docrypt 0.1.0__py3-none-any.whl

docrypt/max.py

@@ -0,0 +1,59 @@
+from .aes import decrypt_aes, encrypt_aes
+from .m import derive_key
+from .p import from_base64, from_hex, to_base64, to_bytes, to_hex
+from .sha512 import hash_sha512_bytes
+from .xor import xor_encrypt
+from .z import secure_compare
+
+DIGEST_SIZE = 64
+INFO_ONE = b"docrypt-max-layer-one"
+INFO_TWO = b"docrypt-max-layer-two"
+INFO_THREE = b"docrypt-max-layer-three"
+
+
+def max_crypt(main, *keys):
+    if not keys:
+        raise ValueError("at least one key is required")
+    data = to_bytes(main)
+    key_one = derive_key(*keys, info=INFO_ONE)
+    key_two = derive_key(*keys, info=INFO_TWO)
+    key_three = derive_key(*keys, info=INFO_THREE)
+    data = encrypt_aes(data, key_one)
+    data = xor_encrypt(data, key_three)
+    data = encrypt_aes(data, key_two)
+    return data + hash_sha512_bytes(data)
+
+
+def max_decrypt(main, *keys):
+    if not keys:
+        raise ValueError("at least one key is required")
+    token = to_bytes(main)
+    if len(token) < DIGEST_SIZE + 2 * (12 + 16):
+        raise ValueError("invalid token size")
+    body = token[:-DIGEST_SIZE]
+    digest = token[-DIGEST_SIZE:]
+    if not secure_compare(hash_sha512_bytes(body), digest):
+        raise ValueError("integrity check failed, data is corrupted")
+    key_one = derive_key(*keys, info=INFO_ONE)
+    key_two = derive_key(*keys, info=INFO_TWO)
+    key_three = derive_key(*keys, info=INFO_THREE)
+    data = decrypt_aes(body, key_two)
+    data = xor_encrypt(data, key_three)
+    data = decrypt_aes(data, key_one)
+    return data
+
+
+def max_crypt_hex(main, *keys):
+    return to_hex(max_crypt(main, *keys))
+
+
+def max_decrypt_hex(main, *keys):
+    return max_decrypt(from_hex(main), *keys)
+
+
+def max_crypt_base64(main, *keys):
+    return to_base64(max_crypt(main, *keys))
+
+
+def max_decrypt_base64(main, *keys):
+    return max_decrypt(from_base64(main), *keys)

docrypt/much.py

@@ -0,0 +1,65 @@
+from .decrypt import decrypt, decrypt_hex
+from .maincrypt import crypt, crypt_hex
+from .p import to_str
+
+
+def crypt_many(items, *keys):
+    return [crypt(item, *keys) for item in items]
+
+
+def decrypt_many(tokens, *keys):
+    return [decrypt(token, *keys) for token in tokens]
+
+
+def decrypt_many_str(tokens, *keys):
+    return [to_str(decrypt(token, *keys)) for token in tokens]
+
+
+def crypt_dict(mapping, *keys):
+    result = {}
+    for name, value in mapping.items():
+        result[name] = crypt(value, *keys)
+    return result
+
+
+def decrypt_dict(mapping, *keys):
+    result = {}
+    for name, value in mapping.items():
+        result[name] = decrypt(value, *keys)
+    return result
+
+
+def crypt_file(source_path, target_path, *keys):
+    with open(source_path, "rb") as handle:
+        raw = handle.read()
+    token = crypt(raw, *keys)
+    with open(target_path, "wb") as handle:
+        handle.write(token)
+    return len(token)
+
+
+def decrypt_file(source_path, target_path, *keys):
+    with open(source_path, "rb") as handle:
+        token = handle.read()
+    raw = decrypt(token, *keys)
+    with open(target_path, "wb") as handle:
+        handle.write(raw)
+    return len(raw)
+
+
+def crypt_file_hex(source_path, target_path, *keys):
+    with open(source_path, "rb") as handle:
+        raw = handle.read()
+    token = crypt_hex(raw, *keys)
+    with open(target_path, "w") as handle:
+        handle.write(token)
+    return len(token)
+
+
+def decrypt_file_hex(source_path, target_path, *keys):
+    with open(source_path, "r") as handle:
+        token = handle.read()
+    raw = decrypt_hex(token, *keys)
+    with open(target_path, "wb") as handle:
+        handle.write(raw)
+    return len(raw)

