docrypt 0.1.0__tar.gz

docrypt-0.1.0/PKG-INFO

@@ -0,0 +1,21 @@
+Metadata-Version: 2.4
+Name: docrypt
+Version: 0.1.0
+Summary: Universal library for document encryption and secure storage
+Author-email: vexikoff <vexikoff@gmail.com>
+License: MIT
+Keywords: crypto,encryption,decrypt,security,docrypt,files
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.8
+Classifier: Programming Language :: Python :: 3.9
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Topic :: Security :: Cryptography
+Classifier: Operating System :: OS Independent
+Requires-Python: >=3.8

docrypt-0.1.0/docrypt/__init__.py

@@ -0,0 +1,296 @@
+from .aes import (
+    decrypt_aes,
+    decrypt_aes_base64,
+    decrypt_aes_hex,
+    decrypt_aes_with_aad,
+    encrypt_aes,
+    encrypt_aes_base64,
+    encrypt_aes_hex,
+    encrypt_aes_with_aad,
+    generate_aes_key,
+)
+from .crunch import crunch_decrypt, crunch_encrypt, crunch_hash
+from .decrypt import decrypt, decrypt_base64, decrypt_hex
+from .dopo import (
+    decode_token,
+    describe_token,
+    encode_token,
+    pack_token,
+    token_length,
+    unpack_token,
+)
+from .light import (
+    light_crypt,
+    light_crypt_base64,
+    light_crypt_hex,
+    light_decrypt,
+    light_decrypt_base64,
+    light_decrypt_hex,
+    light_derive_key,
+    light_hash,
+)
+from .m import (
+    derive_key,
+    derive_key_base64,
+    derive_key_hex,
+    derive_key_with_info,
+    derive_two_keys,
+    merge_keys,
+    stretch_key,
+    stretch_key_hex,
+)
+from .maincrypt import crypt, crypt_base64, crypt_hex
+from .max import (
+    max_crypt,
+    max_crypt_base64,
+    max_crypt_hex,
+    max_decrypt,
+    max_decrypt_base64,
+    max_decrypt_hex,
+)
+from .much import (
+    crypt_dict,
+    crypt_file,
+    crypt_file_hex,
+    crypt_many,
+    decrypt_dict,
+    decrypt_file,
+    decrypt_file_hex,
+    decrypt_many,
+    decrypt_many_str,
+)
+from .mych import (
+    mix_bytes,
+    mix_hex,
+    mix_keys,
+    mix_rounds,
+    unmix_bytes,
+    unmix_hex,
+    unmix_rounds,
+)
+from .p import (
+    chunk_bytes,
+    from_base32,
+    from_base64,
+    from_base64_url,
+    from_base85,
+    from_hex,
+    from_int,
+    join_bytes,
+    length_bytes,
+    pad_pkcs7,
+    repeat_bytes,
+    reverse_bytes,
+    split_bytes,
+    to_base32,
+    to_base64,
+    to_base64_url,
+    to_base85,
+    to_bytes,
+    to_hex,
+    to_int,
+    to_str,
+    unpad_pkcs7,
+)
+from .plus import (
+    crypt_and_sign,
+    decrypt_and_verify,
+    envelope_open,
+    envelope_seal,
+    sign_data,
+    sign_data_hex,
+    verify_signature,
+)
+from .rych import (
+    rych_crypt,
+    rych_crypt_hex,
+    rych_decrypt,
+    rych_decrypt_hex,
+    rych_derive,
+    rych_hash,
+    rych_mac,
+)
+from .sha256 import (
+    double_sha256,
+    double_sha256_bytes,
+    hash_sha256,
+    hash_sha256_bytes,
+    hmac_sha256,
+    hmac_sha256_bytes,
+    sha256_file,
+    sha256_rounds,
+    sha256_rounds_bytes,
+    verify_sha256,
+)
+from .sha512 import (
+    double_sha512,
+    double_sha512_bytes,
+    hash_sha512,
+    hash_sha512_bytes,
+    hmac_sha512,
+    hmac_sha512_bytes,
+    sha512_file,
+    sha512_rounds,
+    sha512_rounds_bytes,
+    verify_sha512,
+)
+from .xor import (
+    make_keystream,
