# juanguillermo1983/criptografia-demo-rsa-aes architecture

> Architecture diagram of the GitHub repository juanguillermo1983/criptografia-demo-rsa-aes, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-06-16). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/juanguillermo1983/criptografia-demo-rsa-aes
- Repository: https://github.com/juanguillermo1983/criptografia-demo-rsa-aes

## Overview

1. **What this repo is**
   - A Python demo of **hybrid cryptography**: it encrypts a CSV with **AES-256-GCM**, then encrypts the AES key with **RSA-2048/OAEP**.
   - The whole flow is designed as a **multi-terminal demo**, not as a production service.

2. **Main runtime boundary**
   - Everything runs locally with **Python scripts** plus a few shell helpers.
   - There is no real backend or database; the architecture is mostly **file-based** and **terminal-driven**.

3. **Primary actors**
   - **Emitter terminal**: generates keys, encrypts data, wraps the symmetric key, and prepares the transfer package.
   - **Receiver terminal**: polls for incoming packages and performs automatic decryption.
   - **Manual/debug terminal**: runs the decryption steps separately for demonstration purposes.

4. **Core data flow**
   - Plain CSV in `datos/ventas.csv` or root `ventas.csv`
   - → AES encryption of the CSV payload
   - → RSA encryption of the AES key
   - → packaging into a `.tar.gz`
   - → drop into `intercambio_ftp/`
   - → receiver detects the package
   - → RSA key unwrap
   - → AES-GCM file decryption
   - → recovered CSV in `descifrado/`

5. **Cryptographic split**
   - `scripts/02_cifrar_csv_aes.py` handles the **bulk data encryption** with AES-GCM.
   - `scripts/03_cifrar_llave_rsa.py` protects only the **small AES key** with RSA.
   - `scripts/05_descifrar_llave.py` and `scripts/06_descifrar_csv.py` mirror that split on the receiving side.

6. **File-system “transport” layer**
   - `intercambio_ftp/` acts as the **message handoff boundary**.
   - The receiver script `scripts/07_polling_ftp.py` watches this directory every 2 seconds.
   - This simulates FTP-style delivery, but architecturally it is a **local drop zone**, not a network service.

7. **Artifact layout**
   - `keys/` holds the RSA key pair generated by `scripts/01_generar_llaves.py`.
   - `cifrado/` stores encrypted outputs such as `ventas.csv.enc` and `aes_key.bin.enc`.
   - `descifrado/` stores the recovered AES key and decrypted CSV.
   - `intercambio_ftp/procesados/` is the receiver’s archive for already-handled packages.

8. **Packaging and delivery**
   - The sender does not ship loose crypto artifacts; it creates a **single archive package**.
   - That packaging step is important because it defines the boundary between **producer output** and **consumer input**.

9. **Demo orchestration**
   - `setup.sh` bootstraps the environment once.
   - `demo_completa.py` and `limpiar-demo.sh` are likely convenience scripts for end-to-end execution and cleanup.
   - `generar_csv.py` is a helper for creating sample input data.

10. **Security properties emphasized by the repo**
   - **Confidentiality** comes from AES and RSA.
   - **Integrity/authenticity of ciphertext** comes from **AES-GCM tags**, which detect tampering.
   - The README explicitly frames this as an **end-to-end encryption demo** for explaining the hybrid pattern.

11. **Important architectural boundary for a diagram**
   - Draw the system as two local subsystems connected by a shared folder:
     - **Emitter pipeline**: key generation → data encryption → key wrapping → packaging
     - **Receiver pipeline**: polling → package pickup → key unwrapping → data decryption
   - The shared folder `intercambio_ftp/` is the critical integration point between them.

12. **What is not present**
   - No web server, API, or database.
   - No external FTP daemon is shown; the “FTP” concept is represented by local file exchange and polling.
   - No cloud infrastructure is required for the demo.

Main entry points: [`scripts/02_cifrar_csv_aes.py`](https://github.com/juanguillermo1983/criptografia-demo-rsa-aes/blob/main/scripts/02_cifrar_csv_aes.py) (AES encrypt), [`scripts/01_generar_llaves.py`](https://github.com/juanguillermo1983/criptografia-demo-rsa-aes/blob/main/scripts/01_generar_llaves.py) (Key pair), [`intercambio_ftp`](https://github.com/juanguillermo1983/criptografia-demo-rsa-aes/tree/main/intercambio_ftp) (FTP drop), [`scripts/03_cifrar_llave_rsa.py`](https://github.com/juanguillermo1983/criptografia-demo-rsa-aes/blob/main/scripts/03_cifrar_llave_rsa.py) (Wrap key)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_emitter["Emitter pipeline"]
  node_csvgen["Sample data<br/>data generator<br/>[generar_csv.py]"]
  node_rootcsv["Ventas CSV<br/>source csv<br/>[ventas.csv]"]
  node_datoscsv["Datos CSV<br/>source csv<br/>[ventas.csv]"]
  node_keygen["Key pair<br/>rsa keygen"]
  node_keysdir[("RSA keys<br/>key store")]
  node_aesenc["AES encrypt<br/>bulk cipher"]
  node_cipherdir[("Cipher outputs<br/>artifact store")]
  node_rsawrap["Wrap key<br/>rsa oaep"]
  node_sendftp["Pack ship<br/>package sender<br/>[04_enviar_ftp.py]"]
end

