Along with readme demo addition for performance recommendation.

encrypt

chi_tool -e -p password inputfile -o outputfile
chi_tool -e -p password - -o outputfile # read from stdin
chi_tool -e -p password -o outputfile # also read from stdin

decrypt

chi_tool -d -p password inputfile -o outputfile
chi_tool -p password inputfile -o outputfile
chi_tool inputfile -o outputfile  # prompt for password
chi_tool -p password inputfile -o -  # stdout
chi_tool -p password inputfile  # also stdout
chi_tool -P password_file inputfile -o outputfile

If OS environment variable CHI_PASSWORD set use that as password instead of prompting.

If password keychain available use that instead of prompt. - #6

• Py 3.6 >= https://docs.python.org/3/library/secrets.html#module-secrets - secrets.token_bytes()

• https://www.pycryptodome.org/src/random/random#Crypto.Random.get_random_bytes

• see other personal code that uses alternative system random (os.urandom)

  try:
      from secrets import choice, randbelow  # Python 3.6 module
  except ImportError:
      import random as _py_random
      random = _py_random  # backup(, backup) plan
  
  # Potentially overkill, use system random numbers
  # Nested exception catching for older Python version
  try:
      try:
          random = _py_random.SystemRandom()
      except NotImplementedError:
          # not available
          pass
  except AttributeError:
      # Pre Python 2.4
      pass
  
  def randbelow(x):
      return random.randint(0, x)
  choice = random.choice
  

For completeness, (Linux) should not be needed:

try:
    urandom = os.urandom
except AttributeError:
    if os.path.exists('/dev/urandom'):
        def urandom(n):
            # UNIX ONLY
            f = open('/dev/urandom')
            result = f.read(n)
            f.close()
            return result
    else:
        def urandom(n):
           s = []
           for i in xrange(n):
              r = random.randint(0,255)
              s.append(chr(r))
           return ''.join(s)

Windows only:

win32prng.getRandomBytes

Current import logic can end up importing python2 only blowfish implementation under Python3.
Quickest thing would be to do conditional import based on version.

Also look at https://www.seanet.com/~bugbee/crypto/blowfish/.

Use https://github.com/clach04/x10_any/blob/master/.github/workflows/main.yml

• https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#symmetric-encryption-algorithms
• pycryptodomex (already support pycryptodome) https://github.com/Legrandin/pycryptodome
• #2
  • https://www.seanet.com/~bugbee/crypto/blowfish/

For the different APIs, class versus file IO functions. See #12

• use PEP272LikeCipher() in read enc file function, read_encrypted_file()
• use PEP272LikeCipher() in write enc file function write_encrypted_file()

NOTE comments in code on behavior differences:

[PEP272LikeCipher.decrypt()]code is almost identical to the code currently in read_encrypted_file(), difference is ChiIO exceptions are should catch all issues - RunTime exception is not raised unlike read_encrypted_file() for some bad inputs

in decrypt, for padding read issues:

• function raises RuntimeError()
• class raises UnsupportedFile()

Both raise BadPassword() but file code attempts to report filename.

file code also complains on missing password.

Future proof from:

(py311venv) C:\code\py\puren_tonbo>python -m pip install --upgrade git+https://github.com/clach04/chi_io.git
Collecting git+https://github.com/clach04/chi_io.git
  Cloning https://github.com/clach04/chi_io.git to c:\users\clach04\appdata\local\temp\pip-req-build-hh3fq4mi
  Running command git clone --filter=blob:none --quiet https://github.com/clach04/chi_io.git 'C:\Users\clach04\AppData\Local\Temp\pip-req-build-hh3fq4mi'
  Resolved https://github.com/clach04/chi_io.git to commit e680521b61b85d30b70bad19449fef5846cced15
  Preparing metadata (setup.py) ... done
Installing collected packages: chi-io
  DEPRECATION: chi-io is being installed using the legacy 'setup.py install' method, because it does not have a 'pyproject.toml' and the 'wheel' package is not installed. pip 23.1 will enforce this behaviour change. A possible replacement is to enable the '--use-pep517' option. Discussion can be found at https://github.com/pypa/pip/issues/8559
  Running setup.py install for chi-io ... done
Successfully installed chi-io-1.0.0

Also see #8

See clach04/puren_tonbo#91

See https://github.com/clach04/puren_tonbo/wiki/Tombo for Tombo limitation.

Use a profiler to find hotspots. There are inefficient pieces of code, for example

• single slices, rather than multiple
• (Byte) concatenation, compare:
  • demos concat faster - https://blog.ganssle.io/articles/2019/11/string-concat.html#benchmark-code
  • demos join faster - https://discuss.python.org/t/joining-strings-is-faster-than-adding-but-only-if-concatenating-3-strings/5293
• struct/array calls
• big ticket item likely to be key derivation called all the time for read and write encrypted_file() (not an issue for the class interface) - #11

If password keyring available use that instead of prompt.