Encryption

What I do

• Implement encryption at rest
• Handle encryption in transit
• Use proper algorithms
• Manage encryption keys
• Hash passwords securely
• Encrypt sensitive data
• Handle key rotation
• Validate encryption

When to use me

When implementing encryption or handling sensitive data.

Encryption at Rest

import os
import base64
from cryptography.fernet import Fernet
from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC
from cryptography.hazmat.primitives.asymmetric import rsa, padding
from cryptography.hazmat.primitives import serialization
from cryptography.hazmat.backends import default_backend


class EncryptionService:
    """Encryption service for sensitive data."""
    
    def __init__(self, master_key: bytes = None):
        self.master_key = master_key or os.environ.get("ENCRYPTION_KEY").encode()
        self.fernet = Fernet(self._derive_key(self.master_key, b"fernet"))
    
    def _derive_key(self, key: bytes, salt: bytes) -> bytes:
        """Derive a key from master key using PBKDF2."""
        kdf = PBKDF2HMAC(
            algorithm=hashes.SHA256(),
            length=32,
            salt=salt,
            iterations=480000,
            backend=default_backend()
        )
        return base64.urlsafe_b64encode(kdf.derive(key))
    
    def encrypt(self, plaintext: str) -> str:
        """Encrypt plaintext string."""
        if isinstance(plaintext, str):
            plaintext = plaintext.encode()
        
        encrypted = self.fernet.encrypt(plaintext)
        return encrypted.decode()
    
    def decrypt(self, ciphertext: str) -> str:
        """Decrypt ciphertext string."""
        if isinstance(ciphertext, str):
            ciphertext = ciphertext.encode()
        
        decrypted = self.fernet.decrypt(ciphertext)
        return decrypted.decode()
    
    def encrypt_file(self, input_path: str, output_path: str) -> None:
        """Encrypt a file."""
        with open(input_path, 'rb') as f:
            data = f.read()
        
        encrypted = self.fernet.encrypt(data)
        
        with open(output_path, 'wb') as f:
            f.write(encrypted)
    
    def decrypt_file(self, input_path: str, output_path: str) -> None:
        """Decrypt a file."""
        with open(input_path, 'rb') as f:
            data = f.read()
        
        decrypted = self.fernet.decrypt(data)
        
        with open(output_path, 'wb') as f:
            f.write(decrypted)


class AsymmetricEncryption:
    """Asymmetric encryption for key exchange and signatures."""
    
    def __init__(self):
        self.private_key = rsa.generate_private_key(
            public_exponent=65537,
            key_size=2048,
            backend=default_backend()
        )
        self.public_key = self.private_key.public_key()
    
    def encrypt(self, plaintext: bytes) -> bytes:
        """Encrypt with public key."""
        return self.public_key.encrypt(
            plaintext,
            padding.OAEP(
                mgf=padding.MGF1(algorithm=hashes.SHA256()),
                algorithm=hashes.SHA256(),
                label=None
            )
        )
    
    def decrypt(self, ciphertext: bytes) -> bytes:
        """Decrypt with private key."""
        return self.private_key.decrypt(
            ciphertext,
            padding.OAEP(
                mgf=padding.MGF1(algorithm=hashes.SHA256()),
                algorithm=hashes.SHA256(),
                label=None
            )
        )
    
    def get_public_key_pem(self) -> bytes:
        """Get public key in PEM format."""
        return self.public_key.public_bytes(
            encoding=serialization.Encoding.PEM,
            format=serialization.PublicFormat.SubjectPublicKeyInfo
        )
    
    def sign(self, data: bytes) -> bytes:
        """Sign data with private key."""
        return self.private_key.sign(
            data,
            padding.PKCS1v15(),
            hashes.SHA256()
        )
    
    def verify_signature(self, data: bytes, signature: bytes) -> bool:
        """Verify signature with public key."""
        try:
            self.public_key.verify(
                signature,
                data,
                padding.PKCS1v15(),
                hashes.SHA256()
            )
            return True
        except:
            return False

Field-Level Encryption

from dataclasses import dataclass
from typing import Dict, Any
import json


@dataclass
class EncryptedField:
    """Encrypted field value."""
    ciphertext: str
    iv: str
    algorithm: str = "AES-256-GCM"


class FieldEncryption:
    """Encrypt specific fields in data."""
    
    def __init__(self, encryption_service: EncryptionService):
        self.encryption = encryption_service
    
    def encrypt_fields(
        self,
        data: Dict[str, Any],
        fields_to_encrypt: list[str]
    ) -> Dict[str, Any]:
        """Encrypt specific fields in data."""
        encrypted = data.copy()
        
        for field in fields_to_encrypt:
            if field in encrypted and encrypted[field]:
                encrypted[field] = self.encryption.encrypt(
                    str(encrypted[field])
                )
        
        return encrypted
    
    def decrypt_fields(
        self,
        data: Dict[str, Any],
        fields_to_decrypt: list[str]
    ) -> Dict[str, Any]:
        """Decrypt specific fields in data."""
        decrypted = data.copy()
        
        for field in fields_to_decrypt:
            if field in decrypted and decrypted[field]:
                try:
                    decrypted[field] = self.encryption.decrypt(
                        decrypted[field]
                    )
                except:
                    # Field might not be encrypted
                    pass
        
        return decrypted


# Usage with Pydantic model
from pydantic import BaseModel, Field


class UserData(BaseModel):
    """User data with encrypted fields."""
    
