Remove the old Python code.
I'm liking Rust, it's working.
This commit is contained in:
parent
d296f40eae
commit
9b66d1ee98
148
gongor/aegis.py
148
gongor/aegis.py
|
|
@ -1,148 +0,0 @@
|
|||
import argparse
|
||||
import os
|
||||
from pathlib import Path
|
||||
import subprocess
|
||||
|
||||
from cryptography import x509
|
||||
from cryptography.hazmat.primitives import hashes, serialization
|
||||
from cryptography.hazmat.primitives.ciphers import aead
|
||||
from cryptography.hazmat.primitives.serialization import pkcs12
|
||||
from cryptography.hazmat.primitives.asymmetric import ec, ed25519, padding
|
||||
|
||||
MAX_HUMAN_AGE = 365 * 200
|
||||
def box():
|
||||
"Take a message, put it in a box, encrypt the contents using a public key."
|
||||
parser = argparse.ArgumentParser()
|
||||
parser.add_argument("aegis_cert_pem", type=Path, help="The file for the PEM-encoded aegis public cert.")
|
||||
parser.add_argument("message", type=Path, help="The file containing the message to box.")
|
||||
parser.add_argument("output", type=Path, help="The path to the file where the output will go.")
|
||||
args = parser.parse_args()
|
||||
|
||||
with open(args.aegis_cert_pem, "rb") as f:
|
||||
certificate = x509.load_pem_x509_certificate(
|
||||
data=f.read(),
|
||||
)
|
||||
with open(args.message, "rb") as f:
|
||||
data = f.read()
|
||||
|
||||
shared_ecc_key, ciphered_public_key = _generate_encryption_key(certificate.public_key())
|
||||
aad = b"authenticated but unencrypted data"
|
||||
key = aead.ChaCha20Poly1305.generate_key()
|
||||
with open("encryption.key", "wb") as f:
|
||||
f.write(key)
|
||||
print("Wrote encryption key to 'encryption.key'")
|
||||
chacha = aead.ChaCha20Poly1305(key)
|
||||
nonce = os.urandom(12)
|
||||
with open("nonce", "wb") as f:
|
||||
f.write(nonce)
|
||||
print("Wrote nonce to 'nonce'")
|
||||
ct = chacha.encrypt(nonce, data, aad)
|
||||
with open(args.output, "wb") as f:
|
||||
f.write(ct)
|
||||
print(f"Wrote encrypted message to '{args.output}'")
|
||||
|
||||
|
||||
def ecc_calc_encryption_keys(pubKey):
|
||||
ciphertextPrivKey = secrets.randbelow(curve.field.n)
|
||||
ciphertextPubKey = ciphertextPrivKey * curve.g
|
||||
sharedECCKey = pubKey * ciphertextPrivKey
|
||||
return (sharedECCKey, ciphertextPubKey)
|
||||
|
||||
def ecc_calc_decryption_key(privKey, ciphertextPubKey):
|
||||
sharedECCKey = ciphertextPubKey * privKey
|
||||
return sharedECCKey
|
||||
|
||||
def generate():
|
||||
print("Please name this aegis. You can call it anything. Frequently people use their legal name.")
|
||||
name = input("Name? ")
|
||||
print("Generating aegis.")
|
||||
subprocess.run([
|
||||
"openssl", "req", # PKCS#10 certificate generation utility
|
||||
"-new", # Generate a new certificate
|
||||
"-newkey", "ec", # Generate a new private key using elliptic-curve (ECDSA or ECDH compatible)
|
||||
"-pkeyopt", "ec_paramgen_curve:prime256v1", # Use the prime256v1 CE curve from NIST (P-256)
|
||||
"-x509", # Create a self-signed certificate instead of a certificate request.
|
||||
"-days", str(MAX_HUMAN_AGE), # Set the validity period to the expected max age of a human
|
||||
"-subj", f"/CN={name}", # Add the common name for the persona tied to this aegis
|
||||
"-out", "cert.pem", # Generate a self-signed certificate file with a .pem extension
|
||||
"-keyout", "key.pem", # Generate an encrypted private key file with a .pem extension
|
||||
],
|
||||
check=True,)
|
||||
|
||||
def sign():
|
||||
"Sign some arbitrary data."
|
||||
parser = argparse.ArgumentParser()
|
||||
parser.add_argument("aegis_key_pem", type=Path, help="The file for the PEM-encoded aegis private key.")
|
||||
parser.add_argument("message", type=Path, help="The file containing the message to sign.")
|
||||
parser.add_argument("-p", "--password", help="The password to use to open the key file.")
|
||||
args = parser.parse_args()
|
||||
|
||||
with open(args.aegis_key_pem, "rb") as f:
|
||||
private_key = serialization.load_pem_private_key(
|
||||
data=f.read(),
|
||||
password=args.password.encode("UTF-8"),
|
||||
)
|
||||
with open(args.message, "rb") as f:
|
||||
data = f.read()
|
||||
signature = private_key.sign(
|
||||
data,
|
||||
ec.ECDSA(hashes.SHA256()),
|
||||
)
|
||||
with open("signature.bin", "wb") as f:
|
||||
f.write(signature)
|
||||
print("Wrote signature to signature.bin")
|
||||
|
||||
def validate():
|
||||
"Validate the signature of some arbitrary data."
