Function encrypt_env

vmm/src/vmm-cli.py:260–319

Encrypts environment variables using a one-time X25519 key exchange and AES-GCM. This function does the following: 1. Converts the given environment variables to JSON bytes. 2. Removes a leading "0x" from the provided public key (if present) and converts it to bytes. 3. Genera

(envs, hex_public_key: str)

def encrypt_env(envs, hex_public_key: str) -> str:
    """Encrypts environment variables using a one-time X25519 key exchange and AES-GCM.

    This function does the following:
      1. Converts the given environment variables to JSON bytes.
      2. Removes a leading "0x" from the provided public key (if present) and converts it to bytes.
      3. Generates an ephemeral X25519 key pair.
      4. Computes a shared secret using this ephemeral private key and the remote public key.
      5. Uses the shared key directly as the 32-byte key for AES-GCM.
      6. Encrypts the JSON string with AES-GCM using a randomly generated IV.
      7. Concatenates the ephemeral public key, IV, and ciphertext and returns it as a hex string.

    Args:
        envs: The environment variables to encrypt. This can be any JSON-serializable data structure.
        hex_public_key: The remote encryption public key in hexadecimal format.

    Returns:
        A hexadecimal string that is the concatenation of:
          (ephemeral public key || IV || ciphertext).

    """
    if not CRYPTO_AVAILABLE:
        raise ImportError(
            "Cryptography libraries not available. Please install them with:\n"
            "pip install cryptography eth-keys eth-utils"
        )

    # Serialize the environment variables to JSON and encode to bytes.
    envs_json = json.dumps({"env": envs}).encode("utf-8")

    # Remove the "0x" prefix if present.
    if hex_public_key.startswith("0x"):
        hex_public_key = hex_public_key[2:]

    # Convert the hexadecimal public key to bytes.
    remote_pubkey_bytes = bytes.fromhex(hex_public_key)

    # Generate an ephemeral X25519 key pair.
    ephemeral_private_key = x25519.X25519PrivateKey.generate()
    ephemeral_public_key = ephemeral_private_key.public_key()

    # Compute the shared secret using X25519.
    peer_public_key = x25519.X25519PublicKey.from_public_bytes(remote_pubkey_bytes)
    shared = ephemeral_private_key.exchange(peer_public_key)

    # Use the shared secret as a key for AES-GCM encryption (AES-256 needs 32 bytes).
    aesgcm = AESGCM(shared)
    iv = os.urandom(12)  # 12-byte nonce (IV) for AES-GCM.
    ciphertext = aesgcm.encrypt(iv, envs_json, None)

    # Serialize the ephemeral public key to raw bytes.
    ephemeral_public_bytes = ephemeral_public_key.public_bytes(
        encoding=serialization.Encoding.Raw, format=serialization.PublicFormat.Raw
    )

    # Combine ephemeral public key, IV, and ciphertext.
    result = ephemeral_public_bytes + iv + ciphertext