Cryptography Fundamentals

# hashing_demo.py
import hashlib

message = "Hello, Security World!"
data = message.encode("utf-8")

# MD5, broken, shown only for comparison
md5_hash = hashlib.md5(data).hexdigest()

# SHA-256, recommended standard
sha256_hash = hashlib.sha256(data).hexdigest()

# SHA-3-256, different family, equally secure
sha3_hash = hashlib.sha3_256(data).hexdigest()

# BLAKE2b, fast and secure
blake2_hash = hashlib.blake2b(data).hexdigest()

print(f"Input:    '{message}'")
print(f"MD5:      {md5_hash}  (32 chars), ⚠️  DO NOT USE")
print(f"SHA-256:  {sha256_hash}  (64 chars), ✅")
print(f"SHA3-256: {sha3_hash}  (64 chars), ✅")
print(f"BLAKE2b:  {blake2_hash[:64]}...  (128 chars), ✅")

# Hashing a file, stream it for large files
def hash_file(filepath: str) -> str:
    sha256 = hashlib.sha256()
    with open(filepath, "rb") as f:
        for chunk in iter(lambda: f.read(65536), b""):
            sha256.update(chunk)
    return sha256.hexdigest()

print("\nFile hash function defined, use hash_file('/path/to/file')")

# hmac_demo.py
import hmac
import hashlib
import secrets

# Generate a strong secret key
secret_key = secrets.token_bytes(32)   # 256-bit key

def sign_message(key: bytes, message: str) -> str:
    """Produce an HMAC-SHA256 signature."""
    return hmac.new(key, message.encode("utf-8"), hashlib.sha256).hexdigest()

def verify_message(key: bytes, message: str, signature: str) -> bool:
    """Verify an HMAC signature using constant-time comparison."""
    expected = sign_message(key, message)
    # hmac.compare_digest prevents timing attacks
    return hmac.compare_digest(expected, signature)

# Sign a payload
payload = '{"user_id": 42, "action": "transfer", "amount": 500}'
mac = sign_message(secret_key, payload)
print(f"Payload:   {payload}")
print(f"HMAC-SHA256: {mac}")

# Verify, untampered
is_valid = verify_message(secret_key, payload, mac)
print(f"\nVerification (original): {is_valid}")   # True

# Tampered payload, same MAC will fail
tampered = '{"user_id": 42, "action": "transfer", "amount": 9999}'
is_valid_tampered = verify_message(secret_key, tampered, mac)
print(f"Verification (tampered): {is_valid_tampered}")   # False

# fernet_demo.py
from cryptography.fernet import Fernet

# Generate and save a key (store securely, not in source code!)
key = Fernet.generate_key()
cipher = Fernet(key)

print(f"Key (base64): {key.decode()[:40]}...")

# Encrypt
plaintext = b"Top secret: database password is hunter2"
token = cipher.encrypt(plaintext)
print(f"\nPlaintext: {plaintext.decode()}")
print(f"Encrypted: {token.decode()[:60]}...")

# Decrypt
decrypted = cipher.decrypt(token)
print(f"Decrypted: {decrypted.decode()}")

# Tokens have a timestamp, they can expire
import time
from cryptography.fernet import InvalidToken

try:
    # time_to_live=1 means token is valid for 1 second only
    time.sleep(2)
    cipher.decrypt(token, ttl=1)
except InvalidToken:
    print("\nToken expired, use ttl= for time-limited secrets")

# rsa_demo.py
from cryptography.hazmat.primitives.asymmetric import rsa, padding
from cryptography.hazmat.primitives import hashes, serialization

# ── 1. Generate RSA key pair ──────────────────────────────────
private_key = rsa.generate_private_key(
    public_exponent=65537,
    key_size=2048,          # Minimum recommended; use 4096 for high-security
)
public_key = private_key.public_key()

print("RSA key pair generated (2048-bit)")
print(f"Public key type: {type(public_key).__name__}")

# ── 2. Encrypt with public key ────────────────────────────────
message = b"Confidential: API_KEY=sk-live-abc123xyz"
ciphertext = public_key.encrypt(
    message,
    padding.OAEP(
        mgf=padding.MGF1(algorithm=hashes.SHA256()),
        algorithm=hashes.SHA256(),
        label=None,
    )
)
print(f"\nEncrypted ({len(ciphertext)} bytes): {ciphertext.hex()[:40]}...")

# ── 3. Decrypt with private key ───────────────────────────────
decrypted = private_key.decrypt(
    ciphertext,
    padding.OAEP(
        mgf=padding.MGF1(algorithm=hashes.SHA256()),
        algorithm=hashes.SHA256(),
        label=None,
    )
)
print(f"Decrypted: {decrypted.decode()}")

# ── 4. Sign a message with private key ───────────────────────
document = b"Transfer $1000 to account 9876"
signature = private_key.sign(
    document,
    padding.PSS(
        mgf=padding.MGF1(hashes.SHA256()),
        salt_length=padding.PSS.MAX_LENGTH,
    ),
    hashes.SHA256(),
)
print(f"\nSignature ({len(signature)} bytes): {signature.hex()[:40]}...")

# ── 5. Verify signature with public key ──────────────────────
from cryptography.exceptions import InvalidSignature

try:
    public_key.verify(
        signature,
        document,
        padding.PSS(
            mgf=padding.MGF1(hashes.SHA256()),
            salt_length=padding.PSS.MAX_LENGTH,
        ),
        hashes.SHA256(),
    )
    print("Signature VALID ✅")
except InvalidSignature:
    print("Signature INVALID ❌")

# Verify with tampered document
try:
    public_key.verify(
        signature,
        b"Transfer $9999 to account 9876",   # tampered!
        padding.PSS(mgf=padding.MGF1(hashes.SHA256()), salt_length=padding.PSS.MAX_LENGTH),
        hashes.SHA256(),
    )
except InvalidSignature:
    print("Tampered document signature INVALID ❌ (correct behavior)")