# Validating with Encryption **URL:** \ **Category:** Rails\ **Created:** [May 25, 2010, 8:47pm UTC](https://www.ruby-forum.com/t/validating-with-encryption/189164 "2010-05-25T20:47:01Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![tashfeen.ekram](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/3ab097/32.png) [@tashfeen.ekram](https://www.ruby-forum.com/u/tashfeen.ekram)\ **Post date:** [May 25, 2010, 8:47pm UTC](https://www.ruby-forum.com/t/validating-with-encryption/189164/1 "2010-05-25T20:47:01Z")
I am encrypting data mainly email addresses. I would like to use the validations built into rails however I am not sure how to do that given that the actual data stored in the database is an encrypted version. i would like to run the validation on the decrypted version of the data. Thanks. ---
**Author:** ![tashfeen.ekram](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/3ab097/32.png) [@tashfeen.ekram](https://www.ruby-forum.com/u/tashfeen.ekram)\ **Post date:** [May 25, 2010, 8:59pm UTC](https://www.ruby-forum.com/t/validating-with-encryption/189164/2 "2010-05-25T20:59:51Z")
tashfeen.ekram wrote: > I am encrypting data mainly email addresses. I would like to use the > validations built into rails however I am not sure how to do that > given that the actual data stored in the database is an encrypted > version. i would like to run the validation on the decrypted version > of the data. Okay, so perform your encryption after validation not before. [http://railsapi.com/doc/rails-v2.3.5/classes/ActiveRecord/Callbacks.html#M001182](http://railsapi.com/doc/rails-v2.3.5/classes/ActiveRecord/Callbacks.html#M001182) ---
**Author:** ![tashfeen.ekram](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/3ab097/32.png) [@tashfeen.ekram](https://www.ruby-forum.com/u/tashfeen.ekram)\ **Post date:** [May 25, 2010, 9:47pm UTC](https://www.ruby-forum.com/t/validating-with-encryption/189164/3 "2010-05-25T21:47:54Z")
hmmm… ok. i was using strongbox gem. what you recommends seems like it would work if i wrote my own encryption. i think the encryption in the gem is carried out prior to validation. is there another way in which i can still use strongbox? ---
**Author:** ![tashfeen.ekram](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/3ab097/32.png) [@tashfeen.ekram](https://www.ruby-forum.com/u/tashfeen.ekram)\ **Post date:** [May 27, 2010, 12:41am UTC](https://www.ruby-forum.com/t/validating-with-encryption/189164/4 "2010-05-27T00:41:47Z")
Is there a way to use validation however you can pass a function (or a string) to validate on and not the actual value stored in the db? ---
**Author:** ![tashfeen.ekram](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/3ab097/32.png) [@tashfeen.ekram](https://www.ruby-forum.com/u/tashfeen.ekram)\ **Post date:** [May 27, 2010, 3:09am UTC](https://www.ruby-forum.com/t/validating-with-encryption/189164/5 "2010-05-27T03:09:44Z")
tashfeen.ekram wrote: > Is there a way to use validation however you can pass a function (or a > string) to validate on and not the actual value stored in the db? What would be the point of that? If you don’t want to validate your actual data, then don’t. ## Best, Marnen Laibow-Koser [http://www.marnen.org](http://www.marnen.org) removed\_email\_address@domain.invalid ---
**Author:** ![tashfeen.ekram](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/3ab097/32.png) [@tashfeen.ekram](https://www.ruby-forum.com/u/tashfeen.ekram)\ **Post date:** [May 27, 2010, 9:22pm UTC](https://www.ruby-forum.com/t/validating-with-encryption/189164/6 "2010-05-27T21:22:47Z")
tashfeen.ekram wrote: > hmmm… ok. i was using strongbox gem. what you recommends seems like > it would work if i wrote my own encryption. i think the encryption in > the gem is carried out prior to validation. is there another way in > which i can still use strongbox? I’ve not looked at the strongbox gem, but if that’s the case I would avoid using that gem. If you’re going to have a gem do your encrypting/decrypting it should be transparent to the application layer IMHO. This would mean hooking itself in right above the database adaptor layer so that all the higher level ActiveRecord/ActiveModel stuff just works as normal. Maybe you should find a better gem, or roll your own. Encryption isn’t exactly rocket science to implement these days (maybe their implementations are akin to rocket science, but modern abstractions aren’t). ---
**Author:** ![tashfeen.ekram](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/3ab097/32.png) [@tashfeen.ekram](https://www.ruby-forum.com/u/tashfeen.ekram)\ **Post date:** [May 27, 2010, 10:26pm UTC](https://www.ruby-forum.com/t/validating-with-encryption/189164/7 "2010-05-27T22:26:44Z")
hmmm. what you mention does make sense. perhaps i will roll my own. however, i would like to completely understand. so, ideally the encryption should work such that all of the active record attributes work as expected. when retrieving an attribute you would get the expected object. i dont have any experience to do such a thing. any references of of other gems doing anything remotely similar to this? ---
**Author:** ![tashfeen.ekram](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/3ab097/32.png) [@tashfeen.ekram](https://www.ruby-forum.com/u/tashfeen.ekram)\ **Post date:** [May 27, 2010, 11:00pm UTC](https://www.ruby-forum.com/t/validating-with-encryption/189164/8 "2010-05-27T23:00:55Z")
tashfeen.ekram wrote: > hmmm. what you mention does make sense. perhaps i will roll my own. > > however, i would like to completely understand. so, ideally the > encryption should work such that all of the active record attributes > work as expected. when retrieving an attribute you would get the > expected object. > > i dont have any experience to do such a thing. any references of of > other gems doing anything remotely similar to this? I don’t know of any specific gems. I was just thinking conceptually as follows: 1. User enters, obviously, clear text into a form field. 2. User submits form over SSL to ensure encrypted transmission. 3. Rails stack processes data into the params hash. 4. Controller sends “save” message to ActiveRecord instance. 5. ActiveRecord/ActiveModel callback chain (e.g. before\_validation, after\_validation, before\_save, after\_save, etc.) all occur as normal. 6. Either inside or after validation, but before save, encryption occurs. One possibility would be for a gem to add a couple of new callback hooks to the chain. Maybe something like before\_encryption and after\_encryption. But, that’s probably not even necessary in this case. If I were to implement something like this I would probably call my encryption routine from within after\_validation. This should occur before the data actually gets saved to the database. If some problems occur during encryption then after\_validation should return false having the effect of canceling the save. At that point “save” should also return false and you’re controller should handle that in the normal way. You would also need some way to decrypt the data after a “find” operation. I don’t think that Rails has any built-in hooks for this, but I could be wrong about that. I used to use a ORM called Enterprise Objects (EOF) that supported such a mechanism though use of the delegate pattern. There was a delegate method “awakeFromFetch()” that EOEnterpriseObject subclasses could override to perform initialization after fetch. This provided a nice place to “hook in” to perform these kinds of things. But, I can’t think of any such convenience in Rails, but that’s not a “show-stopper.” P.S. Out of curiosity I looked at the stongbox gem. From a quick glance I don’t think it would be something that would interest me. It uses public key technology, which I just don’t see the benefit of using given it huge trade-off in performance. I really think a symmetric key system would make a lot more sense for most cases. I could certainly be missing some important point, however.