-with-authlogic/

If you want to do encryption/decryption then you should use something like AES. Once you start using encryption/decryption, however, you'll also have to start worrying about key management too.

Regarding your comment to the OP below - if you are going to to be storing CC info, I would advise you get a security person in who knows about crypto, key management etc and who also understands the relevant legal and regulatory aspects.

Answer 3

Look at the ezcrypto gem: http://ezcrypto.rubyforge.org/

There's also the crypt gem, look at Blowfish : http://crypt.rubyforge.org

Answer 4

As Horace Ho explained, you should never encrypt a password but always store a crypted salt.

However, it's perfectly fine to crypt other kind of data, such as confidential information. Encryptor it's a simple but powerful wrapper for OpenSSL. It provides the ability to encrypt/decrypt attributes in any class.