We are actively seeking a new maintainer for this gem! As we no longer use MongoDB as part of our platform, we aren't using the gem for ourselves. As MongoDB and Mongoid continually change, we want to make sure our gem keeps up.

If you're interested, please contact us! Thanks

A library for storing encrypted data in Mongo using Mongoid. We looked at a few alternatives, but wanted something that stored the values securely and unobtrusively.

Mongoid 3 supports custom types that need to only provide a simple interface - allowing us to extend core Ruby types to secure any type while providing a clean interface for developers.

Queries encrypt data before searching the database, so equality matches work automatically.

• Mongoid 5+
• Rails 4+
• Ruby 2.0+
• "Bring your own" encryption, see below

Mongoid 3, Mongoid 4 and Rails 3.2 are supported in version 1.x of this gem.

```ruby
gem 'mongoid-encrypted-fields'
```

• Default encrypted fields use a global salt so the same value produces the same encrypted output. Queries work by first encrypting the search term, then searching for the encrypted value.
• Unsearchable encrypted fields use a unique salt each time a value is encrypted. Encrypting the same value multiple times will generate unique encrypted outputs each time. Queries on unsearchable encrypted fields are not possible.

• Configure the ciphers to be used for encrypting field values:

  GibberishCipher can be found in examples - uses the Gibberish gem:

  Mongoid::EncryptedFields.cipher = GibberishCipher.new(ENV['MY_PASSWORD'], ENV['MY_SALT'])
  Mongoid::EncryptedFields.unsearchable_cipher = GibberishCipher.new(ENV['MY_PASSWORD'])

• Use encrypted types for fields in your models:

  class Person
      include Mongoid::Document
  
      field :ssn, type: Mongoid::EncryptedString              #can search for Person with ssn
      field :name, type: Mongoid::UnsearchableEncryptedString #don't need to search based on name
  end

• The field getter returns the unencrypted value:

  person = Person.new(ssn: '123456789')
  person.ssn # => '123456789'

• The encrypted value is accessible with the "encrypted" attribute

  person.ssn.encrypted # => <encrypted string>
  
  # It can also be accessed using the hash syntax supported by Mongoid
  person[:ssn] # => <encrypted string>

• Finding a model by an encrypted field works automatically (equality only):

  Person.where(ssn: '123456789').count() # ssn is encrypted before querying the database
  Person.where(name: 'John Doe').count() # does not work!  uses a new salt each time the value is encrypted

• Currently can encrypt these Mongoid types
  • Date
  • DateTime
  • Hash
  • String
  • Time
• The uniqueness validator for encrypted fields should always be set to case-sensitive. Encrypted fields cannot support a case-insensitive match.
• Queries for unsearchable encrypted fields do not work.

• Storing Encrypted Data in MongoDB
• Transparently Adding Encrypted Fields to a Rails App using Mongoid

(c) 2012 Koan Health. See LICENSE.txt for further details.