使用 Google 公開金鑰加密客戶私密金鑰

import argparse
import base64
import os
from typing import Optional

from cryptography import x509
from cryptography.hazmat.backends import default_backend
from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.primitives.asymmetric import padding
from cryptography.hazmat.primitives.asymmetric.rsa import RSAPublicKey
import requests


GOOGLE_PUBLIC_CERT_URL = (
    "https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem"
)


def get_google_public_cert_key() -> RSAPublicKey:
    """
    Downloads the Google public certificate.

    Returns:
        RSAPublicKey object with the Google public certificate.
    """
    r = requests.get(GOOGLE_PUBLIC_CERT_URL)
    r.raise_for_status()

    # Load the certificate.
    certificate = x509.load_pem_x509_certificate(r.content, default_backend())

    # Get the certicate's public key.
    public_key = certificate.public_key()

    return public_key


def wrap_rsa_key(public_key: RSAPublicKey, private_key_bytes: bytes) -> bytes:
    """
    Use the Google public key to encrypt the customer private key.

    This means that only the Google private key is capable of decrypting
    the customer private key.

    Args:
        public_key: The public key to use for encrypting.
        private_key_bytes: The private key to be encrypted.

    Returns:
        private_key_bytes encrypted using the public_key. Encoded using
        base64.
    """
    wrapped_key = public_key.encrypt(
        private_key_bytes,
        padding.OAEP(
            mgf=padding.MGF1(algorithm=hashes.SHA1()),
            algorithm=hashes.SHA1(),
            label=None,
        ),
    )
    encoded_wrapped_key = base64.b64encode(wrapped_key)
    return encoded_wrapped_key


def main(key_file: Optional[str]) -> None:
    """
    This script will encrypt a private key with Google public key.

    Args:
        key_file: path to a file containing your private key. If not
            provided, a new key will be generated (256 bit).
    """
    # Generate a new 256-bit private key if no key is specified.
    if not key_file:
        customer_key_bytes = os.urandom(32)
    else:
        with open(key_file, "rb") as f:
            customer_key_bytes = f.read()

    google_public_key = get_google_public_cert_key()
    wrapped_rsa_key = wrap_rsa_key(google_public_key, customer_key_bytes)

    b64_key = base64.b64encode(customer_key_bytes).decode("utf-8")

    print(f"Base-64 encoded private key: {b64_key}")
    print(f"Wrapped RSA key: {wrapped_rsa_key.decode('utf-8')}")


if __name__ == "__main__":
    parser = argparse.ArgumentParser(
        description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter
    )
    parser.add_argument("--key_file", help="File containing your binary private key.")

    args = parser.parse_args()

    main(args.key_file)