Teknium
26 lines
894 B
Python
26 lines
894 B
Python
"""AES-256-GCM utilities for QQBot scan-to-configure credential decryption."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import base64
|
|
import os
|
|
|
|
|
|
def generate_bind_key() -> str:
|
|
"""Generate a random 256-bit AES key as base64.
|
|
|
|
Passed to ``create_bind_task`` so the server encrypts the bot's
|
|
*client_secret*; only this CLI holds the key, so the secret never travels
|
|
in plaintext.
|
|
"""
|
|
return base64.b64encode(os.urandom(32)).decode()
|
|
|
|
|
|
def decrypt_secret(encrypted_base64: str, key_base64: str) -> str:
|
|
"""Decrypt ``bot_encrypt_secret`` (base64 of ``IV(12) ‖ ciphertext ‖ tag(16)``) to a UTF-8 string."""
|
|
from cryptography.hazmat.primitives.ciphers.aead import AESGCM
|
|
|
|
raw = base64.b64decode(encrypted_base64)
|
|
# AESGCM expects ciphertext + tag concatenated.
|
|
return AESGCM(base64.b64decode(key_base64)).decrypt(raw[:12], raw[12:], None).decode("utf-8")
|