public_key_cryptography.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Public key cryptography\n",
    "Public key cryptography is most commonly used to authenticate a message or for sending/receiving encrypted messages.  It involves a private/public key pair."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Import cryptography module"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 1,
   "metadata": {},
   "outputs": [],
   "source": [
    "import cryptography\n",
    "from IPython.display import display\n",
    "\n",
    "# import the relevant parts of the cryptography module\n",
    "from cryptography.hazmat.primitives.asymmetric import rsa\n",
    "from cryptography.hazmat.primitives import hashes\n",
    "from cryptography.hazmat.primitives.asymmetric import padding"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Create a private/public key pair\n",
    "For public key cryptography, such as for signing a message to prove its authenticity or for sending an encrypted message to a recipient, we will need a private/public key pair."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Let's start by creating a private key — this should be kept private!"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 2,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "<cryptography.hazmat.backends.openssl.rsa._RSAPrivateKey at 0x7f8f489d60d0>"
      ]
     },
     "execution_count": 2,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "private_key = rsa.generate_private_key(\n",
    "    public_exponent=65537,\n",
    "    key_size=2048,\n",
    ")\n",
    "private_key"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "From the private key, we can derive a public key — this can be shared publicly."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 3,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "<cryptography.hazmat.backends.openssl.rsa._RSAPublicKey at 0x7f8f489d6160>"
      ]
     },
     "execution_count": 3,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "public_key = private_key.public_key() # derive the public key\n",
    "public_key"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Digital signatures\n",
    "Prove authenticity of a message by having the sender asign it with their private key, and the receipient validate the signature using the sender's public key."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Create the signature\n",
    "Each signature is unique, even if repeatedly signing the same message with the same private key."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 4,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "b'\\xb2\\x03b]\\xadv\\xf5q\\xf2X\\xda\\x7f$\\xd0k\\xc3~7\\xd6S\\xee\\xbe*)cF\\xafrZ.8\\xc3\\x83\\xb5\\xc6\\xb3n\\xb9\\xcdh\\xb1\\x00\\xd59\\xa9\\x12\\x16\\x9c6\\xa5\\xcd\\'\\xbe\\xf8\\x8e\\x9d][\\xbd[\\x85\\xa8,\\xba*\\x86\\t\\x00\\x18t9\\xb1v\\xb1*%\\x16r2>\\xa4w\\xd3\\xe7}P\\xf0\\xfe\\xda\\xdc-(\\x8fMb\\xdf\\x9d\\x97\\xf6K>\\xfa\\xbf\\xa6\\x1b\\xf78\\xdf\\xbfE\\x90[\\xc6\\x15\\x1e\\x97\\x85\\x9f\\x06@\\x0c\\x1e\\xc0\\xe1N\\x93[\\xee[\\xeem\\n\\xca;\\xc0q\\x04?\\xbf\\x97\\xc4I\\xbf\\x94\\x7f~\\xdc\\xeb!\\xbax\\'>\\x0e\\xea\\xfd\\x95\\x9d\\xb0\\x87\\x00\\xe9\\xb2N\\x1c\\xbbO\\x9b\\xf5\\xf7\\x00\\xe2\\xdeE?\\xca\\\\\\x1d\\xa8\\x9a\\xc2_\\x069\\xfeM\\xe1\\x0b&\\xd46;\\x1eY\\x85u\\xc8\\xad\\xd8\\x13\\xba\\xb7\\xf1\\xfe\\xd4\\x1a<\"\\xa3\\x97\\xc4e\\xbf\\xa5)\\xd2\\xf62\\xdek\\x0f\\x14-\\xb5\\x99\\x00\\xa1\\xca\\xe9}+\\xb7}nW2\\xb9\\x13\\x94\\x16\\x81\\x16D\\x91&R\\x18\\x06p\\xa3\\xbcF\\x8d\\xdfi\\xc4'"
      ]
     },
     "execution_count": 4,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "# the message for most crypto functions must be a byte array, not a regular string\n",
    "message = b\"In spite of all their friends could say, on a winter's morn, on a stormy day, in a Sieve they went to sea!\"\n",
    "\n",
    "# generate a signature for this message using our private key\n",
    "signature = private_key.sign(\n",
    "    message,\n",
    "    padding.PSS(\n",
    "        mgf=padding.MGF1(hashes.SHA256()),\n",
    "        salt_length=padding.PSS.MAX_LENGTH\n",
    "    ),\n",
    "    hashes.SHA256()\n",
    ")\n",
    "signature"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Validate the signature\n",
