SwiftGUI_Encryption 0.0.3__tar.gz → 0.0.5__tar.gz

{swiftgui_encryption-0.0.3 → swiftgui_encryption-0.0.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: SwiftGUI_Encryption
-Version: 0.0.3
+Version: 0.0.5
 Summary: Useful encryption-features for SwiftGUI-applications based on PyCryptoDome
 License-Expression: Apache-2.0
 License-File: LICENSE

{swiftgui_encryption-0.0.3 → swiftgui_encryption-0.0.5}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "SwiftGUI_Encryption"
-version = "0.0.3"
+version = "0.0.5"
 packages = [
     { include = "SwiftGUI_Encryption", from = "src" }
 ]

{swiftgui_encryption-0.0.3 → swiftgui_encryption-0.0.5}/src/SwiftGUI_Encryption/Advanced/__init__.py

@@ -1,3 +1,3 @@
 
-from .low_level import encrypt, decrypt, readable_hash, make_hash, random_key, argon2_key_derivation
+from .low_level import encrypt, decrypt, readable_hash, make_hash, random_key, argon2_key_derivation, encrypt_CTR, decrypt_CTR
 

{swiftgui_encryption-0.0.3 → swiftgui_encryption-0.0.5}/src/SwiftGUI_Encryption/Advanced/low_level.py

@@ -45,6 +45,35 @@ def argon2_key_derivation(derive_from: bytes, salt: bytes, multiplier: int = 1,
 
     return argon2pure.argon2(derive_from, salt, multiplier, 8 * multiplier, parallelism=1, tag_length=n)
 
+def encrypt_CTR(data: bytes, key: bytes, nonce: bytes) -> bytes:
+    """
+    Encrypt some data in AES-256-CTR mode.
+
+    :param data:
+    :param key:
+    :param nonce: A 12-byte random number, which you should definetly remember
+    :return: Encrypted
+    """
+    crypter = AES.new(key, AES.MODE_CTR, nonce=nonce)
+    enc_data = crypter.encrypt(data)
+
+    return enc_data
+
+def decrypt_CTR(enc_data:bytes, key:bytes, nonce:bytes) -> bytes:
+    """
+    Decrypt some data in AES-256-CTR mode.
+    The decrypted data is not verified, since this isn't a feature of AES-CTR
+
+    :param enc_data: Encrypted data
+    :param key: This needs to be the same as with the encryption
+    :param nonce: This needs to be the same as with the encryption
+    :return:
+    """
+    crypter = AES.new(key, AES.MODE_CTR, nonce=nonce)
+    data = crypter.decrypt(enc_data)
+
+    return data
+
 def encrypt(data: bytes, key: bytes, nonce: bytes, mac_len: int = 8) -> bytes:
     """
     Encrypt some data.

{swiftgui_encryption-0.0.3 → swiftgui_encryption-0.0.5}/src/SwiftGUI_Encryption/__init__.py

@@ -2,7 +2,7 @@
 from . import Advanced
 random_key = Advanced.random_key
 
-from .basics import decrypt_full, encrypt_full, encrypt_with_password, decrypt_with_password, password_to_key
+from .basics import decrypt_full, encrypt_full, encrypt_with_password, decrypt_with_password, password_to_key, encrypt_multilayer, decrypt_multilayer
 from .key_files import KeyFile, KeyHandler, BaseKeyFile
 
 try:

{swiftgui_encryption-0.0.3 → swiftgui_encryption-0.0.5}/src/SwiftGUI_Encryption/basics.py

@@ -1,8 +1,3 @@
-import argon2pure
-from Crypto.Cipher import AES
-import os
-import hashlib
-
 from SwiftGUI_Encryption import Advanced as adv
 
 # This should not be chanced, it just doesn't feel right to add magic numbers...
@@ -34,6 +29,62 @@ def decrypt_full(data: bytes, key: bytes) -> bytes:
 
     return adv.decrypt(data, key, nonce)
 
+def encrypt_multilayer(data: bytes, *keys: bytes) -> bytes:
+    """
+    Encrypt some data multiple times.
+    Pass a key for every layer of encryption.
+
+    This is overkill for most applications.
+    A single AES-256-GCM-encryption is already very secure, even against quantumcomputers.
+
+    VERY IMPORTANT:
+    To attack even a 3-layer-encryption is basically impossible.
+    So the attack will be on the keys, not the encryption.
+    Make sure the keys are secure, they are the weakest link.
+
+    Also, don't correlate the keys in any way.
+    If you can calculate key2 from key1, it defies the whole reason for this multilayer-encryption.
+
+    KINDA IMPORTANT:
+    Using two keys is only a little better than one key, because someone could do a "meet-in-the-middle-attack".
+    As a general rule, you should use an odd number of keys.
+
+    TECHNICALITIES:
+    Only the innermost encryption is using AES-GCM Mode. All other layers are AES-CTR.
+    That's because full AES-GCM allows guessing, if the decryption was successful.
+    Especially for short data, you could brute-force through layer by layer, leaving only a few possible keys per layer.
+
+    So, this function disables that verification-step for the outer layers.
+    You can only check if the full decryption was a success, but not separate layers.
+
+    :return:
+    """
+    # GCM encryption
+    data = encrypt_full(data, keys[0])
+
+    # CTR encryptions
+    for key in keys[1:]:
+        nonce = adv.random_key(12)
+        data = nonce + adv.encrypt_CTR(data, key, nonce)
+
+    return data
+
+def decrypt_multilayer(data: bytes, *keys: bytes) -> bytes:
+    """
+    Read the description of encrypt_multilayer.
+
+    The keys have to be in the same order as with the encryption.
+
+    :return:
+    """
+    # CTR encryptions
+    for key in keys[1:][::-1]:
+        nonce = data[:12]
+        data = adv.decrypt_CTR(data[12:], key, nonce)
+
+    # GCM encryption
+    return decrypt_full(data, keys[0])
+
 def encrypt_with_password(data: bytes, password: str, security_multiplier: int = 1) -> bytes:
     """
     IMPORTANT:

{swiftgui_encryption-0.0.3 → swiftgui_encryption-0.0.5}/src/SwiftGUI_Encryption/sg/dictFile.py

@@ -107,8 +107,10 @@ class PasswordJSONDictFile(EncryptedJSONDictFile):
             **kwargs
         )
 
-    def _regenerate_key(self):
-        self._salt = random_key(SALT_LEN)
+    def _regenerate_key(self, new_salt = True):
+        if new_salt:
+            self._salt = random_key(SALT_LEN)
+
         self._filekey = adv.argon2_key_derivation(self._password.encode(), self._salt)
 
     def change_key(self, new_key: bytes):
@@ -151,6 +153,11 @@ class PasswordJSONDictFile(EncryptedJSONDictFile):
     ) -> dict:
         raw = path.read_bytes()
 
+        salt = raw[:SALT_LEN]
+        if salt != self._salt:
+            self._salt = salt
+            self._regenerate_key(new_salt=False)
+
         raw = decrypt_full(raw[SALT_LEN:], self._filekey).decode()
         return json.loads(raw)