2026-10-18 00:38:26 +02:00
|
|
|
import os
|
|
|
|
|
|
2026-07-21 10:25:29 +02:00
|
|
|
from cryptography.fernet import Fernet
|
|
|
|
|
|
|
|
|
|
from app.config import settings
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def encrypt_xprv(xprv_base58: str) -> bytes:
|
|
|
|
|
return Fernet(settings.xprv_encryption_key).encrypt(xprv_base58.encode())
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def decrypt_xprv(token: bytes) -> str:
|
|
|
|
|
return Fernet(settings.xprv_encryption_key).decrypt(token).decode()
|
Make the draw a commit-reveal at a fixed, confirmed, quorum-agreed height with a public proof (B-73, RND-14 … RND-20, RND-33 … RND-37, DAT-61 … DAT-66, API-25, API-45, AUD-24 … AUD-27, AUD-37, ELC-15, SEC-56, ADR-24, ADR-25)
2026-10-14 16:29:09 +02:00
|
|
|
|
|
|
|
|
|
|
|
|
|
def encrypt_round_seed(server_seed_hex: str) -> str:
|
|
|
|
|
"""B-73 (DAT-64, SEC-56): a round's secret encrypted at rest with the same key that
|
|
|
|
|
protects the master xprv, so a copy of the database alone never reveals it. The Fernet
|
|
|
|
|
token is ASCII, stored as text."""
|
|
|
|
|
return Fernet(settings.xprv_encryption_key).encrypt(server_seed_hex.encode()).decode()
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def decrypt_round_seed(token: str) -> str:
|
|
|
|
|
return Fernet(settings.xprv_encryption_key).decrypt(token.encode()).decode()
|
2026-10-18 00:38:26 +02:00
|
|
|
|
|
|
|
|
|
|
|
|
|
def write_secret_file(path: str, data: bytes) -> None:
|
|
|
|
|
"""B-89 (SEC-50): created `0600` from the start (never through a wider mode) and
|
|
|
|
|
rewritten with the same mode, so a key file is not readable by other users."""
|
|
|
|
|
fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
|
|
|
|
|
with os.fdopen(fd, "wb") as f:
|
|
|
|
|
os.fchmod(f.fileno(), 0o600)
|
|
|
|
|
f.write(data)
|