    "Assuming they have been given the sender's public key, the recipient of this message could use the sender's public key to validate the authenticity of the message."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 5,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "'The signature is valid.'"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    }
   ],
   "source": [
    "# If the signature does not match, verify() will raise an InvalidSignature exception.\n",
    "try:\n",
    "    # try to verify the signature\n",
    "    public_key.verify(\n",
    "        signature,\n",
    "        message,\n",
    "        padding.PSS(\n",
    "            mgf=padding.MGF1(hashes.SHA256()),\n",
    "            salt_length=padding.PSS.MAX_LENGTH\n",
    "        ),\n",
    "        hashes.SHA256()\n",
    "    )\n",
    "    display('The signature is valid.')\n",
    "except:\n",
    "    # an exception was thrown\n",
    "    display('Invalid signature.  Be careful!')"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Encrypting messages\n",
    "To send private messages that others will not be able to intercept, the sender can use the recipient's public key to encrypt a message in such a way that only the recipient (the holder of the corresponding private key) can decrypt it."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 6,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "b'\\x08\\xc3\\x08\\'\\xfa\\xe8=}.\\n\\xbe\\xe2^\\xf1}8\\x12\\xb0t\\x0c\\x90,\\x85\\x1aH\\xf4\\x0e\\xc9\\x13\\xb5\\xc2\\x91\\x8e\\x8cZ\\xf4?Q\\xcf_\\x8aAPz\\x9f.\\xb2i\\xecy\\xcd\\xfc\\xe5\\xaa\\x84\\xe5\\x96\\xf8\\x0f\"\\x0b\\x1c;\\xb9m\\xfc`\\x99_\\xa2\\x97CSj\\xe3\\x80\\xe1\\x07\\xac!nX\\xca:\\x87\\xca9z \\xbd\\x87J\\xb8U\\xc0\\x89\\xae\\xb9d\\xa6ss\\xacHQ2%U\\xd6T\\xecN\\x08\\x1d\\xdf\\x83\\xa86\\x05\\xce\\xbf\\x8f\\xa0\\xb5f\\xe1\\x9eK<Xk\\rlZ4A\\xc1Q\\x87[\\x8b\\xc4\\xb7\\xb6\\xf3\\xab\\x86\\x9e\\xdf\\x1b\\x83\\xb3\\x83\\x9f\\x9c\\xa87-BB\\xa0\\xe4\"\\xe0#%*\\xad\\xa7\\xc1U!\\x18\\xaf\\x0eG\\xd3\\xe7\\x1fgu\\'j.\"L\\xd6,c\\x83\\xee.\\xde\\x81R\"`\\x93\\x16de\\x04I\\x04\\x89\\x14T\\xb8\\x9e\\x96\\xf2\\x1f\\x03\\x19d\\xcc.\\xd5j\\xa8V#\\xb4_\\x03\\x89\\xfaM:\\x8f&q\\xab\\x9c\\xd7D{\\x8c\\x08\\xe1k\\x14\\xf4\\x19\\xcd\\xa1\\xc6\\xc8x\\xd3\\xc9\\x9c\\xbf\\xa0\\xa3\\x05'"
      ]
     },
     "execution_count": 6,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "message = b\"In spite of all their friends could say, on a winter's morn, on a stormy day, in a Sieve they went to sea!\"\n",
    "\n",
    "# create the encrypted message, a.k.a. the cyphertext\n",
    "ciphertext = public_key.encrypt(\n",
    "    message,\n",
    "    padding.OAEP(\n",
    "        mgf=padding.MGF1(algorithm=hashes.SHA256()),\n",
    "        algorithm=hashes.SHA256(),\n",
    "        label=None\n",
    "    )\n",
    ")\n",
    "\n",
    "# show the ciphertext\n",
    "ciphertext"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Decrypt the message\n",
    "The recipient can now use their own private key to decrypt the message that was encrypted by the sender specifically for them.  Imagine here that the recipient runs this code."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 9,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "True"
      ]
     },
     "execution_count": 9,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "plaintext = private_key.decrypt(\n",
    "    ciphertext,\n",
    "    padding.OAEP(\n",
    "        mgf=padding.MGF1(algorithm=hashes.SHA256()),\n",
    "        algorithm=hashes.SHA256(),\n",
    "        label=None\n",
    "    )\n",
    ")\n",
    "\n",
    "# for debugging purposes, we can verify that this decrypts the original message\n",
    "plaintext == message"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Assuming the decryption was successful, we can output the deciphered message:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 8,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "b\"In spite of all their friends could say, on a winter's morn, on a stormy day, in a Sieve they went to sea!\""
      ]
     },
     "execution_count": 8,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "plaintext"
   ]
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.8.5"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 4
}