Encryption System

from cryptography.hazmat.primitives.ciphers.aead import AESGCM
from liboqs import KEMs
import os
import datetime

class QuantumSafeKeyManager:
    def __init__(self, rotation_period_days=90):
        self.rotation_period = datetime.timedelta(days=rotation_period_days)
        self.last_rotation_date = datetime.datetime.now()
        # Initialize quantum-safe KEM keys
        self.kem = KEMs().default()  # This selects the default KEM, adjust as necessary
        self.public_key, self.secret_key = self.kem.keypair()

    def check_and_rotate_keys(self):
        # Check if it's time to rotate the KEM keys and do so if necessary.
        if datetime.datetime.now() - self.last_rotation_date > self.rotation_period:
            self.public_key, self.secret_key = self.kem.keypair()
            self.last_rotation_date = datetime.datetime.now()
            print("KEM keys rotated.")

class EnhancedHybridEncryption:
    def __init__(self):
        self.key_manager = QuantumSafeKeyManager()  # Handles quantum-safe KEM key lifecycle.
    
    def generate_symmetric_key(self):
        # Symmetric key generation for AES encryption.
        return AESGCM.generate_key(bit_length=256)
    
    def encrypt(self, plaintext):
        self.key_manager.check_and_rotate_keys()  # Ensure KEM keys are current.
        
        aesgcm = AESGCM(self.generate_symmetric_key())
        nonce = os.urandom(12)
        encrypted_data = aesgcm.encrypt(nonce, plaintext.encode(), None)
        
        encapsulated_key, shared_secret = self.key_manager.kem.encapsulate(self.key_manager.public_key)
        
        return {
            "encrypted_data": encrypted_data,
            "nonce": nonce,
            "encapsulated_key": encapsulated_key,
        }
    
    def decrypt(self, encryption_bundle):
        shared_secret = self.key_manager.kem.decapsulate(encryption_bundle["encapsulated_key"], self.key_manager.secret_key)
        
        aesgcm = AESGCM(shared_secret)
        decrypted_data = aesgcm.decrypt(encryption_bundle["nonce"], encryption_bundle["encrypted_data"], None)
        
        return decrypted_data.decode()

# Note: Implementations for HSM interactions and secret sharing require specific APIs and infrastructure not provided here.