danpal/encryptor — comment on commit c1b7e39538cb841a809053a7936b610e92a4bde0
File: lib/encryptor.rb line 57
By danpal:

Thank, I need to think of a way of fixing this. It's going to break a lot of things, the reason :key was choosen is because I cloned this from:

https://github.com/shuber/encryptor

He was using :key to mean :pass, and worst not even using :iv or :salts.
Encryptor is used mostly in attr_encrypted:
https://github.com/shuber/attr_encrypted

In attr_encrypted you can't specify an :iv or a :salt so you will actually be doing:

else
cipher.pkcs5_keyivgen(options[:key])
end

Here :key is also treated as a password, and even worse not being interoperable it is actually pretty insecure to do cbc_mode without an iv or salt.

But I agree, I need to fix this to make things more explicit.