from Crypto.PublicKey import DSA
from Crypto.Signature import DSS
from Crypto.Hash import SHA256
from flask import Flask, request
@app.route('/generate_key')
def generate_key():
# Vulnerable: Insufficient DSA key size
key = DSA.generate(1024) # Too small, vulnerable
private_key = key.export_key()
public_key = key.publickey().export_key()
return {
'private_key': private_key.decode(),
'public_key': public_key.decode()
}
@app.route('/sign_data', methods=['POST'])
def sign_data():
# Vulnerable: Using weak DSA key
private_key_pem = request.form.get('private_key')
data = request.form.get('data').encode()
key = DSA.import_key(private_key_pem)
hash_obj = SHA256.new(data)
signer = DSS.new(key, 'fips-186-3')
signature = signer.sign(hash_obj)
return signature.hex()
from Crypto.PublicKey import DSA, ECC
from Crypto.Signature import DSS, eddsa
from Crypto.Hash import SHA256
from flask import Flask, request
import base64
def validate_dsa_key_size(key):
"""Validate DSA key meets minimum security requirements."""
if key.key_size < 2048:
raise ValueError(f'DSA key size {key.key_size} is insufficient. Minimum 2048 bits required.')
return True
@app.route('/generate_key')
def generate_key():
"""Generate secure DSA key with sufficient size."""
try:
# Secure: Use 3072-bit DSA key
key = DSA.generate(3072)
# Validate key size
validate_dsa_key_size(key)
private_key = key.export_key()
public_key = key.publickey().export_key()
return {
'private_key': base64.b64encode(private_key).decode(),
'public_key': base64.b64encode(public_key).decode(),
'key_size': key.key_size,
'algorithm': 'DSA-3072'
}
except Exception as e:
return {'error': 'Key generation failed'}, 500
@app.route('/generate_ecdsa_key')
def generate_ecdsa_key():
"""Generate ECDSA key as secure alternative."""
try:
# Secure: Use ECDSA P-256 curve
key = ECC.generate(curve='P-256')
private_key = key.export_key(format='PEM')
public_key = key.public_key().export_key(format='PEM')
return {
'private_key': base64.b64encode(private_key.encode()).decode(),
'public_key': base64.b64encode(public_key.encode()).decode(),
'curve': 'P-256',
'algorithm': 'ECDSA'
}
except Exception as e:
return {'error': 'ECDSA key generation failed'}, 500
@app.route('/sign_data', methods=['POST'])
def sign_data():
"""Secure data signing with key validation."""
try:
private_key_b64 = request.form.get('private_key', '')
data = request.form.get('data', '').encode('utf-8')
if not private_key_b64 or not data:
return {'error': 'Private key and data required'}, 400
# Decode private key
private_key_pem = base64.b64decode(private_key_b64)
key = DSA.import_key(private_key_pem)
# Validate key size
validate_dsa_key_size(key)
# Create hash and sign
hash_obj = SHA256.new(data)
signer = DSS.new(key, 'fips-186-3')
signature = signer.sign(hash_obj)
return {
'signature': base64.b64encode(signature).decode(),
'algorithm': f'DSA-{key.key_size}',
'hash': 'SHA-256'
}
except ValueError as e:
return {'error': str(e)}, 400
except Exception as e:
return {'error': 'Signing failed'}, 500