docrypt/mych.py

@@ -0,0 +1,58 @@
+import hashlib
+
+from .p import from_hex, to_bytes, to_hex
+
+
+def mix_bytes(data):
+    raw = to_bytes(data)
+    left = raw[:(len(raw) + 1) // 2]
+    right = raw[(len(raw) + 1) // 2:]
+    mixed = bytearray()
+    for index in range(len(right)):
+        mixed.append(left[index])
+        mixed.append(right[index])
+    if len(left) > len(right):
+        mixed.append(left[-1])
+    return bytes(mixed)
+
+
+def unmix_bytes(data):
+    raw = to_bytes(data)
+    return bytes(raw[0::2] + raw[1::2])
+
+
+def mix_hex(data):
+    return to_hex(mix_bytes(data))
+
+
+def unmix_hex(data):
+    return unmix_bytes(from_hex(data))
+
+
+def mix_rounds(data, rounds=2):
+    if rounds < 1:
+        raise ValueError("rounds must be at least 1")
+    raw = to_bytes(data)
+    for _ in range(rounds):
+        raw = mix_bytes(raw)
+    return raw
+
+
+def unmix_rounds(data, rounds=2):
+    if rounds < 1:
+        raise ValueError("rounds must be at least 1")
+    raw = to_bytes(data)
+    for _ in range(rounds):
+        raw = unmix_bytes(raw)
+    return raw
+
+
+def mix_keys(*keys):
+    if not keys:
+        raise ValueError("at least one key is required")
+    digests = [hashlib.sha512(to_bytes(item)).digest() for item in keys]
+    result = bytearray(digests[0])
+    for digest in digests[1:]:
+        for index in range(64):
+            result[index] ^= digest[index]
+    return bytes(result)

docrypt/p.py

@@ -0,0 +1,141 @@
+import base64
+
+
+def to_bytes(data):
+    if isinstance(data, bytes):
+        return data
+    if isinstance(data, bytearray):
+        return bytes(data)
+    if isinstance(data, memoryview):
+        return bytes(data)
+    if isinstance(data, str):
+        return data.encode("utf-8")
+    if isinstance(data, (int, float)):
+        return str(data).encode("utf-8")
+    raise TypeError("unsupported data type for conversion to bytes")
+
+
+def to_str(data):
+    return to_bytes(data).decode("utf-8")
+
+
+def to_hex(data):
+    return to_bytes(data).hex()
+
+
+def from_hex(data):
+    if isinstance(data, (bytes, bytearray, memoryview)):
+        data = bytes(data).decode("ascii")
+    return bytes.fromhex(data)
+
+
+def to_base64(data):
+    return base64.b64encode(to_bytes(data)).decode("ascii")
+
+
+def from_base64(data):
+    if isinstance(data, (bytes, bytearray, memoryview)):
+        data = bytes(data).decode("ascii")
+    return base64.b64decode(data)
+
+
+def to_base64_url(data):
+    return base64.urlsafe_b64encode(to_bytes(data)).decode("ascii")
+
+
+def from_base64_url(data):
+    if isinstance(data, (bytes, bytearray, memoryview)):
+        data = bytes(data).decode("ascii")
+    return base64.urlsafe_b64decode(data)
+
+
+def to_base32(data):
+    return base64.b32encode(to_bytes(data)).decode("ascii")
+
+
+def from_base32(data):
+    if isinstance(data, (bytes, bytearray, memoryview)):
+        data = bytes(data).decode("ascii")
+    return base64.b32decode(data)
+
+
+def to_base85(data):
+    return base64.b85encode(to_bytes(data)).decode("ascii")
+
+
+def from_base85(data):
+    if isinstance(data, (bytes, bytearray, memoryview)):
+        data = bytes(data).decode("ascii")
+    return base64.b85decode(data)
+
+
+def to_int(data):
+    return int.from_bytes(to_bytes(data), "big")
+
+
+def from_int(value, length=None):
+    if not isinstance(value, int):
+        raise TypeError("value must be an integer")
+    if value < 0:
+        raise ValueError("value must not be negative")
+    if length is None:
+        length = max(1, (value.bit_length() + 7) // 8)
+    return value.to_bytes(length, "big")
+
+
+def pad_pkcs7(data, block_size=16):
+    raw = to_bytes(data)
+    if block_size < 1 or block_size > 255:
+        raise ValueError("block size must be between 1 and 255")
+    pad_length = block_size - (len(raw) % block_size)
+    return raw + bytes([pad_length] * pad_length)
+
+
+def unpad_pkcs7(data, block_size=16):
+    raw = to_bytes(data)
+    if len(raw) == 0 or len(raw) % block_size != 0:
+        raise ValueError("invalid padded data length")
+    pad_length = raw[-1]
+    if pad_length < 1 or pad_length > block_size:
+        raise ValueError("invalid padding byte")
+    if raw[-pad_length:] != bytes([pad_length] * pad_length):
+        raise ValueError("invalid padding block")
+    return raw[:-pad_length]
+
+
+def chunk_bytes(data, size):
+    raw = to_bytes(data)
+    if size <= 0:
+        raise ValueError("chunk size must be positive")
+    return [raw[i:i + size] for i in range(0, len(raw), size)]
+
+
+def join_bytes(parts):
+    result = bytearray()
+    for part in parts:
+        result.extend(to_bytes(part))
+    return bytes(result)
+
+
+def split_bytes(data, first_length, second_length=None):
+    raw = to_bytes(data)
+    if second_length is None:
+        return raw[:first_length], raw[first_length:]
+    return raw[:first_length], raw[first_length:first_length + second_length], raw[first_length + second_length:]
+
+
+def reverse_bytes(data):
+    return to_bytes(data)[::-1]
+
+
+def repeat_bytes(data, length):
+    raw = to_bytes(data)
+    if len(raw) == 0:
+        raise ValueError("source data must not be empty")
+    if length <= 0:
+        raise ValueError("length must be positive")
+    return (raw * (length // len(raw) + 1))[:length]
+
+
+def length_bytes(data):
+    return len(to_bytes(data))

