How juanguillermo1983/criptografia-demo-rsa-aes works
1. What this repo is
- A Python demo of hybrid cryptography: it encrypts a CSV with AES-256-GCM, then encrypts the AES key with RSA-2048/OAEP.
- The whole flow is designed as a multi-terminal demo, not as a production service.
2. Main runtime boundary
- Everything runs locally with Python scripts plus a few shell helpers.
- There is no real backend or database; the architecture is mostly file-based and terminal-driven.
3. Primary actors
- Emitter terminal: generates keys, encrypts data, wraps the symmetric key, and prepares the transfer package.
- Receiver terminal: polls for incoming packages and performs automatic decryption.
- Manual/debug terminal: runs the decryption steps separately for demonstration purposes.
4. Core data flow
- Plain CSV in datos/ventas.csv or root ventas.csv
- → AES encryption of the CSV payload
- → RSA encryption of the AES key
- → packaging into a .tar.gz
- → drop into intercambio_ftp/
- → receiver detects the package
- → RSA key unwrap
- → AES-GCM file decryption
- → recovered CSV in descifrado/
5. Cryptographic split
- scripts/02_cifrar_csv_aes.py handles the bulk data encryption with AES-GCM.
- scripts/03_cifrar_llave_rsa.py protects only the small AES key with RSA.
- scripts/05_descifrar_llave.py and scripts/06_descifrar_csv.py mirror that split on the receiving side.
6. File-system “transport” layer
- intercambio_ftp/ acts as the message handoff boundary.
- The receiver script scripts/07_polling_ftp.py watches this directory every 2 seconds.
- This simulates FTP-style delivery, but architecturally it is a local drop zone, not a network service.
7. Artifact layout
- keys/ holds the RSA key pair generated by scripts/01_generar_llaves.py.
- cifrado/ stores encrypted outputs such as ventas.csv.enc and aes_key.bin.enc.
- descifrado/ stores the recovered AES key and decrypted CSV.
- intercambio_ftp/procesados/ is the receiver’s archive for already-handled packages.
8. Packaging and delivery
- The sender does not ship loose crypto artifacts; it creates a single archive package.
- That packaging step is important because it defines the boundary between producer output and consumer input.
9. Demo orchestration
- setup.sh bootstraps the environment once.
- demo_completa.py and limpiar-demo.sh are likely convenience scripts for end-to-end execution and cleanup.
- generar_csv.py is a helper for creating sample input data.
10. Security properties emphasized by the repo
- Confidentiality comes from AES and RSA.
- Integrity/authenticity of ciphertext comes from AES-GCM tags, which detect tampering.
- The README explicitly frames this as an end-to-end encryption demo for explaining the hybrid pattern.
11. Important architectural boundary for a diagram
- Draw the system as two local subsystems connected by a shared folder:
- Emitter pipeline: key generation → data encryption → key wrapping → packaging
- Receiver pipeline: polling → package pickup → key unwrapping → data decryption
- The shared folder intercambio_ftp/ is the critical integration point between them.
12. What is not present
- No web server, API, or database.
- No external FTP daemon is shown; the “FTP” concept is represented by local file exchange and polling.
- No cloud infrastructure is required for the demo.
Main entry points: 02_cifrar_csv_aes.py AES encrypt · 01_generar_llaves.py Key pair · intercambio_ftp FTP drop · 03_cifrar_llave_rsa.py Wrap key
Components 17
Emitter pipeline
Local key generation, encryption, wrapping, and packaging on the sender side.
- Sample data · Helper for producing demo CSV input.
generar_csv.py - Ventas CSV · Alternate plain-text input CSV at repository root.
ventas.csv - Datos CSV · Primary plain-text CSV input used by the encryption flow.
datos/ventas.csv - Key pair · Generates the RSA-2048 public/private key pair used to wrap and unwrap the AES key.
scripts/01_generar_llaves.py - RSA keys · Repository location for the generated RSA key pair.
- AES encrypt · Encrypts the CSV payload with AES-256-GCM.
scripts/02_cifrar_csv_aes.py - Cipher outputs · Holds encrypted payloads and the wrapped AES key before packaging.
- Wrap key · Encrypts only the AES key with RSA-OAEP.
scripts/03_cifrar_llave_rsa.py - Pack ship · Bundles the encrypted artifacts and moves the archive toward the handoff boundary.
scripts/04_enviar_ftp.py
Shared drop zone
Local file-exchange boundary that simulates FTP-style delivery.
- FTP drop · Shared local exchange directory that stands in for FTP delivery.
intercambio_ftp
Receiver pipeline
Polling, key unwrap, and CSV recovery on the consumer side.
- Poll inbox · Watches the shared folder every few seconds for incoming packages.
scripts/07_polling_ftp.py - Processed · Receiver-side archive for already handled packages.
- Unwrap key · Recovers the AES key using the RSA private key.
scripts/05_descifrar_llave.py - AES decrypt · Decrypts the CSV payload and verifies integrity with the GCM tag.
scripts/06_descifrar_csv.py - Recovered data · Stores the recovered AES key and decrypted CSV output.
Connections 20
- Demo flow → Bootstrap: bootstraps · Prepares the local demo environment before the terminal flow runs.
- Demo flow → Sample data: drives · Can generate sample input data for the run.
- Sample data → Datos CSV: writes · Produces the CSV used as plaintext input.
- Datos CSV → AES encrypt: plaintext · Plain CSV is the bulk input to AES-GCM encryption.
- Ventas CSV → AES encrypt: plaintext · Alternate root-level CSV input can feed the same encryption stage.
- Bootstrap → Key pair: prepares · Bootstraps the environment before key generation and demo execution.
- Key pair → RSA keys: stores · Writes the RSA key pair to the keys directory.
- Key pair → Wrap key: provides keys · The generated RSA material is used to wrap the AES key.
- AES encrypt → Cipher outputs: stores · Outputs the AES-encrypted CSV artifact.
- AES encrypt → Wrap key: emits aes key · Produces the symmetric key that will be encrypted separately.
- Wrap key → Cipher outputs: stores · Writes the RSA-encrypted AES key beside the encrypted payload.
- Cipher outputs → Pack ship: packages · Encrypted artifacts are gathered for shipment as one archive.
- Pack ship → FTP drop: drops · Places the package into the shared handoff folder.
- FTP drop → Poll inbox: observed by · The receiver watches the drop zone for new packages.
- Poll inbox → Processed: moves · After pickup, processed packages are archived locally.
- FTP drop → Unwrap key: package input · Incoming package supplies the wrapped AES key to the receiver side.
- RSA keys → Unwrap key: private key · Receiver-side RSA private key is needed to unwrap the AES key.
- Unwrap key → AES decrypt: recovered key · The decrypted AES key feeds payload decryption.
- Cipher outputs → AES decrypt: ciphertext · Encrypted CSV payload is consumed by the decrypt stage.
- AES decrypt → Recovered data: writes · Recovered CSV and key artifacts are written to the decrypt output area.