subgraph group_transport["Shared drop zone"]
  node_ftpdrop[("FTP drop<br/>handoff folder")]
end

subgraph group_receiver["Receiver pipeline"]
  node_poller["Poll inbox<br/>receiver poller<br/>[07_polling_ftp.py]"]
  node_archive[("Processed<br/>archive folder")]
  node_unwrap["Unwrap key<br/>rsa decrypt"]
  node_aesdec["AES decrypt<br/>payload decrypt"]
  node_recovered[("Recovered data<br/>decrypt outputs")]
end

node_demo["Demo flow<br/>orchestrator<br/>[demo_completa.py]"]
node_setup["Bootstrap<br/>setup script<br/>[setup.sh]"]

node_demo -->|"bootstraps"| node_setup
node_demo -->|"drives"| node_csvgen
node_csvgen -->|"writes"| node_datoscsv
node_datoscsv -->|"plaintext"| node_aesenc
node_rootcsv -->|"plaintext"| node_aesenc
node_setup -->|"prepares"| node_keygen
node_keygen -->|"stores"| node_keysdir
node_keygen -->|"provides keys"| node_rsawrap
node_aesenc -->|"stores"| node_cipherdir
node_aesenc -->|"emits aes key"| node_rsawrap
node_rsawrap -->|"stores"| node_cipherdir
node_cipherdir -->|"packages"| node_sendftp
node_sendftp -->|"drops"| node_ftpdrop
node_ftpdrop -->|"observed by"| node_poller
node_poller -->|"moves"| node_archive
node_ftpdrop -->|"package input"| node_unwrap
node_keysdir -->|"private key"| node_unwrap
node_unwrap -->|"recovered key"| node_aesdec
node_cipherdir -->|"ciphertext"| node_aesdec
node_aesdec -->|"writes"| node_recovered