docrypt/plus.py

@@ -0,0 +1,61 @@
+import hashlib
+import hmac as hmac_module
+
+from .aes import decrypt_aes, encrypt_aes
+from .decrypt import decrypt
+from .m import derive_key
+from .maincrypt import crypt
+from .p import to_bytes
+from .z import random_bytes, secure_compare
+
+WRAPPED_KEY_SIZE = 12 + 16 + 32
+
+
+def sign_data(data, *keys):
+    if not keys:
+        raise ValueError("at least one key is required")
+    key = derive_key(*keys, info=b"docrypt-sign")
+    return hmac_module.new(key, to_bytes(data), hashlib.sha512).digest()
+
+
+def sign_data_hex(data, *keys):
+    return sign_data(data, *keys).hex()
+
+
+def verify_signature(data, signature, *keys):
+    expected = sign_data(data, *keys)
+    return secure_compare(expected, to_bytes(signature))
+
+
+def crypt_and_sign(main, *keys):
+    token = crypt(main, *keys)
+    return token, sign_data(token, *keys)
+
+
+def decrypt_and_verify(main, signature, *keys):
+    if not verify_signature(main, signature, *keys):
+        raise ValueError("signature verification failed")
+    return decrypt(main, *keys)
+
+
+def envelope_seal(main, *keys):
+    if not keys:
+        raise ValueError("at least one key is required")
+    session_key = random_bytes(32)
+    master_key = derive_key(*keys, info=b"docrypt-envelope")
+    body = encrypt_aes(main, session_key)
+    wrapped = encrypt_aes(session_key, master_key)
+    return wrapped + body
+
+
+def envelope_open(token, *keys):
+    if not keys:
+        raise ValueError("at least one key is required")
+    token = to_bytes(token)
+    if len(token) < WRAPPED_KEY_SIZE + 12 + 16:
+        raise ValueError("invalid token size")
+    wrapped = token[:WRAPPED_KEY_SIZE]
+    body = token[WRAPPED_KEY_SIZE:]
+    master_key = derive_key(*keys, info=b"docrypt-envelope")
+    session_key = decrypt_aes(wrapped, master_key)
+    return decrypt_aes(body, session_key)

