# diffie_hellman_whatsapp.py  ← EXACTLY how WhatsApp establishes session key
from cryptography.hazmat.primitives.asymmetric import x25519
from cryptography.hazmat.primitives import serialization
import os

# Alice generates her key pair
alice_private = x25519.X25519PrivateKey.generate()
alice_public = alice_private.public_key()

# Bob generates his key pair
bob_private = x25519.X25519PrivateKey.generate()
bob_public = bob_private.public_key()

# Exchange public keys over insecure channel (like internet)
print("Alice sends →", alice_public.public_bytes(
    encoding=serialization.Encoding.Raw,
    format=serialization.PublicFormat.Raw
).hex()[:20] + "...")

print("Bob sends   →", bob_public.public_bytes(
    encoding=serialization.Encoding.Raw,
    format=serialization.PublicFormat.Raw
).hex()[:20] + "...")

# Both compute SAME shared secret!
shared_alice = alice_private.exchange(bob_public)
shared_bob = bob_private.exchange(alice_public)

print("\nShared Secret (Alice):", shared_alice.hex())
print("Shared Secret (Bob)  :", shared_bob.hex())
print("Match?               :", shared_alice == shared_bob)  # Always True

# Now derive AES key (like Signal Protocol does)
from cryptography.hazmat.primitives.kdf.hkdf import HKDF
from cryptography.hazmat.primitives import hashes
hkdf = HKDF(algorithm=hashes.SHA256(), length=32, salt=None, info=b'handshake data',)
aes_key = hkdf.derive(shared_alice)
print("\nFinal AES-256 Key   :", aes_key.hex())

# kerberos_simulation.py  ← Mini version of real Kerberos v5
import time
from cryptography.fernet import Fernet

# TGS = Ticket Granting Server (like Active Directory)
TGS_KEY = Fernet.generate_key()
CLIENT_KEY = b'gAAAAABn...'  # Shared with client (like your password hash)

def encrypt(data, key):
    return Fernet(key).encrypt(data.encode())

def decrypt(token, key):
    return Fernet(key).decrypt(token).decode()

# Step 1: Client → AS (Authentication Server)
client_id = "alice@MYUNI.AC.IN"
timestamp = str(int(time.time()))

# AS gives TGT (Ticket Granting Ticket)
tgt = encrypt(f"{client_id}|{timestamp}|TGS_SESSION_KEY", CLIENT_KEY)

# Step 2: Client → TGS (wants access to email server)
authenticator = encrypt(f"{client_id}|{timestamp}", CLIENT_KEY)
service_ticket = encrypt("alice@MYUNI.AC.IN|email.myuni.ac.in|2025-12-31", TGS_KEY)

print("TGT issued to Alice")
print("Service Ticket for email server issued")

# Step 3: Client → Email Server (final
print("Alice successfully logs into email without password again!")

# pgp_real_email.py  ← Full working PGP-style encryption & signing
from cryptography.hazmat.primitives.asymmetric import rsa, padding
from cryptography.hazmat.primitives import hashes, serialization
from cryptography.fernet import Fernet
import base64

# Generate keys (like you do in GnuPG/Kleopatra)
private_key = rsa.generate_private_key(65537, 2048)
public_key = private_key.public_key()

# Export public key to share (like keyserver)
pem_public = public_key.public_bytes(
    encoding=serialization.Encoding.PEM,
    format=serialization.PublicFormat.SubjectPublicKeyInfo
)
print("Share this public key:\n", pem_public.decode())

# Real email from activist
message = "The government is spying on citizens. Meet me at 10 PM."

# Step 1: Generate random AES key
session_key = Fernet.generate_key()
fernet = Fernet(session_key)

# Step 2: Encrypt message with AES
ciphertext = fernet.encrypt(message.encode())

# Step 3: Encrypt AES key with receiver's RSA public key
encrypted_session_key = public_key.encrypt(
    session_key,
    padding.OAEP(mgf=padding.MGF1(algorithm=hashes.SHA256()),
                 algorithm=hashes.SHA256(), label=None)
)

# Final PGP packet
pgp_message = base64.b64encode(encrypted_session_key + b"|||" + ciphertext)
print("\nSend this PGP message:")
print(pgp_message.decode())

# Decryption (receiver side)
def decrypt_pgp(pgp_msg):
    data = base64.b64decode(pgp_msg)
    enc_key, ciphertext = data.split(b"|||")
    session_key = private_key.decrypt(
        enc_key,
        padding.OAEP(mgf=padding.MGF1(algorithm=hashes.SHA256()),
                     algorithm=hashes.SHA256(), label=None)
    )
    return Fernet(session_key).decrypt(ciphertext).decode()

print("\nDecrypted:", decrypt_pgp(pgp_message))

# smime_corporate_email.py  ← Used by Indian Govt, Banks
from cryptography + email.mime
from email.mime.text import MIMEText
from email.mime.multipart import MIMEMultipart
import smime  # pip install python-smime

# In real life: Your DSC token (USB) contains private key certificate
# This is how NIC, Income Tax, MCA21 portal sends secure email

msg = MIMEMultipart("encrypted")
msg["Subject"] = "Confidential - Salary Slip"
msg["From"] = "hr@company.com"
msg["To"] = "employee@company.com"

# Attach encrypted content using employee's public certificate
# (In reality, Outlook + DSC token does this automatically)

print("S/MIME encrypted email ready to send via Outlook/Thunderbird")

Unit4_Key_Management_Lab/
│
├── 01_diffie_hellman_whatsapp_real.py
├── 02_kerberos_simulation_college_login.py
├── 03_pgp_full_encrypt_decrypt.py
├── 04_smime_corporate_email_demo.py
├── 05_x509_certificate_generate.py
├── alice_public_key.asc
├── encrypted_message.pgp
└── Lab_Report.pdf (screenshots + flow diagrams)