Cryptographie L'art du secret

from cryptography.hazmat.primitives.asymmetric import rsa, ec, padding
from cryptography.hazmat.primitives import hashes, serialization

# ── Génération d'une paire RSA-2048 ──
private_key = rsa.generate_private_key(
    public_exponent=65537,
    key_size=2048,
)
public_key = private_key.public_key()

# Chiffrement OAEP (RSA optimal asymmetric encryption padding)
ciphertext = public_key.encrypt(
    b"Message confidentiel",
    padding.OAEP(
        mgf=padding.MGF1(algorithm=hashes.SHA256()),
        algorithm=hashes.SHA256(),
        label=None,
    )
)

# ── ECDH avec Curve25519 ──
alice_priv = ec.generate_private_key(ec.SECP256R1())
bob_priv   = ec.generate_private_key(ec.SECP256R1())

shared_secret = alice_priv.exchange(
    ec.ECDH(), bob_priv.public_key()
)
print(f"Secret partagé : {shared_secret.hex()[:32]}...")

from cryptography.hazmat.primitives.asymmetric import ec
from cryptography.hazmat.primitives import hashes
import hmac, hashlib

# ── Signature ECDSA P-256 ──
private_key = ec.generate_private_key(ec.SECP256R1())
message = b"Document a signer : rapport_q4_2024.pdf"

signature = private_key.sign(message, ec.ECDSA(hashes.SHA256()))

# Vérification (côté destinataire)
try:
    private_key.public_key().verify(signature, message, ec.ECDSA(hashes.SHA256()))
    print("✓ Signature valide")
except Exception:
    print("✗ Signature invalide !")

# ── HMAC-SHA256 ──
secret_key = b"cle_secrete_partagee"
mac = hmac.new(secret_key, message, hashlib.sha256).hexdigest()
print(f"HMAC-SHA256 : {mac}")

# Générer une paire RSA-4096
openssl genrsa -out private.pem 4096
openssl rsa -in private.pem -pubout -out public.pem

# Générer une clé EC (P-256)
openssl ecparam -name prime256v1 -genkey -noout -out ec-key.pem

# Créer un CSR (Certificate Signing Request)
openssl req -new -key private.pem -out request.csr \
  -subj "/C=FR/ST=IDF/L=Paris/O=Universite/CN=crypto.univ.fr"

# Hacher un fichier
openssl dgst -sha256 -sign private.pem -out sig.bin document.pdf
openssl dgst -sha256 -verify public.pem -signature sig.bin document.pdf

# Chiffrer un fichier AES-256-GCM
openssl enc -aes-256-cbc -pbkdf2 -in secret.txt -out secret.enc
openssl enc -d -aes-256-cbc -pbkdf2 -in secret.enc -out decrypted.txt

# Inspecter un certificat TLS distant
echo | openssl s_client -connect example.com:443 2>/dev/null \
  | openssl x509 -text -noout | grep -E "Subject:|Not After"