password change (reencryption)

change-password.py

@@ -0,0 +1,74 @@
+#!/usr/bin/python
+
+import src.config_provider
+import src.sql
+import base64
+import getpass
+from Crypto.Cipher import AES
+from Crypto.Util import Counter
+import binascii
+
+import src.my_scrypt
+
+currentPassword = getpass.getpass(prompt="Enter current password: ")
+
+currentPasswordHash = binascii.hexlify(src.my_scrypt.getVerificationHash(currentPassword))
+
+config = src.config_provider.getConfig()
+
+if currentPasswordHash != config['Login']['passwordHash']:
+    print("Given password doesn't match hash")
+    exit(-1)
+
+currentPasswordEncryptionKey = src.my_scrypt.getEncryptionHash(currentPassword)
+
+newPassword1 = getpass.getpass(prompt="Enter new password: ")
+newPassword2 = getpass.getpass(prompt="Repeat the same password: ")
+
+if newPassword1 != newPassword2:
+    print('Entered passwords are not identical!')
+    exit(-1)
+
+newPasswordVerificationKey = binascii.hexlify(src.my_scrypt.getVerificationHash(newPassword1))
+newPasswordEncryptionKey = src.my_scrypt.getEncryptionHash(newPassword1)
+
+src.sql.connect(config['Document']['documentPath'])
+
+encryptedNotes = src.sql.getResults("select note_id, note_title, note_text from notes where encryption = 1")
+
+def decrypt(encryptedBase64):
+    encryptedBytes = base64.b64decode(encryptedBase64)
+
+    aes = getAes(currentPasswordEncryptionKey)
+    return aes.decrypt(encryptedBytes)
+
+def encrypt(plainText):
+    aes = getAes(newPasswordEncryptionKey)
+    encryptedBytes = aes.encrypt(plainText)
+
+    return base64.b64encode(encryptedBytes)
+
+def getAes(key):
+    return AES.new(key, AES.MODE_CTR, counter=Counter.new(128, initial_value=5))
+
+for note in encryptedNotes:
+    decryptedTitle = decrypt(note['note_title'])
+    decryptedText = decrypt(note['note_text'])
+
+    reEncryptedTitle = encrypt(decryptedTitle)
+    reEncryptedText = encrypt(decryptedText)
+
+    print (reEncryptedTitle)
+    print (reEncryptedText)
+
+    src.sql.execute("update notes set note_title = ?, note_text = ? where note_id = ?",
+                    [reEncryptedTitle, reEncryptedText, note['note_id']])
+
+    print("Note " + note['note_id'] + " reencrypted with new password")
+
+print("New password hash is: " + newPasswordVerificationKey)
+print("Set this value to passwordHash value in config.ini")
+
+src.sql.commit()
+
+print("Changes committed. All encrypted notes were re-encrypted successfully with new password key.")