+    xor_bytes,
+    xor_decrypt,
+    xor_decrypt_hex,
+    xor_encrypt,
+    xor_encrypt_hex,
+)
+from .z import (
+    generate_key,
+    generate_nonce,
+    generate_salt,
+    is_valid_key_length,
+    key_bit_length,
+    random_bytes,
+    random_hex,
+    random_int,
+    random_token,
+    secure_compare,
+)
+
+__version__ = "1.1.0"
+
+__all__ = [
+    "crypt",
+    "crypt_hex",
+    "crypt_base64",
+    "decrypt",
+    "decrypt_hex",
+    "decrypt_base64",
+    "encrypt_aes",
+    "decrypt_aes",
+    "encrypt_aes_hex",
+    "decrypt_aes_hex",
+    "encrypt_aes_base64",
+    "decrypt_aes_base64",
+    "encrypt_aes_with_aad",
+    "decrypt_aes_with_aad",
+    "generate_aes_key",
+    "crunch_encrypt",
+    "crunch_decrypt",
+    "crunch_hash",
+    "max_crypt",
+    "max_crypt_hex",
+    "max_crypt_base64",
+    "max_decrypt",
+    "max_decrypt_hex",
+    "max_decrypt_base64",
+    "light_crypt",
+    "light_crypt_hex",
+    "light_crypt_base64",
+    "light_decrypt",
+    "light_decrypt_hex",
+    "light_decrypt_base64",
+    "light_derive_key",
+    "light_hash",
+    "rych_crypt",
+    "rych_crypt_hex",
+    "rych_decrypt",
+    "rych_decrypt_hex",
+    "rych_derive",
+    "rych_hash",
+    "rych_mac",
+    "xor_encrypt",
+    "xor_decrypt",
+    "xor_encrypt_hex",
+    "xor_decrypt_hex",
+    "xor_bytes",
+    "make_keystream",
+    "mix_bytes",
+    "unmix_bytes",
+    "mix_hex",
+    "unmix_hex",
+    "mix_rounds",
+    "unmix_rounds",
+    "mix_keys",
+    "sign_data",
+    "sign_data_hex",
+    "verify_signature",
+    "crypt_and_sign",
+    "decrypt_and_verify",
+    "envelope_seal",
+    "envelope_open",
+    "crypt_many",
+    "decrypt_many",
+    "decrypt_many_str",
+    "crypt_dict",
+    "decrypt_dict",
+    "crypt_file",
+    "decrypt_file",
+    "crypt_file_hex",
+    "decrypt_file_hex",
+    "pack_token",
+    "unpack_token",
+    "encode_token",
+    "decode_token",
+    "token_length",
+    "describe_token",
+    "merge_keys",
+    "derive_key",
+    "derive_key_hex",
+    "derive_key_base64",
+    "derive_key_with_info",
+    "derive_two_keys",
+    "stretch_key",
+    "stretch_key_hex",
+    "hash_sha256",
+    "hash_sha256_bytes",
+    "hmac_sha256",
+    "hmac_sha256_bytes",
+    "double_sha256",
+    "double_sha256_bytes",
+    "sha256_rounds",
+    "sha256_rounds_bytes",
+    "sha256_file",
+    "verify_sha256",
+    "hash_sha512",
+    "hash_sha512_bytes",
+    "hmac_sha512",
+    "hmac_sha512_bytes",
+    "double_sha512",
+    "double_sha512_bytes",
+    "sha512_rounds",
+    "sha512_rounds_bytes",
+    "sha512_file",
+    "verify_sha512",
+    "to_bytes",
+    "to_str",
+    "to_hex",
+    "from_hex",
+    "to_base64",
+    "from_base64",
+    "to_base64_url",
+    "from_base64_url",
+    "to_base32",
+    "from_base32",
+    "to_base85",
+    "from_base85",
+    "to_int",
+    "from_int",
+    "pad_pkcs7",
+    "unpad_pkcs7",
+    "chunk_bytes",
+    "join_bytes",
+    "split_bytes",
+    "reverse_bytes",
+    "repeat_bytes",
+    "length_bytes",
+    "random_bytes",
+    "random_hex",
+    "random_int",
+    "random_token",
+    "generate_key",
+    "generate_salt",
+    "generate_nonce",
+    "secure_compare",
+    "is_valid_key_length",
+    "key_bit_length",
+    "__version__",
+]