    id: str
    name: str
    email: str
    
    @Field
    def ssn(self) -> str:
        """Get decrypted SSN."""
        return self._decrypted_ssn
    
    @ssn.setter
    def ssn(self, value: str):
        self._encrypted_ssn = value
    
    class Config:
        json_encoders = {
            EncryptedField: lambda v: v.ciphertext
        }

Key Management

import os
import json
from datetime import datetime, timedelta
from cryptography.fernet import Fernet


class KeyRotationManager:
    """Manage encryption key rotation."""
    
    def __init__(self, key_storage_path: str):
        self.key_storage_path = key_storage_path
        self.current_key_id = None
        self.keys: Dict[str, dict] = self._load_keys()
    
    def _load_keys(self) -> dict:
        """Load keys from storage."""
        if os.path.exists(self.key_storage_path):
            with open(self.key_storage_path, 'r') as f:
                return json.load(f)
        return {}
    
    def _save_keys(self) -> None:
        """Save keys to storage."""
        with open(self.key_storage_path, 'w') as f:
            json.dump(self.keys, f)
    
    def generate_key(self, key_id: str = None) -> str:
        """Generate a new encryption key."""
        key_id = key_id or f"key_{datetime.utcnow().strftime('%Y%m%d_%H%M%S')}"
        
        key = Fernet.generate_key().decode()
        
        self.keys[key_id] = {
            "key": key,
            "created_at": datetime.utcnow().isoformat(),
            "version": 1,
            "status": "active",
        }
        
        self.current_key_id = key_id
        self._save_keys()
        
        return key_id
    
    def rotate_key(self, key_id: str) -> str:
        """Rotate an existing key."""
        if key_id not in self.keys:
            raise KeyError(f"Key {key_id} not found")
        
        # Mark old key as deprecated
        self.keys[key_id]["status"] = "deprecated"
        self.keys[key_id]["rotated_at"] = datetime.utcnow().isoformat()
        
        # Generate new key
        return self.generate_key(f"{key_id}_v{self.keys[key_id]['version'] + 1}")
    
    def get_current_key(self) -> str:
        """Get current active key."""
        if not self.current_key_id:
            return self.generate_key()
        
        return self.keys[self.current_key_id]["key"]
    
    def get_all_active_keys(self) -> list:
        """Get all active keys for decryption."""
        return [
            {"id": k, **v}
            for k, v in self.keys.items()
            if v["status"] in ["active", "deprecated"]
        ]

TLS/HTTPS Configuration

# Nginx TLS configuration
# /etc/nginx/nginx.conf

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    
    ssl_certificate /etc/ssl/certs/certificate.crt;
    ssl_certificate_key /etc/ssl/private/private.key;
    
    # TLS configuration
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
    ssl_prefer_server_ciphers off;
    
    # HSTS
    add_header Strict-Transport-Security "max-age=63072000" always;
    
    # OCSP Stapling
    ssl_stapling on;
    ssl_stapling_verify on;
    resolver 8.8.8.8 8.8.4.4 valid=300s;
    resolver_timeout 5s;
    
    # Security headers
    add_header X-Frame-Options DENY;
    add_header X-Content-Type-Options nosniff;
    add_header X-XSS-Protection "1; mode=block";
    add_header Content-Security-Policy "default-src 'self'";
    
    location / {
        proxy_pass http://localhost:8000;
    }
}


# Python SSL context for HTTPS
import ssl

ssl_context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)

# Load certificate and key
ssl_context.load_cert_chain(
    certfile="/etc/ssl/certs/certificate.crt",
    keyfile="/etc/ssl/private/private.key"
)

# Set secure protocols
ssl_context.minimum_version = ssl.TLSVersion.TLSv1_2

# Set cipher suites
ssl_context.set_ciphers('ECDHE+AESGCM:DHE+AESGCM:ECDHE+CHACHA20:DHE+CHACHA20')

Best Practices

Encryption Best Practices:

1. Use strong algorithms
   - AES-256 for symmetric
   - RSA-2048+ for asymmetric
   - SHA-256 for hashing

2. Manage keys properly
   - Use key management services
   - Rotate keys regularly
   - Never hardcode keys

3. Encrypt sensitive data
   - PII, passwords, tokens
   - Database fields
   - Files at rest

4. Use TLS everywhere
   - HTTPS for all traffic
   - Certificate pinning
   - HSTS headers

5. Don't roll your own crypto
   - Use established libraries
   - Don't implement algorithms

6. Key separation
   - Different keys for different purposes
   - Development vs production

7. Secure key storage
   - Hardware security modules
   - Cloud KMS
   - Vault

8. Audit encryption
   - Log encryption operations
   - Monitor key usage
   - Alert on anomalies

9. Plan for key rotation
   - Automated rotation
   - Graceful transitions
   - Backward compatibility

10. Protect against side channels
    - Constant-time operations
    - Secure memory handling