module Bezel::Keys
Keys derived from the application's SECRET_KEY_BASE, one per purpose (the session cookie's, the tokens'): PBKDF2-SHA256 of the secret with the purpose as the salt. Derived once per secret and purpose, then kept for the process.
k = Bezel::Keys.derive("s" * 64, "bezel session")
k.size # => 32
k == Bezel::Keys.derive("s" * 64, "bezel session") # => true
k == Bezel::Keys.derive("s" * 64, "bezel token") # => false
Constants
ITERATIONS: Int
PBKDF2's iterations: the secret is random and long, so these only separate the purposes (as Rails' key generator).
CACHE: Atom[Hash[String, Bytes]]
The keys derived so far, by secret and purpose.
Class methods
def self.derive(secret: String, purpose: String) -> Bytes
A 32-byte key for purpose from secret; Bezel::ConfigError for
the placeholder of a task's configuration (Config::TASK_SECRET),
which is public: a task without SECRET_KEY_BASE signs nothing.
def self.same?(a: Bytes | String, b: Bytes | String) -> Bool
Whether a and b are equal, in a time that depends on their
lengths only (not on where they differ): for comparing secrets.