docrypt/rych.py

@@ -0,0 +1,67 @@
+import hashlib
+import hmac as hmac_module
+import secrets
+
+from .p import from_hex, to_bytes, to_hex
+
+DIGEST_SIZE = 32
+NONCE_SIZE = 12
+
+
+def rych_hash(data):
+    return hashlib.sha256(to_bytes(data)).hexdigest()
+
+
+def rych_mac(key, data):
+    return hmac_module.new(to_bytes(key), to_bytes(data), hashlib.sha256).hexdigest()
+
+
+def rych_derive(*keys):
+    if not keys:
+        raise ValueError("at least one key is required")
+    parts = [hashlib.sha256(to_bytes(item)).digest() for item in keys]
+    return hashlib.sha256(b"".join(parts)).digest()
+
+
+def rych_keystream(key, nonce, length):
+    if length <= 0:
+        raise ValueError("length must be positive")
+    stream = bytearray()
+    counter = 0
+    while len(stream) < length:
+        stream.extend(hmac_module.new(key, nonce + counter.to_bytes(8, "big"), hashlib.sha256).digest())
+        counter += 1
+    return bytes(stream[:length])
+
+
+def rych_crypt(main, *keys):
+    key = rych_derive(*keys)
+    raw = to_bytes(main)
+    nonce = secrets.token_bytes(NONCE_SIZE)
+    stream = rych_keystream(key, nonce, len(raw))
+    ciphertext = bytes(a ^ b for a, b in zip(raw, stream))
+    body = nonce + ciphertext
+    return body + hmac_module.new(key, body, hashlib.sha256).digest()
+
+
+def rych_decrypt(main, *keys):
+    key = rych_derive(*keys)
+    token = to_bytes(main)
+    if len(token) < NONCE_SIZE + DIGEST_SIZE:
+        raise ValueError("invalid token size")
+    body = token[:-DIGEST_SIZE]
+    digest = token[-DIGEST_SIZE:]
+    if not hmac_module.compare_digest(hmac_module.new(key, body, hashlib.sha256).digest(), digest):
+        raise ValueError("decryption failed, invalid key or corrupted data")
+    nonce = body[:NONCE_SIZE]
+    ciphertext = body[NONCE_SIZE:]
+    stream = rych_keystream(key, nonce, len(ciphertext))
+    return bytes(a ^ b for a, b in zip(ciphertext, stream))
+
+
+def rych_crypt_hex(main, *keys):
+    return to_hex(rych_crypt(main, *keys))
+
+
+def rych_decrypt_hex(main, *keys):
+    return rych_decrypt(from_hex(main), *keys)

docrypt/sha256.py

@@ -0,0 +1,64 @@
+import hashlib
+import hmac as hmac_module
+
+from .p import to_bytes
+
+
+def hash_sha256(data):
+    return hashlib.sha256(to_bytes(data)).hexdigest()
+
+
+def hash_sha256_bytes(data):
+    return hashlib.sha256(to_bytes(data)).digest()
+
+
+def hmac_sha256(key, data):
+    return hmac_module.new(to_bytes(key), to_bytes(data), hashlib.sha256).hexdigest()
+
+
+def hmac_sha256_bytes(key, data):
+    return hmac_module.new(to_bytes(key), to_bytes(data), hashlib.sha256).digest()
+
+
+def double_sha256(data):
+    return hashlib.sha256(hashlib.sha256(to_bytes(data)).digest()).hexdigest()
+
+
+def double_sha256_bytes(data):
+    return hashlib.sha256(hashlib.sha256(to_bytes(data)).digest()).digest()
+
+
+def sha256_rounds(data, rounds=2):
+    if rounds < 1:
+        raise ValueError("rounds must be at least 1")
+    digest = hashlib.sha256(to_bytes(data)).digest()
+    for _ in range(rounds - 1):
+        digest = hashlib.sha256(digest).digest()
+    return digest.hex()
+
+
+def sha256_rounds_bytes(data, rounds=2):
+    if rounds < 1:
+        raise ValueError("rounds must be at least 1")
+    digest = hashlib.sha256(to_bytes(data)).digest()
+    for _ in range(rounds - 1):
+        digest = hashlib.sha256(digest).digest()
+    return digest
+
+
+def sha256_file(path, chunk_size=65536):
+    hasher = hashlib.sha256()
+    with open(path, "rb") as handle:
+        while True:
+            chunk = handle.read(chunk_size)
+            if not chunk:
+                break
+            hasher.update(chunk)
+    return hasher.hexdigest()
+
+
+def verify_sha256(data, digest):
+    candidate = to_bytes(digest)
+    if len(candidate) == 32:
+        return hmac_module.compare_digest(hashlib.sha256(to_bytes(data)).digest(), candidate)
+    return hmac_module.compare_digest(hashlib.sha256(to_bytes(data)).hexdigest().encode("ascii"), candidate)