|
||||
parser = argparse.ArgumentParser()
|
||||
parser.add_argument("aegis_cert_pem", type=Path, help="The file for the PEM-encoded aegis public certificate.")
|
||||
parser.add_argument("message", type=Path, help="The file containing the message to validate.")
|
||||
parser.add_argument("signature", type=Path, help="The file containing the signature to validate.")
|
||||
args = parser.parse_args()
|
||||
|
||||
with open(args.aegis_cert_pem, "rb") as f:
|
||||
certificate = x509.load_pem_x509_certificate(
|
||||
data=f.read(),
|
||||
)
|
||||
with open(args.message, "rb") as f:
|
||||
data = f.read()
|
||||
with open(args.signature, "rb") as f:
|
||||
signature = f.read()
|
||||
|
||||
key = certificate.public_key()
|
||||
key.verify(
|
||||
signature=signature,
|
||||
data=data,
|
||||
signature_algorithm=ec.ECDSA(hashes.SHA256()),
|
||||
)
|
||||
print("Signature is valid")
|
||||
|
||||
def unbox():
|
||||
"Take a message in a box, use a key, open the box, get the message."
|
||||
parser = argparse.ArgumentParser()
|
||||
parser.add_argument("aegis_key_pem", type=Path, help="The file for the PEM-encoded aegis key.")
|
||||
parser.add_argument("ciphertext", type=Path, help="The file containing the boxed ciphertext.")
|
||||
parser.add_argument("output", type=Path, help="The path to the file where the output will go.")
|
||||
parser.add_argument("-p", "--password", help="The password to use to open the key file.")
|
||||
args = parser.parse_args()
|
||||
|
||||
with open(args.aegis_key_pem, "rb") as f:
|
||||
private_key = serialization.load_pem_private_key(
|
||||
data=f.read(),
|
||||
password=args.password.encode("UTF-8"),
|
||||
)
|
||||
with open(args.ciphertext, "rb") as f:
|
||||
ciphertext = f.read()
|
||||
aad = b"authenticated but unencrypted data"
|
||||
|
||||
with open("encryption.key", "rb") as f:
|
||||
key = f.read()
|
||||
with open("nonce", "rb") as f:
|
||||
nonce = f.read()
|
||||
|
||||
chacha = aead.ChaCha20Poly1305(key)
|
||||
message = chacha.decrypt(nonce, ciphertext, aad)
|
||||
with open(args.output, "wb") as f:
|
||||
f.write(message)
|
||||
print(f"Wrote unboxed message to '{args.output}'")
|
||||
|
||||
|
|
@ -1,27 +0,0 @@
|
|||
import argparse
|
||||
from pathlib import Path
|
||||
|
||||
from cryptography import x509
|
||||
from cryptography.hazmat.primitives import serialization
|
||||
|
||||
def box_message():
|
||||
parser = argparse.ArgumentParser()
|
||||
parser.add_argument("recipient_certificate", type=Path, help="Path to the certificate of the recipient")
|
||||
parser.add_argument("sender_key", type=Path, help="Path to the private key of the sender")
|
||||
parser.add_argument("--sender-key-password", type="str", default=None, help="The password to the sender private key")
|
||||
parser.add_argument("message", type=Path, help="Path to the message to box")
|
||||
args = parser.parse_args()
|
||||
|
||||
recipient_cert = _load_certificate(args.recipient_certificate)
|
||||
sender_key = _load_key(args.sender_key)
|
||||
|
||||
|
||||
|
||||
|
||||
def _load_certificate(path: Path) -> x509.Certificate:
|
||||
with open(path, "rb") as f:
|
||||
return x509.load_pem_x509_certificate(f.read())
|
||||
|
||||
def _load_key(path: Path, password: str) -> EllipticCurvePrivateKey:
|
||||
with open(path, "rb") as f:
|
||||
return serialization.load_pem_private_key(f.read(), password)
|
||||
|
|
@ -1,21 +0,0 @@
|
|||
[project]
|
||||
name = "gongor"
|
||||
version = "0.1"
|
||||
description = "A system to manage Aegi"
|
||||
readme = "README.md"
|
||||
requires-python = ">=3.7"
|
||||
license = {file = "LICENSE.txt"}
|
||||
|
||||
[project.scripts]
|
||||
aegis-generate = "gongor.aegis:generate"
|
||||
aegis-sign = "gongor.aegis:sign"
|
||||
aegis-validate-signature = "gongor.aegis:validate"
|
||||
aegis-box = "gongor.aegis:box"
|
||||
aegis-unbox = "gongor.aegis:unbox"
|
||||
|
||||
[build-system]
|
||||
requires = ["setuptools >= 61.0.0"]
|
||||
build-backend = "setuptools.build_meta"
|
||||
|
||||
[tool.setuptools.packages.find]
|
||||
include = ["gongor"]
|
||||
Loading…
Reference in New Issue