Stream cypher (encrypt) with digital envelope in Python

Generating. storing and keeping inventory of hundreds of terabyte large database backups is a challenge by itself which we do on daily basis. It’s even a bigger challenge to store them encrypted which is the requirement sometimes. The backup data is being pushed through a socket generated by percona-xtrabackup. On the receiving end this is stored on SAN devices. Because of the size of the backups it’s unfeasible to reread the binary and encrypt them after the full backup data arrived. We had to come up with a solution which can do the whole thing in the stream time while minimising the amount of unnecessary disk reads and writes…

Digital envelope

The idea of digital envelope is not a new concept. Actually it’s very simple if you understand it. It generates a random symmetric key which is being used to do stream cypher and encrypt the data with a symmetric key block cypher (like ARC4). During this operation your envelope is “open”. When it’s finished the public key of the asymmetric key pair you encode your passphrase and store it with the encrypted data.

Only in the possession of the private key can the envelope be opened again. The decryption process is straightforwards from there. You retrieve the passphrase by decrypting the encrypted passphrase and use that to decipher the data with the chosen block cypher (ARC4 in the example)


I published the basic implementation on my github:

Example usage (writing/encryption):

Example usage (read/decrypt):

You might like these too

Python timeit – when speed matters – S... Although there are always multiple ways to solve a single problem not always the most elegant is the best performant. Python gives a perfect tool to c...
Python error: AttributeError: __exit__ I just had a 30 minutes worth of debugging on a stupid mistake I made. I wanted to check the free space on the target server before I actually start t...
5 things to love about python Syntax Takes a bit of time to get used to it but after a certain point it just becomes natural. Like english. No heavy-weight operators or complicate...

About charlesnagy

I'm out of many things mostly automation expert, database specialist, system engineer and software architect with passion towards data, searching it, analyze it, learn from it. I learn by experimenting and this blog is a result of these experiments and some other random thought I have time to time.
Bookmark the permalink.