docrypt-0.1.0/docrypt/aes.py

@@ -0,0 +1,82 @@
+from cryptography.exceptions import InvalidTag
+from cryptography.hazmat.primitives.ciphers.aead import AESGCM
+
+from .p import from_base64, from_hex, to_base64, to_bytes, to_hex
+from .z import random_bytes
+
+NONCE_SIZE = 12
+TAG_SIZE = 16
+
+
+def generate_aes_key(bits=256):
+    if bits not in (128, 192, 256):
+        raise ValueError("bits must be 128, 192 or 256")
+    return AESGCM.generate_key(bit_length=bits)
+
+
+def encrypt_aes(data, key):
+    raw = to_bytes(data)
+    key = to_bytes(key)
+    if len(key) not in (16, 24, 32):
+        raise ValueError("aes key must be 16, 24 or 32 bytes")
+    nonce = random_bytes(NONCE_SIZE)
+    cipher = AESGCM(key)
+    return nonce + cipher.encrypt(nonce, raw, None)
+
+
+def decrypt_aes(data, key):
+    token = to_bytes(data)
+    key = to_bytes(key)
+    if len(key) not in (16, 24, 32):
+        raise ValueError("aes key must be 16, 24 or 32 bytes")
+    if len(token) < NONCE_SIZE + TAG_SIZE:
+        raise ValueError("invalid token size")
+    nonce = token[:NONCE_SIZE]
+    ciphertext = token[NONCE_SIZE:]
+    cipher = AESGCM(key)
+    try:
+        return cipher.decrypt(nonce, ciphertext, None)
+    except InvalidTag:
+        raise ValueError("decryption failed, invalid key or corrupted data")
+
+
+def encrypt_aes_hex(data, key):
+    return to_hex(encrypt_aes(data, key))
+
+
+def decrypt_aes_hex(data, key):
+    return decrypt_aes(from_hex(data), key)
+
+
+def encrypt_aes_base64(data, key):
+    return to_base64(encrypt_aes(data, key))
+
+
+def decrypt_aes_base64(data, key):
+    return decrypt_aes(from_base64(data), key)
+
+
+def encrypt_aes_with_aad(data, key, aad):
+    raw = to_bytes(data)
+    key = to_bytes(key)
+    if len(key) not in (16, 24, 32):
+        raise ValueError("aes key must be 16, 24 or 32 bytes")
+    nonce = random_bytes(NONCE_SIZE)
+    cipher = AESGCM(key)
+    return nonce + cipher.encrypt(nonce, raw, to_bytes(aad))
+
+
+def decrypt_aes_with_aad(data, key, aad):
+    token = to_bytes(data)
+    key = to_bytes(key)
+    if len(key) not in (16, 24, 32):
+        raise ValueError("aes key must be 16, 24 or 32 bytes")
+    if len(token) < NONCE_SIZE + TAG_SIZE:
+        raise ValueError("invalid token size")
+    nonce = token[:NONCE_SIZE]
+    ciphertext = token[NONCE_SIZE:]
+    cipher = AESGCM(key)
+    try:
+        return cipher.decrypt(nonce, ciphertext, to_bytes(aad))
+    except InvalidTag:
+        raise ValueError("decryption failed, invalid key or corrupted data")

docrypt-0.1.0/docrypt/crunch.py

@@ -0,0 +1,50 @@
+from .aes import decrypt_aes, encrypt_aes
+from .m import derive_key
+from .p import to_bytes
+from .sha512 import hash_sha512_bytes
+from .xor import xor_encrypt
+from .z import secure_compare
+
+DIGEST_SIZE = 64
+DEFAULT_ROUNDS = 3
+
+
+def crunch_encrypt(main, *keys, rounds=DEFAULT_ROUNDS):
+    if not keys:
+        raise ValueError("at least one key is required")
+    if not isinstance(rounds, int) or rounds < 1 or rounds > 255:
+        raise ValueError("rounds must be between 1 and 255")
+    data = to_bytes(main)
+    for index in range(rounds):
+        xor_key = derive_key(*keys, info=b"docrypt-crunch-xor-" + bytes([index]))
+        enc_key = derive_key(*keys, info=b"docrypt-crunch-enc-" + bytes([index]))
+        data = encrypt_aes(xor_encrypt(data, xor_key), enc_key)
+    return bytes([rounds]) + data + hash_sha512_bytes(data)
+
+
+def crunch_decrypt(main, *keys):
+    if not keys:
+        raise ValueError("at least one key is required")
+    token = to_bytes(main)
+    if len(token) < 1 + DIGEST_SIZE + 12 + 16:
+        raise ValueError("invalid token size")
+    rounds = token[0]
+    body = token[1:-DIGEST_SIZE]
+    digest = token[-DIGEST_SIZE:]
+    if not secure_compare(hash_sha512_bytes(body), digest):
+        raise ValueError("integrity check failed, data is corrupted")
+    data = body
+    for index in range(rounds - 1, -1, -1):
+        xor_key = derive_key(*keys, info=b"docrypt-crunch-xor-" + bytes([index]))
+        enc_key = derive_key(*keys, info=b"docrypt-crunch-enc-" + bytes([index]))
+        data = xor_encrypt(decrypt_aes(data, enc_key), xor_key)
+    return data
+
+
+def crunch_hash(data, rounds=1000):
+    if rounds < 1:
+        raise ValueError("rounds must be at least 1")
+    digest = hash_sha512_bytes(data)
+    for _ in range(rounds - 1):
+        digest = hash_sha512_bytes(digest)
+    return digest.hex()

