From 32845779cbadd711d226248fa17e1e71710fb170 Mon Sep 17 00:00:00 2001 From: quantova-inc Date: Mon, 2 Nov 2026 13:48:36 +0800 Subject: [PATCH 1/2] Write the generated private key with owner only file permissions --- encryption_helper/main.py | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/encryption_helper/main.py b/encryption_helper/main.py index e4de3ea..e0d1298 100644 --- a/encryption_helper/main.py +++ b/encryption_helper/main.py @@ -5,6 +5,7 @@ It handles the generation process, file I/O operations, and logging. """ +import os from pathlib import Path from typing import Tuple from cryptography.hazmat.primitives.asymmetric import rsa @@ -64,9 +65,14 @@ def generate_rsa_key() -> Tuple[bytes, bytes]: keys_dir = Path("keys/pem") keys_dir.mkdir(parents=True, exist_ok=True) - # Write the private key to a file - with open(keys_dir / "private-key.pem", "wb") as file_out: + # Write the private key to a file with owner only permissions + private_key_path = keys_dir / "private-key.pem" + private_key_fd = os.open( + private_key_path, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600 + ) + with os.fdopen(private_key_fd, "wb") as file_out: file_out.write(private_key) + os.chmod(private_key_path, 0o600) # Write the public key to a file with open(keys_dir / "public-key.pem", "wb") as file_out: From 932063c086065c4e24cc781b59ccec6ff2ead178 Mon Sep 17 00:00:00 2001 From: quantova-inc Date: Mon, 2 Nov 2026 14:35:14 +0800 Subject: [PATCH 2/2] Stop writing the generated private key to stdout and the debug log --- encryption_helper/main.py | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/encryption_helper/main.py b/encryption_helper/main.py index e0d1298..b5b7753 100644 --- a/encryption_helper/main.py +++ b/encryption_helper/main.py @@ -78,15 +78,13 @@ def generate_rsa_key() -> Tuple[bytes, bytes]: with open(keys_dir / "public-key.pem", "wb") as file_out: file_out.write(public_key) - # Log the keys + # Log only the public key, the private key is never logged logger.debug(f"Public key:\n{public_key.decode()}\n") - logger.debug(f"Private key:\n{private_key.decode()}\n") - # Print the keys to console + # Print only the public key, the private key is written to file only print("Public key:") print(public_key.decode()) - print("\nPrivate key:") - print(private_key.decode()) + print("\nPrivate key written to keys/pem/private-key.pem") return public_key, private_key