module

Crypto::Secret

Interface to hold sensitive information (often cryptographic keys)

Only for direct use by cryptographic library authors

For all other applications use a preexisting class that includes Crypto::Secret

Which class should I use?

  • Crypto::Secret::Key - Use with small (<= 4096 bytes) keys
  • Crypto::Secret::Large - Use for decrypted data that may stress mlock limits
  • Crypto::Secret::Not - Only use when you're sure the data isn't secret. 0 overhead. No wiping.

Other shards may provide additional Secret types (sodium.cr)

Instance methods

==(other : Secret) : Bool

Timing safe memory compare

Source
==(other : Bytes) : Bool

Timing safe memory compare

Source
bytesize
Source
copy_from(data : Bytes) : Nil

Copies from data

Source
finalize
Source
hexstring

For debugging.

Returned String not tracked or wiped

Source
inspect(io : IO) : Nil

Hide internal state to prevent leaking in to logs

Source
move_from(data : Bytes) : Nil

Copies then wipes data

Prefer this method over #copy_from

Source
noaccess

Makes a region allocated inaccessible depending on implementation. It cannot be read or written, but the data are preserved.

Source
random

Fills Secret with secure random data

Source
readonly

Marks a region allocated using as read-only depending on implementation.

Source
readwrite

Marks a region allocated using as read & write depending on implementation.

Source
reset
Source
wipe

Zeroes data

Secret is unavailable (readonly/readwrite may fail) until reset

Source
wipe

Secret is wiped after exiting the block

Source

Macros

delegate_to_bytesize(to object)
Source
delegate_to_slice(to object)
Source

Nested types