Stream cypher (encrypt) with digital envelope in Python

Generating. storing and keeping inventory of hundreds of terabyte large database backups is a challenge by itself which we do on daily basis. It’s even a bigger challenge to store them encrypted which is the requirement sometimes. The backup data is being pushed through a socket generated by percona-xtrabackup. On the receiving end this is stored on SAN devices. Because of the size of the backups it’s unfeasible to reread the binary and encrypt them after the full backup data arrived. We had to come up with a solution which can do the whole thing in the stream time while minimising the amount of unnecessary disk reads and writes…

Digital envelope

The idea of digital envelope is not a new concept. Actually it’s very simple if you understand it. It generates a random symmetric key which is being used to do stream cypher and encrypt the data with a symmetric key block cypher (like ARC4). During this operation your envelope is “open”. When it’s finished the public key of the asymmetric key pair you encode your passphrase and store it with the encrypted data.

Only in the possession of the private key can the envelope be opened again. The decryption process is straightforwards from there. You retrieve the passphrase by decrypting the encrypted passphrase and use that to decipher the data with the chosen block cypher (ARC4 in the example)

Implementation

I published the basic implementation on my github: https://github.com/charlesnagy/python-digitalenvelope

Example usage (writing/encryption):

Example usage (read/decrypt):

You might like these too

Dataimport handler for Sunburnt Solr python librar... Dataimport handler I had to trigger the dataimporter delta-import command from the code so I added support for this function. Example: Followin...
BitTornado library forked by me on GitHub I just forked and committed some patches to the BitTornado library on GitHub. https://github.com/charlesnagy/BitTornado Right now I only committ...
Python MySQLdb vs mysql-connector query performanc... There are a lot of python driver available for MySQL and two stand out the most. The one, traditionally everybody's choice, sort of industrial standar...

About charlesnagy

I'm out of many things mostly automation expert, database specialist, system engineer and software architect with passion towards data, searching it, analyze it, learn from it. I learn by experimenting and this blog is a result of these experiments and some other random thought I have time to time.
Bookmark the permalink.