docrypt-0.1.0/docrypt/decrypt.py

@@ -0,0 +1,32 @@
+from .aes import decrypt_aes
+from .m import derive_key
+from .p import from_base64, from_hex, to_bytes
+from .sha512 import hash_sha512_bytes
+from .z import secure_compare
+
+DIGEST_SIZE = 64
+NONCE_SIZE = 12
+TAG_SIZE = 16
+
+
+def decrypt(main, *keys):
+    if not keys:
+        raise ValueError("at least one key is required")
+    token = to_bytes(main)
+    if len(token) < DIGEST_SIZE + NONCE_SIZE + TAG_SIZE:
+        raise ValueError("invalid token size")
+    payload = token[:-DIGEST_SIZE]
+    digest = token[-DIGEST_SIZE:]
+    expected = hash_sha512_bytes(payload)
+    if not secure_compare(expected, digest):
+        raise ValueError("integrity check failed, data is corrupted")
+    key = derive_key(*keys)
+    return decrypt_aes(payload, key)
+
+
+def decrypt_hex(main, *keys):
+    return decrypt(from_hex(main), *keys)
+
+
+def decrypt_base64(main, *keys):
+    return decrypt(from_base64(main), *keys)

docrypt-0.1.0/docrypt/dopo.py

@@ -0,0 +1,68 @@
+from .p import (
+    from_base32,
+    from_base64,
+    from_base64_url,
+    from_base85,
+    from_hex,
+    to_base32,
+    to_base64,
+    to_base64_url,
+    to_base85,
+    to_bytes,
+    to_hex,
+)
+
+TOKEN_PREFIX = b"DC1"
+
+
+def pack_token(token):
+    return TOKEN_PREFIX + to_bytes(token)
+
+
+def unpack_token(token):
+    raw = to_bytes(token)
+    if not raw.startswith(TOKEN_PREFIX):
+        raise ValueError("unknown token prefix")
+    return raw[len(TOKEN_PREFIX):]
+
+
+def encode_token(token, encoding):
+    raw = to_bytes(token)
+    if encoding == "hex":
+        return to_hex(raw)
+    if encoding == "base64":
+        return to_base64(raw)
+    if encoding == "base64url":
+        return to_base64_url(raw)
+    if encoding == "base32":
+        return to_base32(raw)
+    if encoding == "base85":
+        return to_base85(raw)
+    raise ValueError("unsupported encoding")
+
+
+def decode_token(token, encoding):
+    if encoding == "hex":
+        return from_hex(token)
+    if encoding == "base64":
+        return from_base64(token)
+    if encoding == "base64url":
+        return from_base64_url(token)
+    if encoding == "base32":
+        return from_base32(token)
+    if encoding == "base85":
+        return from_base85(token)
+    raise ValueError("unsupported encoding")
+
+
+def token_length(token):
+    return len(to_bytes(token))
+
+
+def describe_token(token):
+    raw = to_bytes(token)
+    return {
+        "length": len(raw),
+        "hex_head": raw[:16].hex(),
+        "has_prefix": raw.startswith(TOKEN_PREFIX),
+    }

