def _decrypt(self, enc_data: str, password: str) -> str: """Decrypt AES-256-CBC encrypted data.""" raw = base64.b64decode(enc_data) salt = raw[:SALT_SIZE] iv = raw[SALT_SIZE:SALT_SIZE + IV_SIZE] ciphertext = raw[SALT_SIZE + IV_SIZE:] key = self._derive_key(password, salt) cipher = Cipher(algorithms.AES(key), modes.CBC(iv), backend=default_backend()) decryptor = cipher.decryptor() decrypted_padded = decryptor.update(ciphertext) + decryptor.finalize() # Remove padding return decrypted_padded.rstrip(b"\x00").decode()
def save(self): """Save data to encrypted file.""" if not self.master_password: print("❌ Master password not set.") return json_str = json.dumps(self.data, indent=2) enc_content = self._encrypt(json_str, self.master_password) with open(STORAGE_FILE, "w") as f: f.write(enc_content) print("✅ Data saved securely.") breezip password
### **5. Security Notes**
def _derive_key(self, password: str, salt: bytes) -> bytes: """Derive a 32-byte AES key from master password using PBKDF2.""" kdf = PBKDF2( algorithm=hashes.SHA256(), length=32, salt=salt, iterations=ITERATIONS, backend=default_backend() ) return kdf.derive(password.encode()) def _decrypt(self, enc_data: str, password: str) -> str:
def _encrypt(self, plaintext: str, password: str) -> str: """Encrypt data with AES-256-CBC.""" salt = os.urandom(SALT_SIZE) iv = os.urandom(IV_SIZE) key = self._derive_key(password, salt) cipher = Cipher(algorithms.AES(key), modes.CBC(iv), backend=default_backend()) encryptor = cipher.encryptor() # Pad plaintext to multiple of 16 bytes padded = plaintext.encode() + b"\x00" * (16 - len(plaintext) % 16) ciphertext = encryptor.update(padded) + encryptor.finalize() # Store: salt + iv + ciphertext combined = salt + iv + ciphertext return base64.b64encode(combined).decode() password: str) ->