module

Logarithm::Encryption

Encryption utilities for securing sensitive data in the anomaly detection pipeline.

This module provides symmetric encryption using AES-256-CBC with PBKDF2 key derivation for protecting configuration secrets, model parameters, and audit logs. It ensures data confidentiality while maintaining compatibility with the system's distributed architecture.

Security Considerations

  • Uses AES-256-CBC for strong symmetric encryption
  • PBKDF2 key derivation with 1000 iterations for key strengthening
  • Random IV generation for each encryption operation
  • Base64 encoding for safe storage/transmission

Usage

key = "my-secret-key"
data = "sensitive configuration data"

encrypted = Logarithm::Encryption.encrypt(data, key)
decrypted = Logarithm::Encryption.decrypt(encrypted, key)

puts decrypted # => "sensitive configuration data"

Integration Points

Used by the Config module for encrypting sensitive configuration values and by the Audit module for securing log entries containing sensitive information.

Class methods

decrypt(encrypted_data : String, key : String) : String

Decrypts data encrypted with the encrypt method.

Extracts the IV from the beginning of the encrypted data and uses the same PBKDF2 key derivation process as encryption. Validates data integrity during decryption.

Parameters:

  • encrypted_data: Base64-encoded encrypted data from encrypt()
  • key: The same password/key used for encryption

Returns: The original plaintext string

Raises:

  • Base64::Error if the input is not valid Base64
  • OpenSSL::CipherError if decryption fails (wrong key, corrupted data)
Source
encrypt(data : String, key : String) : String

Encrypts data using AES-256-CBC symmetric encryption.

Generates a random initialization vector (IV) for each encryption operation to ensure semantic security. The key is derived using PBKDF2 with a fixed salt and 1000 iterations.

Parameters:

  • data: The plaintext string to encrypt
  • key: The password/key used for encryption (will be derived via PBKDF2)

Returns: Base64-encoded encrypted data containing IV + ciphertext

Raises: OpenSSL::CipherError if encryption fails

Source