RD_Themis v.0.1
Redis module for Themis
This module provides a simple and secure way to store data in Redis via encrypting/decrypting with various Themis primitives.
It is Apache 2.0 licensed, so you may use it quite freely.
Quick start guide
-
Prepare dependencies:
- You might want to install Redis server with support for modules to actually use Rd_Themis module.
- Rd_Themis needs Themis crypto library, included as submodule in
/src/
, builds itself during make. - Themis needs libcrypto.so to run, libssl-dev package to build Themis.
-
Build the rd_themis module:
git clone --recursive https://github.com/cossacklabs/rd_themis cd rd_themis make
-
To load the module, start Redis with the
--loadmodule /path/to/module.so
option, add it as a directive to the configuration file or send aMODULE LOAD
command.
Features
Symmetric container, cget/cset: Encrypts data with Secure Cell symmetric container with context awareness, authenticity and other features.
Asymmetric container, msget/msset: One-way asymmetric container that was born during Acra's development and will emerge in next versions of Themis, which allows any piece of code to:
- Encrypt payload with a random symmetric key.
- Store this key in an asymmetric envelope sent from a random keypair to the desired keypair.
- Stack the encrypted payload and asymmetric envelope together with format control. It enables you to bind secrecy and authenticity to one private key while preserving speed benefits of symmetric cryptography over the main payload.
Commands
rd_themis.cset key password data
Works like the standard Redis SET
command, but stores the encrypted data (encrypted with Themis Secure Cell in Seal Mode) instead of the plaintext data.
rd_themis.cget key password
Decrypts and returns the stored data.
rd_themis.msset key public_key data
Works like the standard Redis SET
command, but stores the encrypted data (encrypted with Themis Secure Cell with random key, wrapped in Themis Secure Message with random sender key and fixed decryption key) instead of the clear data.
rd_themis.msget key private_key
Decrypts and returns the stored data.
RedisModule_BlockClient
API
Alternative commands for using rd_themis.csetbl key password data
Works like the standard Redis SET
command, but stores the encrypted data (encrypted with Themis Secure Cell in Seal Mode) instead of the plaintext data.
rd_themis.cgetbl key password
Decrypts and returns the stored data.
rd_themis.mssetbl key public_key data
Works like the standard Redis SET
command, but stores the encrypted data (encrypted with Themis Secure Cell with random key, wrapped in Themis Secure Message with random sender key and fixed decryption key) instead of the clear data.
rd_themis.msgetbl key private_key
Decrypts and returns the stored data.
Examples and use-cases
In /examples/
we put two simple examples of using Rd_Themis in Python and Ruby. They require corresponding Themis wrappers (Python package, Ruby Gem) to run.
Rd_Themis is especially beneficial within apps that use Themis for many things. For example, you may encrypt something in your Python application, store it in Redis via regular SET
command, then fetch the same blob of data from JS code in an environment that doesn't have Themis port, and then use rd_themis.cget
to decrypt the blob.