Generate a Fernet symmetric key.

Returns: Base64-encoded 32-byte key suitable for Fernet encryption.

Example: >>> key = generate_symmetric_key() >>> len(key) # 44 characters base64 encoded 44

Generate an RSA key pair.

Args: key_size: Key size in bits (default 2048). Must be at least 2048.

Returns: Dictionary with 'public_key' and 'private_key' in PEM format.

Raises: ValueError: If key_size is less than 2048.

Generate an X25519 key pair for key exchange.

Returns: Dictionary with 'public_key' and 'private_key' in PEM format.

Example: >>> keys = generate_x25519_key() >>> len(keys['public_key']) > 0 True

Encrypt data using Fernet symmetric encryption.

Args: key: Base64-encoded Fernet key. data: Plain text string to encrypt.

Returns: Base64-encoded ciphertext.

Example: >>> key = generate_symmetric_key() >>> ciphertext = fernet_encrypt(key, "Hello, World!") >>> len(ciphertext) > 0 True

Decrypt Fernet ciphertext.

Args: key: Base64-encoded Fernet key. ciphertext: Base64-encoded ciphertext.

Returns: Decrypted plain text string.

Raises: cryptography.fernet.InvalidToken: If decryption fails.

Encrypt data using AES.

Args: key: Hex-encoded AES key (16, 24, or 32 bytes). data: String to encrypt. mode: Encryption mode - 'CBC' or 'GCM' (default CBC).

Returns: Dictionary with 'ciphertext' (hex) and 'iv' (hex).

Raises: ValueError: If key size is invalid.

Decrypt AES ciphertext.

Args: key: Hex-encoded AES key. ciphertext: Hex-encoded ciphertext. iv: Hex-encoded initialization vector. mode: Encryption mode - 'CBC' or 'GCM' (default CBC).

Returns: Decrypted string.

Raises: ValueError: If key size is invalid.

Encrypt data using RSA with OAEP asymmetric_padding.

Args: public_key_pem: RSA public key in PEM format. data: String to encrypt (max ~446 bytes for 4096-bit key).

Returns: Base64-encoded ciphertext.

Raises: ValueError: If data is too large for the key size.

Decrypt RSA ciphertext using private key.

Args: private_key_pem: RSA private key in PEM format. ciphertext: Base64-encoded ciphertext.

Returns: Decrypted string.

Create RSA digital signature.

Args: private_key_pem: RSA private key in PEM format. data: String to sign.

Returns: Base64-encoded signature.

Verify RSA digital signature.

Args: public_key_pem: RSA public key in PEM format. data: Original signed data. signature: Base64-encoded signature.

Returns: True if signature is valid.

Compute SHA-256 hash.

Args: data: String or base64-encoded bytes to hash.

Returns: Hex-encoded hash.

Example: >>> hash_sha256("Hello, World!") 'dffd6021bb2bd5b0af676290809ec3a53191dd81c7f70a4b28688a362182986f'

Compute SHA-512 hash.

Args: data: String to hash.

Returns: Hex-encoded hash.

Compute SHA-1 hash.

Note: SHA-1 is considered cryptographically broken. Use only for legacy compatibility.

Args: data: String to hash.

Returns: Hex-encoded hash.

Generate HMAC.

Args: key: Hex-encoded key. data: String to sign. algorithm: Hash algorithm - 'sha256' or 'sha512' (default sha256).

Returns: Hex-encoded HMAC.

Example: >>> hmac_sign("aabbcc", "message") 'c053c4f7...'

Verify HMAC.

Args: key: Hex-encoded key. data: String that was signed. hmac: Hex-encoded HMAC to verify. algorithm: Hash algorithm - 'sha256' or 'sha512'.

Returns: True if HMAC is valid.

Derive key using PBKDF2.

Args: password: Password to derive from. salt: Hex-encoded salt (optional, will generate if not provided). iterations: Number of iterations (default 480000, OWASP recommended).

Returns: Dictionary with 'derived_key' (hex) and 'salt' (hex).

Derive key using Scrypt.

Args: password: Password to derive from. salt: Hex-encoded salt (optional, will generate if not provided).

Returns: Dictionary with 'derived_key' (hex) and 'salt' (hex).

Generate a self-signed X.509 certificate.

Args: common_name: Common name for the certificate subject. organization: Organization name (optional). days_valid: Number of days the certificate is valid (default 365).

Returns: Dictionary with 'certificate' (PEM) and 'private_key' (PEM).

Parse X.509 certificate.

Args: certificate_pem: Certificate in PEM format.

Returns: Dictionary with 'subject', 'issuer', 'not_valid_before', 'not_valid_after'.

Generate random bytes.

Args: length: Number of bytes to generate (default 32).

Returns: Hex-encoded random bytes.

Example: >>> generate_random_bytes(16) 'a1b2c3d4e5f6...'

Generate random bytes encoded as base64.

Args: length: Number of bytes to generate (default 32).

Returns: Base64-encoded random string.