Class Keychain

keychain.py:13–148

# This class implements the packets encryption keychain. It loads and
# saves keys from/to disk, and implements encryption and decryption.
class Keychain:
    def __init__(self,keychain_dir="keys"):
        try: os.mkdir(keychain_dir)
        except: pass
        self.keychain_dir = keychain_dir
        self.load_keys()

    # Load keys in memory.
    def load_keys(self):
        self.keys = {}  # Map "key name" -> SHA256(key)
        for key_name in os.listdir(self.keychain_dir):
            try:
                f = open(self.keychain_dir+"/"+key_name,'rb')
                key = f.read()
                f.close()
                self.keys[key_name] = self.sha16(key)
            except: pass

    # Return all the available key names
    def list_keys(self):
        return os.listdir(self.keychain_dir)

    # Delete the specified key
    def del_key(self,key_name):
        try: os.unlink(self.keychain_dir+"/"+key_name)
        except: pass
        del self.keys[key_name]

    # Add a new key into the keychain, overwriting an old one
    # with the same name if any.
    def add_key(self,key_name,key):
        f = open(self.keychain_dir+"/"+key_name,'wb')
        f.write(key)
        f.close()
        self.load_keys()

    # Return True if the key exists.
    def has_key(self,key_name):
        return self.keys.get(key_name) != None

    # Given a key, derive two keys, one for AES and the other
    # for the HMAC.
    def derive_keys(self,key):
        return HMAC_SHA256(key,"AES14159265358979323846")[:16], \
               HMAC_SHA256(key,"MAC26433832795028841971")

    # Return the SHA256 digest truncated to 16 bytes
    def sha16(self,data):
        return hashlib.sha256(data).digest()[:16]

    # This function expects an already encoded data packet, and
    # return its encrypted version.
    def encrypt(self,packet,key_name):
        key = self.keys.get(key_name)
        if key == None:
            raise Exception("No key with the specified name: "+str(key_name))

        # Derive the encryption and HMAC keys.