Stream cypher (encrypt) with digital envelope in Python

Generating. storing and keeping inventory of hundreds of terabyte large database backups is a challenge by itself which we do on daily basis. It’s even a bigger challenge to store them encrypted which is the requirement sometimes. The backup data is being pushed through a socket generated by percona-xtrabackup. On the receiving end this is stored on SAN devices. Because of the size of the backups it’s unfeasible to reread the binary and encrypt them after the full backup data arrived. We had to come up with a solution which can do the whole thing in the stream time while minimising the amount of unnecessary disk reads and writes…

Digital envelope

The idea of digital envelope is not a new concept. Actually it’s very simple if you understand it. It generates a random symmetric key which is being used to do stream cypher and encrypt the data with a symmetric key block cypher (like ARC4). During this operation your envelope is “open”. When it’s finished the public key of the asymmetric key pair you encode your passphrase and store it with the encrypted data.

Only in the possession of the private key can the envelope be opened again. The decryption process is straightforwards from there. You retrieve the passphrase by decrypting the encrypted passphrase and use that to decipher the data with the chosen block cypher (ARC4 in the example)


I published the basic implementation on my github:

Example usage (writing/encryption):

Example usage (read/decrypt):

You might like these too

5 things to love about python Syntax Takes a bit of time to get used to it but after a certain point it just becomes natural. Like english. No heavy-weight operators or complicate...
Priority queue in Redis aka ZPOP Redis list is great to use it as a processing queue. So great that it sort of became the standard and many people using that instead of dedicated queu...
Solr python interface – Sunburnt fork I forked tow (Toby White, gratitude for his great work) sunburnt repository from github because I needed range facet funcionality and the workaround (...

About charlesnagy

I'm out of many things mostly automation expert, database specialist, system engineer and software architect with passion towards data, searching it, analyze it, learn from it. I learn by experimenting and this blog is a result of these experiments and some other random thought I have time to time.
Bookmark the permalink.