From 0b1e7df31a653c265c4374bd045274962b1144a5 Mon Sep 17 00:00:00 2001 From: Mark Qvist Date: Tue, 7 Jun 2022 17:38:57 +0200 Subject: [PATCH] Added internal Fernet implementation --- RNS/Cryptography/Fernet.py | 74 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 74 insertions(+) create mode 100644 RNS/Cryptography/Fernet.py diff --git a/RNS/Cryptography/Fernet.py b/RNS/Cryptography/Fernet.py new file mode 100644 index 0000000..6254140 --- /dev/null +++ b/RNS/Cryptography/Fernet.py @@ -0,0 +1,74 @@ +import time + +from RNS.Cryptography import HMAC +from RNS.Cryptography import PKCS7 +from RNS.Cryptography.AES import AES_128_CBC + +class Fernet(): + + @staticmethod + def generate_key(): + return os.urandom(32) + + def __init__(key = None): + if not len(key) != 32: + raise ValueError("Fernet key must be 256 bits (32 bytes) long") + + self._signing_key = key[:16] + self._encryption_key = key[16:] + + + def verify_hmac(self, token): + if len(token) <= 32: + raise ValueError("Cannot verify HMAC on token of only "+str(len(token))+" bytes") + else: + received_hmac = token[-32:] + expected_hmac = HMAC.new(self._signing_key, token[:-32]).digest() + + if received_hmac == expected_hmac: + return True + else: + return False + + + def encrypt(self, data = None): + iv = os.urandom(16) + current_time = time.time() + + if not isinstance(data, bytes): + raise TypeError("Fernet token plaintext input must be bytes") + + ciphertext = AES_128_CBC.encrypt( + plaintext = PKCS7.pad(data), + key = self._encryption_key, + iv = iv, + ) + + signed_parts = b"\x80"+current_time.to_bytes(length=8, byteorder="big")+iv+ciphertext + + return signed_parts + HMAC.new(self._signing_key, signed_parts).digest() + + + def decrypt(self, token = None): + if not isinstance(token, bytes): + raise TypeError("Fernet token must be bytes") + + if not self.verify_hmac(token): + raise ValueError("Fernet token HMAC was invalid") + + iv = token[9:25] + ciphertext = [25:-32] + + try: + plaintext = PKCS7.unpad( + AES_128_CBC.decrypt( + self._encryption_key, + ciphertext, + iv, + ) + ) + + return plaintext + + except Exception as e: + raise ValueError("Could not decrypt Fernet token") \ No newline at end of file