Package: opsep
OpSep Python Client LibraryIn order to use this client library, you will need to be running anOpSep Serverto protect your RSA private key.For simplicty, we'll use an OpSep server hosted by SecondGuard athttps://test.secondguard.com/, along with its corresponding RSA public key.
Note that this isnotsuitable for production data, the RSA private key has been published!QuickstartInstall fromPyPI:$pip3install--upgradeopsepEncrypt using the testing API token and testing RSA pubkey (no account needed):fromopsepimportopsep_hybrid_encrypt,opsep_hybrid_decrypt# Testing RSA PubKey and OpSep API Server URL (normally saved in your app's config)RSA_PUBKEY='-----BEGIN PUBLIC KEY-----\nMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA7q4R3soRD2CrjL13OK6Y\nSBG8wpjP5sbfkL0QhpJMH87grlR2SS3CUnbYCOONzQiJ3OuKAViy/lMw1KsmG9Nn\nhAot2acg1iNyZRY33LR2jwmfFF+2iRp0itPQeOHY6GS8m3WLCMtC/kWUq0Bl5g1P\nYa9JXwSkTTRJunNH0TPk8uqwFeVhpT336M1H6ed105L8a8W3mpSwlwePron7pLf7\nwD32m9RT0nNdnHBDQCsUKS/Gdp+saLYWTgj0rpnQCe8f1p3g36Gm0gTzr3X0Adow\n8gIPfxO4HU/0cdL+Pw4mpcsWJ4531taRLLGb+a2la2zAUteYcS+8d4Nb8Omkbz39\nPylvKP6R1kHElqlF3BnwUp0AdcAvOLdeX8kYUlbKE8xwjHm/KwwleKlcAZDam7hC\nRw72JUQiod0E7My+SiZ3Ij5zKnxZXmAF5BX8T+YSqSzR4Qdp2QU9L9GgAZo/HPBN\nwME9v8usjEzrEItSSg3Nn10+J+ygsCqjrCT8CnSvD8wEyDSdO/Jly9DnWJ6B2HJE\nOc4wxWGFTCE0wiQOwC3IPNxFhuWun6/4tsEQcDs5XHaBXIHry5WCiVkjwa2pc95x\niXcfoQWr1A/jLe/MrZyN4yrgDK9mmQxxNzVfLj8S9NPjJMv+K7BKvtOmvoqsf13K\n6hYJGkAdR0d99DNFlllRm7cCAwEAAQ==\n-----END PUBLIC KEY-----\n'OPSEP_URL='https://test.secondguard.com/'your_secret=b"attack at dawn!"# Encrypt locally (symmetrically and asymmetrically) and save the results to your DB:local_ciphertext,opsep_recovery_instructions=opsep_hybrid_encrypt(to_encrypt=your_secret,rsa_pubkey=RSA_PUBKEY,)# Asymmetrically decrypt opsep_recovery_instructions (via OpSep's rate-limited API) and use it to symmetrically decrypt local_ciphertext:secret_recovered,rate_limit_dict=opsep_hybrid_decrypt(local_ciphertext_to_decrypt=local_ciphertext,opsep_recovery_instructions=opsep_recovery_instructions,opsep_url=OPSEP_URL,)ifyour_secret==secret_recovered:print("Your secret was recovered:%s"%secret_recovered)Seetest_client.pyto see how the protocol works.Audit LogFor audit logging of decryption requests, we recommend storing the sha256 hash digest of theopsep_recovery_instructions(base64 decoded) in an indexed column of your database. This makes it easy to see which records have been decrypted if your servers are breached. See theopsep_hybrid_encrypt_with_auditlog()method with test coverage intest_client.py.Under the HoodPull requests with test coverage are welcome!Check out the code:$gitcheckoutgit@github.com:opsep/opsep-python.git&&cdopsep-python.gitCreate & activate a virtual environment, install dependencies & this library$python3-mvirtualenv.venv3&&source.venv3/bin/activate&&pip3install-rrequirements.txt&&pip3install--editable.Run tests (requires having previously intalled an--editablelocal version of this repo):$ pytest -v
====================================== test session starts ======================================
platform darwin -- Python 3.7.8, pytest-5.4.3, py-1.9.0, pluggy-0.13.1 -- /Users/mflaxman/workspace/secondguard-python/.venv3/bin/python
cachedir: .pytest_cache
rootdir: /Users/mflaxman/workspace/opsep-python
collected 3 items                                                                               

tests/test_client.py::test_opsep_hybrid_encryption_and_decryption PASSED                  [ 33%]
tests/test_pyca.py::test_symmetric PASSED                                                 [ 66%]
tests/test_pyca.py::test_asymmetric PASSED                                                [100%]To updaterequirements.txtchangerequirements.inand then run (requirespip-tools):$pip-compilerequirements.inHow theseinsecuretesting RSA keys were created:$opensslgenrsa-outinsecureprivkey.pem4096&&opensslrsa-ininsecureprivkey.pem-pubout-outinsecurepubkey.crt