docrypt/sha512.py

@@ -0,0 +1,64 @@
+import hashlib
+import hmac as hmac_module
+
+from .p import to_bytes
+
+
+def hash_sha512(data):
+    return hashlib.sha512(to_bytes(data)).hexdigest()
+
+
+def hash_sha512_bytes(data):
+    return hashlib.sha512(to_bytes(data)).digest()
+
+
+def hmac_sha512(key, data):
+    return hmac_module.new(to_bytes(key), to_bytes(data), hashlib.sha512).hexdigest()
+
+
+def hmac_sha512_bytes(key, data):
+    return hmac_module.new(to_bytes(key), to_bytes(data), hashlib.sha512).digest()
+
+
+def double_sha512(data):
+    return hashlib.sha512(hashlib.sha512(to_bytes(data)).digest()).hexdigest()
+
+
+def double_sha512_bytes(data):
+    return hashlib.sha512(hashlib.sha512(to_bytes(data)).digest()).digest()
+
+
+def sha512_rounds(data, rounds=2):
+    if rounds < 1:
+        raise ValueError("rounds must be at least 1")
+    digest = hashlib.sha512(to_bytes(data)).digest()
+    for _ in range(rounds - 1):
+        digest = hashlib.sha512(digest).digest()
+    return digest.hex()
+
+
+def sha512_rounds_bytes(data, rounds=2):
+    if rounds < 1:
+        raise ValueError("rounds must be at least 1")
+    digest = hashlib.sha512(to_bytes(data)).digest()
+    for _ in range(rounds - 1):
+        digest = hashlib.sha512(digest).digest()
+    return digest
+
+
+def sha512_file(path, chunk_size=65536):
+    hasher = hashlib.sha512()
+    with open(path, "rb") as handle:
+        while True:
+            chunk = handle.read(chunk_size)
+            if not chunk:
+                break
+            hasher.update(chunk)
+    return hasher.hexdigest()
+
+
+def verify_sha512(data, digest):
+    candidate = to_bytes(digest)
+    if len(candidate) == 64:
+        return hmac_module.compare_digest(hashlib.sha512(to_bytes(data)).digest(), candidate)
+    return hmac_module.compare_digest(hashlib.sha512(to_bytes(data)).hexdigest().encode("ascii"), candidate)

docrypt/xor.py

@@ -0,0 +1,41 @@
+import hashlib
+import hmac as hmac_module
+
+from .p import from_hex, to_bytes, to_hex
+
+
+def make_keystream(key, length):
+    if length <= 0:
+        raise ValueError("length must be positive")
+    key = to_bytes(key)
+    stream = bytearray()
+    counter = 0
+    while len(stream) < length:
+        stream.extend(hmac_module.new(key, counter.to_bytes(8, "big"), hashlib.sha512).digest())
+        counter += 1
+    return bytes(stream[:length])
+
+
+def xor_bytes(first, second):
+    first = to_bytes(first)
+    second = to_bytes(second)
+    if len(first) != len(second):
+        raise ValueError("operands must have equal length")
+    return bytes(a ^ b for a, b in zip(first, second))
+
+
+def xor_encrypt(data, key):
+    raw = to_bytes(data)
+    return xor_bytes(raw, make_keystream(key, len(raw)))
+
+
+def xor_decrypt(data, key):
+    return xor_encrypt(data, key)
+
+
+def xor_encrypt_hex(data, key):
+    return to_hex(xor_encrypt(data, key))
+
+
+def xor_decrypt_hex(data, key):
+    return xor_decrypt(from_hex(data), key)

docrypt/z.py

@@ -0,0 +1,60 @@
+import hmac
+import secrets
+import string
+
+from .p import to_bytes
+
+
+def random_bytes(length):
+    if not isinstance(length, int) or length <= 0:
+        raise ValueError("length must be a positive integer")
+    return secrets.token_bytes(length)
+
+
+def random_hex(length):
+    if not isinstance(length, int) or length <= 0:
+        raise ValueError("length must be a positive integer")
+    return secrets.token_hex(length)
+
+
+def random_int(lower, upper):
+    if lower > upper:
+        raise ValueError("lower bound must not exceed upper bound")
+    return secrets.randbelow(upper - lower + 1) + lower
+
+
+def random_token(length=32):
+    if not isinstance(length, int) or length <= 0:
+        raise ValueError("length must be a positive integer")
+    alphabet = string.ascii_letters + string.digits
+    return "".join(secrets.choice(alphabet) for _ in range(length))
+
+
+def generate_key(length=32):
+    if length not in (16, 24, 32):
+        raise ValueError("key length must be 16, 24 or 32 bytes")
+    return secrets.token_hex(length)
+
+
+def generate_salt(length=16):
+    if not isinstance(length, int) or length <= 0:
+        raise ValueError("length must be a positive integer")
+    return secrets.token_bytes(length)
+
+
+def generate_nonce(length=12):
+    if not isinstance(length, int) or length <= 0:
+        raise ValueError("length must be a positive integer")
+    return secrets.token_bytes(length)
+
+
+def secure_compare(first, second):
+    return hmac.compare_digest(to_bytes(first), to_bytes(second))
+
+
+def is_valid_key_length(key):
+    return len(to_bytes(key)) in (16, 24, 32)
+
+
+def key_bit_length(key):
+    return len(to_bytes(key)) * 8