click node_demo "https://github.com/juanguillermo1983/criptografia-demo-rsa-aes/blob/main/demo_completa.py"
click node_setup "https://github.com/juanguillermo1983/criptografia-demo-rsa-aes/blob/main/setup.sh"
click node_csvgen "https://github.com/juanguillermo1983/criptografia-demo-rsa-aes/blob/main/generar_csv.py"
click node_rootcsv "https://github.com/juanguillermo1983/criptografia-demo-rsa-aes/blob/main/ventas.csv"
click node_datoscsv "https://github.com/juanguillermo1983/criptografia-demo-rsa-aes/blob/main/datos/ventas.csv"
click node_keygen "https://github.com/juanguillermo1983/criptografia-demo-rsa-aes/blob/main/scripts/01_generar_llaves.py"
click node_aesenc "https://github.com/juanguillermo1983/criptografia-demo-rsa-aes/blob/main/scripts/02_cifrar_csv_aes.py"
click node_rsawrap "https://github.com/juanguillermo1983/criptografia-demo-rsa-aes/blob/main/scripts/03_cifrar_llave_rsa.py"
click node_sendftp "https://github.com/juanguillermo1983/criptografia-demo-rsa-aes/blob/main/scripts/04_enviar_ftp.py"
click node_ftpdrop "https://github.com/juanguillermo1983/criptografia-demo-rsa-aes/tree/main/intercambio_ftp"
click node_poller "https://github.com/juanguillermo1983/criptografia-demo-rsa-aes/blob/main/scripts/07_polling_ftp.py"
click node_unwrap "https://github.com/juanguillermo1983/criptografia-demo-rsa-aes/blob/main/scripts/05_descifrar_llave.py"
click node_aesdec "https://github.com/juanguillermo1983/criptografia-demo-rsa-aes/blob/main/scripts/06_descifrar_csv.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_csvgen,node_rootcsv,node_datoscsv,node_keygen,node_keysdir,node_aesenc,node_cipherdir,node_rsawrap,node_sendftp toneBlue
class node_ftpdrop toneAmber
class node_poller,node_archive,node_unwrap,node_aesdec,node_recovered toneMint
class node_demo,node_setup toneNeutral
```

## Components

### Emitter pipeline

Local key generation, encryption, wrapping, and packaging on the sender side.

- [Sample data](https://github.com/juanguillermo1983/criptografia-demo-rsa-aes/blob/main/generar_csv.py): data generator · Helper for producing demo CSV input. · `generar_csv.py`
- [Ventas CSV](https://github.com/juanguillermo1983/criptografia-demo-rsa-aes/blob/main/ventas.csv): source csv · Alternate plain-text input CSV at repository root. · `ventas.csv`
- [Datos CSV](https://github.com/juanguillermo1983/criptografia-demo-rsa-aes/blob/main/datos/ventas.csv): source csv · Primary plain-text CSV input used by the encryption flow. · `datos/ventas.csv`
- [Key pair](https://github.com/juanguillermo1983/criptografia-demo-rsa-aes/blob/main/scripts/01_generar_llaves.py): rsa keygen · Generates the RSA-2048 public/private key pair used to wrap and unwrap the AES key. · `scripts/01_generar_llaves.py`
- **RSA keys**: key store · Repository location for the generated RSA key pair.
- [AES encrypt](https://github.com/juanguillermo1983/criptografia-demo-rsa-aes/blob/main/scripts/02_cifrar_csv_aes.py): bulk cipher · Encrypts the CSV payload with AES-256-GCM. · `scripts/02_cifrar_csv_aes.py`
- **Cipher outputs**: artifact store · Holds encrypted payloads and the wrapped AES key before packaging.
- [Wrap key](https://github.com/juanguillermo1983/criptografia-demo-rsa-aes/blob/main/scripts/03_cifrar_llave_rsa.py): rsa oaep · Encrypts only the AES key with RSA-OAEP. · `scripts/03_cifrar_llave_rsa.py`
- [Pack ship](https://github.com/juanguillermo1983/criptografia-demo-rsa-aes/blob/main/scripts/04_enviar_ftp.py): package sender · Bundles the encrypted artifacts and moves the archive toward the handoff boundary. · `scripts/04_enviar_ftp.py`

### Shared drop zone

Local file-exchange boundary that simulates FTP-style delivery.

- [FTP drop](https://github.com/juanguillermo1983/criptografia-demo-rsa-aes/tree/main/intercambio_ftp): handoff folder · Shared local exchange directory that stands in for FTP delivery. · `intercambio_ftp`

### Receiver pipeline

Polling, key unwrap, and CSV recovery on the consumer side.

- [Poll inbox](https://github.com/juanguillermo1983/criptografia-demo-rsa-aes/blob/main/scripts/07_polling_ftp.py): receiver poller · Watches the shared folder every few seconds for incoming packages. · `scripts/07_polling_ftp.py`
- **Processed**: archive folder · Receiver-side archive for already handled packages.
- [Unwrap key](https://github.com/juanguillermo1983/criptografia-demo-rsa-aes/blob/main/scripts/05_descifrar_llave.py): rsa decrypt · Recovers the AES key using the RSA private key. · `scripts/05_descifrar_llave.py`
- [AES decrypt](https://github.com/juanguillermo1983/criptografia-demo-rsa-aes/blob/main/scripts/06_descifrar_csv.py): payload decrypt · Decrypts the CSV payload and verifies integrity with the GCM tag. · `scripts/06_descifrar_csv.py`
- **Recovered data**: decrypt outputs · Stores the recovered AES key and decrypted CSV output.

### Other components

- [Demo flow](https://github.com/juanguillermo1983/criptografia-demo-rsa-aes/blob/main/demo_completa.py): orchestrator · End-to-end convenience entrypoint that ties together the local multi-terminal demo. · `demo_completa.py`
- [Bootstrap](https://github.com/juanguillermo1983/criptografia-demo-rsa-aes/blob/main/setup.sh): setup script · Initial environment preparation for the demo. · `setup.sh`

## Connections

- Demo flow → Bootstrap: bootstraps · Prepares the local demo environment before the terminal flow runs.
- Demo flow → Sample data: drives · Can generate sample input data for the run.
- Sample data → Datos CSV: writes · Produces the CSV used as plaintext input.
- Datos CSV → AES encrypt: plaintext · Plain CSV is the bulk input to AES-GCM encryption.
- Ventas CSV → AES encrypt: plaintext · Alternate root-level CSV input can feed the same encryption stage.
- Bootstrap → Key pair: prepares · Bootstraps the environment before key generation and demo execution.
- Key pair → RSA keys: stores · Writes the RSA key pair to the keys directory.
- Key pair → Wrap key: provides keys · The generated RSA material is used to wrap the AES key.
- AES encrypt → Cipher outputs: stores · Outputs the AES-encrypted CSV artifact.
- AES encrypt → Wrap key: emits aes key · Produces the symmetric key that will be encrypted separately.
- Wrap key → Cipher outputs: stores · Writes the RSA-encrypted AES key beside the encrypted payload.
- Cipher outputs → Pack ship: packages · Encrypted artifacts are gathered for shipment as one archive.
- Pack ship → FTP drop: drops · Places the package into the shared handoff folder.
- FTP drop → Poll inbox: observed by · The receiver watches the drop zone for new packages.
- Poll inbox → Processed: moves · After pickup, processed packages are archived locally.
- FTP drop → Unwrap key: package input · Incoming package supplies the wrapped AES key to the receiver side.
- RSA keys → Unwrap key: private key · Receiver-side RSA private key is needed to unwrap the AES key.
- Unwrap key → AES decrypt: recovered key · The decrypted AES key feeds payload decryption.
- Cipher outputs → AES decrypt: ciphertext · Encrypted CSV payload is consumed by the decrypt stage.
- AES decrypt → Recovered data: writes · Recovered CSV and key artifacts are written to the decrypt output area.