block-encrypt-authenticate

#!/usr/bin/env ruby
require 'openssl'
require 'base64'

message = ARGV[0]
cipher = OpenSSL::Cipher::AES128.new :CBC

cipher.encrypt
if ARGV[1]
  key = cipher.key = Base64.strict_decode64(ARGV[1])
else
  key = cipher.random_key
end
iv = cipher.random_iv

ciphertext = cipher.update(message) + cipher.final

hmac = OpenSSL::HMAC.new key, OpenSSL::Digest::SHA512.new
hmac << ciphertext

puts "Key: #{Base64.strict_encode64(key)}"
puts "IV: #{Base64.strict_encode64(iv)}"
puts "Ciphertext: #{Base64.strict_encode64(ciphertext)}"
puts "Tag: #{hmac.to_s}"