docrypt-0.1.0/docrypt/light.py

@@ -0,0 +1,71 @@
+import hashlib
+import hmac as hmac_module
+import secrets
+
+from .p import from_base64, from_hex, to_base64, to_bytes, to_hex
+
+DIGEST_SIZE = 64
+NONCE_SIZE = 12
+
+
+def light_derive_key(*keys):
+    if not keys:
+        raise ValueError("at least one key is required")
+    parts = [hashlib.sha512(to_bytes(item)).digest() for item in keys]
+    return hashlib.sha512(b"".join(parts)).digest()[:32]
+
+
+def light_keystream(key, length):
+    if length <= 0:
+        raise ValueError("length must be positive")
+    stream = bytearray()
+    counter = 0
+    while len(stream) < length:
+        stream.extend(hmac_module.new(key, counter.to_bytes(8, "big"), hashlib.sha512).digest())
+        counter += 1
+    return bytes(stream[:length])
+
+
+def light_crypt(main, *keys):
+    key = light_derive_key(*keys)
+    raw = to_bytes(main)
+    nonce = secrets.token_bytes(NONCE_SIZE)
+    stream = light_keystream(key + nonce, len(raw))
+    ciphertext = bytes(a ^ b for a, b in zip(raw, stream))
+    body = nonce + ciphertext
+    return body + hmac_module.new(key, body, hashlib.sha512).digest()
+
+
+def light_decrypt(main, *keys):
+    key = light_derive_key(*keys)
+    token = to_bytes(main)
+    if len(token) < NONCE_SIZE + DIGEST_SIZE:
+        raise ValueError("invalid token size")
+    body = token[:-DIGEST_SIZE]
+    digest = token[-DIGEST_SIZE:]
+    if not hmac_module.compare_digest(hmac_module.new(key, body, hashlib.sha512).digest(), digest):
+        raise ValueError("decryption failed, invalid key or corrupted data")
+    nonce = body[:NONCE_SIZE]
+    ciphertext = body[NONCE_SIZE:]
+    stream = light_keystream(key + nonce, len(ciphertext))
+    return bytes(a ^ b for a, b in zip(ciphertext, stream))
+
+
+def light_crypt_hex(main, *keys):
+    return to_hex(light_crypt(main, *keys))
+
+
+def light_decrypt_hex(main, *keys):
+    return light_decrypt(from_hex(main), *keys)
+
+
+def light_crypt_base64(main, *keys):
+    return to_base64(light_crypt(main, *keys))
+
+
+def light_decrypt_base64(main, *keys):
+    return light_decrypt(from_base64(main), *keys)
+
+
+def light_hash(data):
+    return hashlib.sha512(to_bytes(data)).hexdigest()

docrypt-0.1.0/docrypt/m.py

@@ -0,0 +1,56 @@
+import hashlib
+
+from cryptography.hazmat.primitives import hashes
+from cryptography.hazmat.primitives.kdf.hkdf import HKDF
+from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC
+
+from .p import to_base64, to_bytes, to_hex
+
+DERIVE_INFO = b"docrypt-aes-256-key"
+
+
+def merge_keys(*keys):
+    if not keys:
+        raise ValueError("at least one key is required")
+    parts = []
+    for item in keys:
+        parts.append(hashlib.sha512(to_bytes(item)).digest())
+    return hashlib.sha512(b"".join(parts)).digest()
+
+
+def derive_key(*keys, length=32, info=DERIVE_INFO):
+    if length not in (16, 24, 32):
+        raise ValueError("key length must be 16, 24 or 32 bytes")
+    material = merge_keys(*keys)
+    hkdf = HKDF(algorithm=hashes.SHA512(), length=length, salt=None, info=to_bytes(info))
+    return hkdf.derive(material)
+
+
+def derive_key_hex(*keys, length=32, info=DERIVE_INFO):
+    return to_hex(derive_key(*keys, length=length, info=info))
+
+
+def derive_key_base64(*keys, length=32, info=DERIVE_INFO):
+    return to_base64(derive_key(*keys, length=length, info=info))
+
+
+def derive_key_with_info(*keys, info, length=32):
+    return derive_key(*keys, length=length, info=info)
+
+
+def derive_two_keys(*keys):
+    material = merge_keys(*keys)
+    hkdf = HKDF(algorithm=hashes.SHA512(), length=64, salt=None, info=DERIVE_INFO)
+    block = hkdf.derive(material)
+    return block[:32], block[32:]
+
+
+def stretch_key(password, salt, iterations=100000, length=32):
+    if length not in (16, 24, 32):
+        raise ValueError("key length must be 16, 24 or 32 bytes")
+    kdf = PBKDF2HMAC(algorithm=hashes.SHA512(), length=length, salt=to_bytes(salt), iterations=iterations)
+    return kdf.derive(to_bytes(password))
+
+
+def stretch_key_hex(password, salt, iterations=100000, length=32):
+    return to_hex(stretch_key(password, salt, iterations=iterations, length=length))

docrypt-0.1.0/docrypt/maincrypt.py

@@ -0,0 +1,23 @@
+from .aes import encrypt_aes
+from .m import derive_key
+from .p import to_base64, to_hex
+from .sha512 import hash_sha512_bytes
+
+DIGEST_SIZE = 64
+
+
+def crypt(main, *keys):
+    if not keys:
+        raise ValueError("at least one key is required")
+    key = derive_key(*keys)
+    payload = encrypt_aes(main, key)
+    digest = hash_sha512_bytes(payload)
+    return payload + digest
+
+
+def crypt_hex(main, *keys):
+    return to_hex(crypt(main, *keys))
+
+
+def crypt_base64(main, *keys):
+    return to_base64(crypt(main, *keys))