Error while trying to decrypt using Fernet

Question

After creating a simple python encryption code with fernet library (that worked great) I tried to code a decryptor but unfortunately while trying to use my decryptor i got the following error

['blahblahblah.txt', 'blah.txt']
Traceback (most recent call last):
  File "/home/kali/Desktop/stuff/projects/voldemort/decrypt.py", line 24, in <module>
    contents_decrypted = Fernet(secretkey).decrypt(contents)
  File "/usr/lib/python3/dist-packages/cryptography/fernet.py", line 34, in __init__
    raise ValueError(
ValueError: Fernet key must be 32 url-safe base64-encoded bytes.

The Code:

#!/usr/bin/python3

import os
from cryptography.fernet import Fernet

#find some files
files = []

#Starting the file in a loop
for file in os.listdir():
        if file == "voldemort.py" or file == "thekey.key" or file == "decrypt.py":
                continue
        if os.path.isfile(file):
                files.append(file)

print(files)

with open("thekey.key", "rb") as key:
        secretkey = key.read()

for file in files:
        with open(file, "rb") as thefile:
                contents = thefile.read()
        contents_decrypted = Fernet(secretkey).decrypt(contents)
        with open(file, "wb") as thefile:
                thefile.write(contents_decrypted)

Please *update the question* to include the value of `secretkey`. — S3DEV, Jun 07 '22 at 17:58
The problem is the content of `thekey.key` isn't saved correctly, but that code isn't shown. — Mark Tolonen, Jun 07 '22 at 18:11

S3DEV · Answer 1 · 2022-06-07T18:20:33.383

The error simply states the key used is invalid. Fernet is expecting a (url-safe) 32-byte base64 encoded string, as the key.

There are many methods for generating such a string, here are two simpler examples:

Option 1:

Let Fernet do it for you:

from cryptography import fernet

key = fernet.Fernet.generate_key()

Output:

b'd25vYTghWVgkTQWrMFnwW1tfKtn_lWzDr2JJM95f2fs='

Option 2:

Create one yourself using a (unique) randomly generated UUID4 string:

import base64
import uuid

key = base64.b64encode(uuid.uuid4().hex.encode())

Output:

b'M2E4MmQ2MDJlNmZmNDQwN2I3Y2NiN2I0ZDJkMzA4Zjk='

Addressing the helpful comment about writing the key to a file, one can use:

with open('keyfile.key', 'wb') as f:
    f.write(key)

Remember, Fernet is looking for a bytestring, so it's important to store the file using the 'wb' (write binary) mode.

And then, save it correctly to `thekey.key` by writing as `with open('thekey.key','wb') as f: f.write(key)`, which is probably the real root cause. My guess is the OP used something like `with open('thekey.key','w') as f: f.write(str(key))` instead of binary mode, but that code isn't shown. — Mark Tolonen, Jun 07 '22 at 18:12

eatmeimadanish · Answer 2 · 2022-06-07T18:07:23.830

0

Your issue is your Fernet key is not encoded correctly.

*UPDATED TO SUPPORT RAW FILE OUTPUT

from cryptography.fernet import Fernet
from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.backends import default_backend
import hashlib
import zlib, base64, json

SALT = 'secretpassword'        

def cryptkey(password=''):
    digest = hashes.Hash(hashes.SHA256(), backend=default_backend())
    digest.update(SALT+password)
    return Fernet(base64.urlsafe_b64encode(digest.finalize()))

def encrypt(meta, password=''):
    meta = str(zlib.compress(meta, 9))
    f = cryptkey(password)
    return base64.urlsafe_b64encode(f.encrypt(bytes(meta)))

def decrypt(meta, password=''):
    meta = base64.urlsafe_b64decode(meta)
    f = cryptkey(password)
    meta = f.decrypt(bytes(meta))
    return zlib.decompress(meta)

edited Jun 07 '22 at 18:07

answered Jun 07 '22 at 17:50

eatmeimadanish

3,809
1
14
20

In case of my original code that i posted above what is your recommedndation ? – Lorenzo Jun 07 '22 at 17:57
While it may work (have not tested) 1) This is mass overkill for the OP’s simple error message, and 2) in no way addresses the OP’s error. – S3DEV Jun 07 '22 at 17:57
@S3DEV how does this not solve the problem? And there was no code in the OP to solve at the time of my post so exactly how am I to know what to solve? – eatmeimadanish Jun 07 '22 at 17:59
Perhaps an answer shouldn’t be posted if we’re not sure what we’re trying to answer. (?) – S3DEV Jun 07 '22 at 18:00
@Lorenzo I would just use this as a module and call encrypt/decrypt with the password. (make your own secret salt). There really is no simpler way to do this, and this is sha256 encryption. – eatmeimadanish Jun 07 '22 at 18:03

Error while trying to decrypt using Fernet

2 Answers2

Option 1:

Option 2: