FixTheVuln

from cryptography.hazmat.primitives.ciphers.aead import AESGCM
import os

def encrypt_aes_gcm(plaintext: bytes, key: bytes) -> tuple[bytes, bytes]:
    """Encrypt with AES-256-GCM. Returns (nonce, ciphertext)."""
    nonce = os.urandom(12)  # 96-bit nonce for GCM
    aesgcm = AESGCM(key)
    ciphertext = aesgcm.encrypt(nonce, plaintext, associated_data=None)
    return nonce, ciphertext

def decrypt_aes_gcm(nonce: bytes, ciphertext: bytes, key: bytes) -> bytes:
    """Decrypt AES-256-GCM ciphertext."""
    aesgcm = AESGCM(key)
    return aesgcm.decrypt(nonce, ciphertext, associated_data=None)

# Usage
key = os.urandom(32)  # 256-bit key
message = b"Secret message"

nonce, encrypted = encrypt_aes_gcm(message, key)
decrypted = decrypt_aes_gcm(nonce, encrypted, key)

const crypto = require('crypto');

function encryptAesGcm(plaintext, key) {
  const iv = crypto.randomBytes(12); // 96-bit IV for GCM
  const cipher = crypto.createCipheriv('aes-256-gcm', key, iv);

  let encrypted = cipher.update(plaintext, 'utf8', 'hex');
  encrypted += cipher.final('hex');
  const authTag = cipher.getAuthTag();

  return { iv: iv.toString('hex'), encrypted, authTag: authTag.toString('hex') };
}

function decryptAesGcm(encrypted, key, iv, authTag) {
  const decipher = crypto.createDecipheriv('aes-256-gcm', key, Buffer.from(iv, 'hex'));
  decipher.setAuthTag(Buffer.from(authTag, 'hex'));

  let decrypted = decipher.update(encrypted, 'hex', 'utf8');
  decrypted += decipher.final('utf8');
  return decrypted;
}

// Usage
const key = crypto.randomBytes(32); // 256-bit key

from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
from cryptography.hazmat.primitives import serialization

# Generate key pair
private_key = Ed25519PrivateKey.generate()
public_key = private_key.public_key()

# Sign message
message = b"Important document"
signature = private_key.sign(message)

# Verify signature
try:
    public_key.verify(signature, message)
    print("Signature valid")
except InvalidSignature:
    print("Signature invalid")

# Export keys
private_pem = private_key.private_bytes(
    encoding=serialization.Encoding.PEM,
    format=serialization.PrivateFormat.PKCS8,
    encryption_algorithm=serialization.NoEncryption()
)

# Python - Secure random key generation
import secrets
import os

# Generate random bytes (use for symmetric keys)
key_256 = secrets.token_bytes(32)  # 256-bit key
key_128 = os.urandom(16)           # 128-bit key

# Generate random tokens (for API keys, session tokens)
api_key = secrets.token_urlsafe(32)  # URL-safe base64
hex_token = secrets.token_hex(32)    # Hex string

# NEVER use random module for cryptography
import random  # NOT cryptographically secure!

# Envelope encryption with AWS KMS
import boto3

kms = boto3.client('kms')

# Generate data key (DEK)
response = kms.generate_data_key(
    KeyId='alias/my-master-key',
    KeySpec='AES_256'
)

plaintext_key = response['Plaintext']      # Use to encrypt data
encrypted_key = response['CiphertextBlob'] # Store with encrypted data

# To decrypt: first decrypt the DEK with KMS, then decrypt data
decrypted_key = kms.decrypt(
    CiphertextBlob=encrypted_key
)['Plaintext']

# TLS 1.3 (automatic - these are the only options)
TLS_AES_256_GCM_SHA384
TLS_CHACHA20_POLY1305_SHA256
TLS_AES_128_GCM_SHA256

# TLS 1.2 (if 1.3 not available)
ECDHE-ECDSA-AES256-GCM-SHA384
ECDHE-RSA-AES256-GCM-SHA384
ECDHE-ECDSA-CHACHA20-POLY1305
ECDHE-RSA-CHACHA20-POLY1305
ECDHE-ECDSA-AES128-GCM-SHA256
ECDHE-RSA-AES128-GCM-SHA256

# Nginx configuration
ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers off;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;