1# Copyright 2021 Google LLC 2# 3# Licensed under the Apache License, Version 2.0 (the "License"); 4# you may not use this file except in compliance with the License. 5# You may obtain a copy of the License at 6# 7# http://www.apache.org/licenses/LICENSE-2.0 8# 9# Unless required by applicable law or agreed to in writing, software 10# distributed under the License is distributed on an "AS-IS" BASIS, 11# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 12# See the License for the specific language governing permissions and 13# limitations under the License. 14# [START hybrid-encryption-example] 15"""A command-line utility for encrypting a file using hybrid encryption. 16 17It loads cleartext keys from disk - this is not recommended! 18""" 19 20from absl import app 21from absl import flags 22from absl import logging 23import tink 24from tink import cleartext_keyset_handle 25from tink import hybrid 26 27 28FLAGS = flags.FLAGS 29 30flags.DEFINE_enum('mode', None, ['encrypt', 'decrypt'], 31 'The operation to perform.') 32flags.DEFINE_string('keyset_path', None, 33 'Path to the keyset used for encryption.') 34flags.DEFINE_string('input_path', None, 'Path to the input file.') 35flags.DEFINE_string('output_path', None, 'Path to the output file.') 36flags.DEFINE_string('context_info', None, 37 'Context info used for encryption.') 38 39 40def main(argv): 41 del argv # Unused 42 43 context_info = b'' if not FLAGS.context_info else bytes( 44 FLAGS.context_info, 'utf-8') 45 46 # Initialise Tink 47 hybrid.register() 48 49 # Read the keyset into a keyset_handle 50 with open(FLAGS.keyset_path, 'rt') as keyset_file: 51 try: 52 text = keyset_file.read() 53 keyset_handle = cleartext_keyset_handle.read(tink.JsonKeysetReader(text)) 54 except tink.TinkError as e: 55 logging.exception('Error reading key: %s', e) 56 return 1 57 58 with open(FLAGS.input_path, 'rb') as input_file: 59 data = input_file.read() 60 61 if FLAGS.mode == 'encrypt': 62 # Get the primitive 63 try: 64 primitive = keyset_handle.primitive(hybrid.HybridEncrypt) 65 except tink.TinkError as e: 66 logging.exception( 67 'Error creating hybrid encrypt primitive from keyset: %s', e) 68 return 1 69 # Encrypt data 70 with open(FLAGS.output_path, 'wb') as output_file: 71 ciphertext = primitive.encrypt(data, context_info) 72 output_file.write(ciphertext) 73 74 if FLAGS.mode == 'decrypt': 75 # Get the primitive 76 try: 77 primitive = keyset_handle.primitive(hybrid.HybridDecrypt) 78 except tink.TinkError as e: 79 logging.exception( 80 'Error creating hybrid encrypt primitive from keyset: %s', e) 81 return 1 82 # Decrypt data 83 with open(FLAGS.output_path, 'wb') as output_file: 84 plaintext = primitive.decrypt(data, context_info) 85 output_file.write(plaintext) 86 87 88if __name__ == '__main__': 89 flags.mark_flags_as_required( 90 ['mode', 'keyset_path', 'input_path', 'output_path']) 91 app.run(main) 92# [END hybrid-encryption-example] 93