# Encryption: Protecting Data Through Cryptography

Original Message: "Hello, this is a secret message"

Algorithm: AES-256
Key: "my-secret-encryption-key-12345"

Encrypted Output: "8f3a9c7e2d1b5a4f9e3c7d2a1b8f4e6c..."

Decrypted Output: "Hello, this is a secret message"

┌─────────────┐
│   Sender    │
└──────┬──────┘
       │
       ├─1─> Generate random AES key
       │
       ├─2─> Encrypt message with AES key (fast)
       │     Message: "Secret data..."
       │     Result: [Encrypted Data]
       │
       ├─3─> Encrypt AES key with recipient's RSA public key
       │     AES Key: "random-key-123"
       │     Result: [Encrypted Key]
       │
       └─4─> Send both [Encrypted Data] + [Encrypted Key]
                          │
                          ▼
                   ┌──────────────┐
                   │  Recipient   │
                   └──────┬───────┘
                          │
                          ├─5─> Decrypt AES key with RSA private key
                          │     Result: "random-key-123"
                          │
                          └─6─> Decrypt data with AES key
                                Result: "Secret data..."

# CBC Mode
cipher = AES.new(key, AES.MODE_CBC)
ciphertext = cipher.encrypt(pad(plaintext, AES.block_size))
# Must store cipher.iv for decryption!

# GCM Mode (Authenticated Encryption)
cipher = AES.new(key, AES.MODE_GCM)
ciphertext, tag = cipher.encrypt_and_digest(plaintext)
# Tag verifies data hasn't been tampered with

Original Image → ECB Encryption → Pattern Still Visible! ❌

# CTR Mode
cipher = AES.new(key, AES.MODE_CTR)
ciphertext = cipher.encrypt(plaintext)

import os
from base64 import b64decode

# ✅ Load from environment
key = b64decode(os.environ['ENCRYPTION_KEY'])

# Set in environment
export ENCRYPTION_KEY="base64_encoded_key_here"

# ✅ Use AWS KMS
import boto3

kms = boto3.client('kms')
response = kms.decrypt(CiphertextBlob=encrypted_key)
key = response['Plaintext']

# ✅ Use Azure Key Vault
from azure.keyvault.secrets import SecretClient

client = SecretClient(vault_url=vault_url, credential=credential)
key = client.get_secret("encryption-key").value

# ✅ Use HSM for high-security applications
from pkcs11 import Session

# Keys never leave the HSM hardware
session = Session(...)
key = session.get_key(...)
encrypted = key.encrypt(data)

import sqlite3
from Crypto.Cipher import AES
from Crypto.Random import get_random_bytes
import json

class EncryptedDatabase:
    def __init__(self, db_path, master_key):
        self.conn = sqlite3.connect(db_path)
        self.master_key = master_key

    def store_encrypted(self, table, data):
        """Store encrypted data"""
        # Generate unique key for this record
        key = get_random_bytes(32)

        # Encrypt data
        cipher = AES.new(key, AES.MODE_GCM)
        json_data = json.dumps(data).encode()
        ciphertext, tag = cipher.encrypt_and_digest(json_data)

        # Encrypt the key with master key
        master_cipher = AES.new(self.master_key, AES.MODE_GCM)
        encrypted_key, key_tag = master_cipher.encrypt_and_digest(key)

        # Store in database
        self.conn.execute(
            f"INSERT INTO {table} (data, key, nonce, tag, key_nonce, key_tag) VALUES (?, ?, ?, ?, ?, ?)",
            (ciphertext, encrypted_key, cipher.nonce, tag, master_cipher.nonce, key_tag)
        )
        self.conn.commit()

    def retrieve_encrypted(self, table, record_id):
        """Retrieve and decrypt data"""
        cursor = self.conn.execute(
            f"SELECT data, key, nonce, tag, key_nonce, key_tag FROM {table} WHERE id = ?",
            (record_id,)
        )
        row = cursor.fetchone()

        # Decrypt the key
        master_cipher = AES.new(self.master_key, AES.MODE_GCM, nonce=row[4])
        key = master_cipher.decrypt_and_verify(row[1], row[5])

