devolutions-crypto 0.10.0

An abstraction layer for the cryptography used by Devolutions
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59

import unittest
import devolutions_crypto


class TestDeriveEncrypt(unittest.TestCase):
    def test_roundtrip_with_password(self):
        plaintext = b"hello world"
        password = b"mypassword"

        blob = devolutions_crypto.derive_encrypt_with_password(plaintext, password)

        self.assertEqual(devolutions_crypto.derive_decrypt_with_password(blob, password), plaintext)

    def test_blob_differs_from_plaintext(self):
        plaintext = b"sensitive data"
        password = b"password123"

        blob = devolutions_crypto.derive_encrypt_with_password(plaintext, password)

        self.assertNotEqual(blob, plaintext)

    def test_each_encryption_uses_random_salt(self):
        plaintext = b"same data"
        password = b"same password"

        blob1 = devolutions_crypto.derive_encrypt_with_password(plaintext, password)
        blob2 = devolutions_crypto.derive_encrypt_with_password(plaintext, password)

        self.assertNotEqual(blob1, blob2)

    def test_wrong_password_fails(self):
        blob = devolutions_crypto.derive_encrypt_with_password(b"secret", b"correct-password")

        with self.assertRaises(devolutions_crypto.DevolutionsCryptoError):
            devolutions_crypto.derive_decrypt_with_password(blob, b"wrong-password")

    def test_roundtrip_with_aad(self):
        plaintext = b"authenticated data"
        password = b"mypassword"
        aad = b"context"

        blob = devolutions_crypto.derive_encrypt_with_password_and_aad(plaintext, password, aad)

        self.assertEqual(
            devolutions_crypto.derive_decrypt_with_password_and_aad(blob, password, aad),
            plaintext,
        )

        # Wrong aad fails to decrypt.
        with self.assertRaises(devolutions_crypto.DevolutionsCryptoError):
            devolutions_crypto.derive_decrypt_with_password_and_aad(blob, password, b"wrong-context")

        # An aad-encrypted blob cannot be decrypted without the aad.
        with self.assertRaises(devolutions_crypto.DevolutionsCryptoError):
            devolutions_crypto.derive_decrypt_with_password(blob, password)


if __name__ == "__main__":
    unittest.main()