1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42

import secrets
import hashlib
from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.primitives.asymmetric import rsa

class KeyEscrow:
    def __init__(self, escrow_public_key):
        self.escrow_public_key = escrow_public_key
    
    def generate_key_with_escrow(self, key_size=2048):
        """Generar clave con escrow"""
        # Generar clave privada
        private_key = rsa.generate_private_key(
            public_exponent=65537,
            key_size=key_size
        )
        
        # Serializar clave privada
        private_pem = private_key.private_bytes(
            encoding=serialization.Encoding.PEM,
            format=serialization.PrivateFormat.PKCS8,
            encryption_algorithm=serialization.NoEncryption()
        )
        
        # Cifrar clave privada con clave de escrow
        encrypted_key = self.escrow_public_key.encrypt(
            private_pem,
            padding.OAEP(
                mgf=padding.MGF1(algorithm=hashes.SHA256()),
                algorithm=hashes.SHA256(),
                label=None
            )
        )
        
        return private_key.public_key(), encrypted_key

# Ejemplo de uso
escrow_key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
escrow_public = escrow_key.public_key()
escrow_system = KeyEscrow(escrow_public)
public_key, encrypted_private = escrow_system.generate_key_with_escrow()

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44

class KeyRecovery:
    def __init__(self, escrow_private_key):
        self.escrow_private_key = escrow_private_key
    
    def recover_key(self, encrypted_key, authorization_token):
        """Recuperar clave con autorización"""
        # Verificar autorización
        if not self.verify_authorization(authorization_token):
            raise ValueError("Autorización no válida")
        
        # Descifrar clave privada
        private_pem = self.escrow_private_key.decrypt(
            encrypted_key,
            padding.OAEP(
                mgf=padding.MGF1(algorithm=hashes.SHA256()),
                algorithm=hashes.SHA256(),
                label=None
            )
        )
        
        # Cargar clave privada
        private_key = serialization.load_pem_private_key(
            private_pem,
            password=None
        )
        
        # Registrar recuperación
        self.log_recovery(authorization_token)
        
        return private_key
    
    def verify_authorization(self, token):
        """Verificar token de autorización"""
        # Implementar verificación de autorización
        return True  # Simplificado
    
    def log_recovery(self, token):
        """Registrar recuperación de clave"""
        # Implementar logging
        print(f"Clave recuperada con token: {token}")

# Ejemplo de uso
recovery_system = KeyRecovery(escrow_key)
recovered_key = recovery_system.recover_key(encrypted_private, "auth_token_123")

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67

from cryptography.hazmat.primitives import hashes
import secrets

class DistributedKeyEscrow:
    def __init__(self, threshold, total_custodians):
        self.threshold = threshold
        self.total_custodians = total_custodians
    
    def fragment_key(self, private_key):
        """Fragmentar clave en múltiples partes"""
        # Serializar clave privada
        private_pem = private_key.private_bytes(
            encoding=serialization.Encoding.PEM,
            format=serialization.PrivateFormat.PKCS8,
            encryption_algorithm=serialization.NoEncryption()
        )
        
        # Convertir a bytes
        key_bytes = private_pem
        
        # Generar coeficientes aleatorios
        coefficients = [secrets.randbits(256) for _ in range(self.threshold - 1)]
        coefficients.insert(0, int.from_bytes(key_bytes, 'big'))
        
        # Generar fragmentos
        fragments = []
        for i in range(1, self.total_custodians + 1):
            fragment = 0
            for j, coeff in enumerate(coefficients):
                fragment += coeff * (i ** j)
            fragments.append((i, fragment))
        
        return fragments
    
    def reconstruct_key(self, fragments):
        """Reconstruir clave a partir de fragmentos"""
        if len(fragments) < self.threshold:
            raise ValueError("Fragmentos insuficientes")
        
        # Usar interpolación de Lagrange
        x_values = [f[0] for f in fragments[:self.threshold]]
        y_values = [f[1] for f in fragments[:self.threshold]]
        
        # Reconstruir clave
        key_value = 0
        for i in range(self.threshold):
            term = y_values[i]
            for j in range(self.threshold):
                if i != j:
                    term = term * (-x_values[j]) // (x_values[i] - x_values[j])
            key_value += term
        
        # Convertir de vuelta a bytes
        key_bytes = key_value.to_bytes((key_value.bit_length() + 7) // 8, 'big')
        
        # Cargar clave privada
        private_key = serialization.load_pem_private_key(
            key_bytes,
            password=None
        )
        
        return private_key

# Ejemplo de uso
distributed_escrow = DistributedKeyEscrow(threshold=3, total_custodians=5)
fragments = distributed_escrow.fragment_key(private_key)
reconstructed = distributed_escrow.reconstruct_key(fragments[:3])