View Source Fernet (fernetex v0.5.0)

Generate or verify Fernet tokens based on https://github.com/fernet/spec

Example

Fernet generates an encrypted ciphertext from plaintext using the supplied 256-bit key:

iex> key = "lBrMpXneb47e_iY4RFA-HhF2vk2zeL4smfijX-y02-g="
iex> plaintext = "Hello, world!"
iex> {:ok, _iv, ciphertext} = Fernet.generate(plaintext, key: key)
iex> {:ok, ^plaintext} = Fernet.verify(ciphertext, key: key)
{:ok, "Hello, world!"}

A TTL can optionally be supplied during decryption to reject stale messages:

iex> key = "lBrMpXneb47e_iY4RFA-HhF2vk2zeL4smfijX-y02-g="
iex> plaintext = "Hello, world!"
iex> {:ok, _iv, ciphertext} = Fernet.generate(plaintext, key: key)
iex> Fernet.verify(ciphertext, key: key, ttl: 0)
{:error, "expired TTL"}

Summary

Functions

Generate a token for the given message using the key to encrypt it.

Generate a Fernet key made up of a 128-bit signing key and a 128-bit encryption key encoded using base64 with URL and filename safe alphabet.

Compares the two binaries in constant-time to avoid timing attacks. See: http://codahale.com/a-lesson-in-timing-attacks/

Verify a token using the given key and optionally validate TTL

Types

@type ciphertext() :: String.t()
@type generate_options() :: [{:key, key()}] | %{key: key()}
@type iv() :: binary()
@type key() :: String.t()
@type plaintext() :: String.t()
@type verify_options() ::
  [key: key(), ttl: integer(), enforce_ttl: boolean()]
  | %{key: key(), ttl: integer(), enforce_ttl: boolean()}

Functions

Link to this function

generate(message, options)

View Source
@spec generate(plaintext(), generate_options()) ::
  {:ok, iv(), ciphertext()} | {:error, String.t()}

Generate a token for the given message using the key to encrypt it.

Options

The accepted options are:

  • :key - key to use for encryptions (256 bits, defaults to the value
         of "key" in the fernetex app config)
Link to this function

generate!(message, options)

View Source
@spec generate!(plaintext(), generate_options()) :: {iv(), ciphertext()} | no_return()
@spec generate_key() :: key()

Generate a Fernet key made up of a 128-bit signing key and a 128-bit encryption key encoded using base64 with URL and filename safe alphabet.

Link to this function

secure_compare(left, right)

View Source
@spec secure_compare(binary(), binary()) :: boolean()

Compares the two binaries in constant-time to avoid timing attacks. See: http://codahale.com/a-lesson-in-timing-attacks/

Taken verbatim from Plug.Crypto implementation: https://github.com/elixir-plug/plug_crypto

@spec verify(ciphertext(), verify_options()) ::
  {:ok, plaintext()} | {:error, String.t()}

Verify a token using the given key and optionally validate TTL

Options

The accepted options are:

  • :key - key to use for encryptions (256 bits, defaults to
                 the value of "key" in the fernetex app config)
  • :ttl - If :enforce_ttl is true then this is the time in
                 seconds (defaults to 60 seconds)
  • :enforce_ttl - Should ttl be enforced (default to true)
@spec verify!(ciphertext(), verify_options()) :: plaintext() | no_return()