        # Decrypt the data
        cipher = AES.new(key, AES.MODE_GCM, nonce=row[2])
        json_data = cipher.decrypt_and_verify(row[0], row[3])

        return json.loads(json_data)

from Crypto.Cipher import AES
from Crypto.Protocol.KDF import PBKDF2
import os

def encrypt_file(input_file, output_file, password):
    """Encrypt a file with password"""
    # Derive key from password
    salt = get_random_bytes(32)
    key = PBKDF2(password, salt, dkLen=32, count=1000000)

    # Read file
    with open(input_file, 'rb') as f:
        plaintext = f.read()

    # Encrypt
    cipher = AES.new(key, AES.MODE_GCM)
    ciphertext, tag = cipher.encrypt_and_digest(plaintext)

    # Write encrypted file
    with open(output_file, 'wb') as f:
        f.write(salt)           # 32 bytes
        f.write(cipher.nonce)   # 16 bytes
        f.write(tag)            # 16 bytes
        f.write(ciphertext)     # Variable

def decrypt_file(input_file, output_file, password):
    """Decrypt a file with password"""
    # Read encrypted file
    with open(input_file, 'rb') as f:
        salt = f.read(32)
        nonce = f.read(16)
        tag = f.read(16)
        ciphertext = f.read()

    # Derive key from password
    key = PBKDF2(password, salt, dkLen=32, count=1000000)

    # Decrypt
    cipher = AES.new(key, AES.MODE_GCM, nonce=nonce)
    plaintext = cipher.decrypt_and_verify(ciphertext, tag)

    # Write decrypted file
    with open(output_file, 'wb') as f:
        f.write(plaintext)

# Usage
encrypt_file('secret.pdf', 'secret.pdf.enc', 'strong-password-123')
decrypt_file('secret.pdf.enc', 'secret.pdf', 'strong-password-123')

# Flask with HTTPS
from flask import Flask

app = Flask(__name__)

@app.route('/api/data')
def get_data():
    return {'secret': 'data'}

if __name__ == '__main__':
    # Use SSL context
    app.run(
        ssl_context=('cert.pem', 'key.pem'),
        host='0.0.0.0',
        port=443
    )

// Node.js with HTTPS
const https = require('https');
const fs = require('fs');
const express = require('express');

const app = express();

const options = {
  key: fs.readFileSync('key.pem'),
  cert: fs.readFileSync('cert.pem')
};

https.createServer(options, app).listen(443);

class SecureChannel:
    """End-to-end encrypted communication"""

    def __init__(self):
        # Each party generates key pair
        self.private_key = RSA.generate(2048)
        self.public_key = self.private_key.publickey()

    def get_public_key(self):
        """Share public key with other party"""
        return self.public_key.export_key()

    def encrypt_message(self, message, recipient_public_key_pem):
        """Encrypt message for recipient"""
        recipient_public_key = RSA.import_key(recipient_public_key_pem)

        # Generate session key
        session_key = get_random_bytes(32)

        # Encrypt message with session key
        cipher = AES.new(session_key, AES.MODE_GCM)
        ciphertext, tag = cipher.encrypt_and_digest(message.encode())

        # Encrypt session key with recipient's public key
        rsa_cipher = PKCS1_OAEP.new(recipient_public_key)
        encrypted_session_key = rsa_cipher.encrypt(session_key)

        return {
            'encrypted_key': encrypted_session_key,
            'nonce': cipher.nonce,
            'tag': tag,
            'ciphertext': ciphertext
        }

    def decrypt_message(self, encrypted_data):
        """Decrypt received message"""
        # Decrypt session key with private key
        rsa_cipher = PKCS1_OAEP.new(self.private_key)
        session_key = rsa_cipher.decrypt(encrypted_data['encrypted_key'])

        # Decrypt message with session key
        cipher = AES.new(session_key, AES.MODE_GCM, nonce=encrypted_data['nonce'])
        plaintext = cipher.decrypt_and_verify(
            encrypted_data['ciphertext'],
            encrypted_data['tag']
        )

        return plaintext.decode()

# Usage
alice = SecureChannel()
bob = SecureChannel()

# Alice encrypts message for Bob
encrypted = alice.encrypt_message("Hi Bob!", bob.get_public_key())

# Bob decrypts Alice's message
message = bob.decrypt_message(encrypted)
print(message)  # "Hi Bob!"