Encrypt customer private key with Google public key

import argparse import base64 import os from typing import Optional from cryptography import x509 from cryptography.hazmat.backends import default_backend from cryptography.hazmat.primitives import hashes from cryptography.hazmat.primitives.asymmetric import padding from cryptography.hazmat.primitives.asymmetric.rsa import RSAPublicKey import requests GOOGLE_PUBLIC_CERT_URL = ( "https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem" ) def get_google_public_cert_key() -> RSAPublicKey:  """  Downloads the Google public certificate.  Returns:  RSAPublicKey object with the Google public certificate.  """ r = requests.get(GOOGLE_PUBLIC_CERT_URL) r.raise_for_status() # Load the certificate. certificate = x509.load_pem_x509_certificate(r.content, default_backend()) # Get the certicate's public key. public_key = certificate.public_key() return public_key def wrap_rsa_key(public_key: RSAPublicKey, private_key_bytes: bytes) -> bytes:  """  Use the Google public key to encrypt the customer private key.  This means that only the Google private key is capable of decrypting  the customer private key.  Args:  public_key: The public key to use for encrypting.  private_key_bytes: The private key to be encrypted.  Returns:  private_key_bytes encrypted using the public_key. Encoded using  base64.  """ wrapped_key = public_key.encrypt( private_key_bytes, padding.OAEP( mgf=padding.MGF1(algorithm=hashes.SHA1()), algorithm=hashes.SHA1(), label=None, ), ) encoded_wrapped_key = base64.b64encode(wrapped_key) return encoded_wrapped_key def main(key_file: Optional[str]) -> None:  """  This script will encrypt a private key with Google public key.  Args:  key_file: path to a file containing your private key. If not  provided, a new key will be generated (256 bit).  """ # Generate a new 256-bit private key if no key is specified. if not key_file: customer_key_bytes = os.urandom(32) else: with open(key_file, "rb") as f: customer_key_bytes = f.read() google_public_key = get_google_public_cert_key() wrapped_rsa_key = wrap_rsa_key(google_public_key, customer_key_bytes) b64_key = base64.b64encode(customer_key_bytes).decode("utf-8") print(f"Base-64 encoded private key: {b64_key}") print(f"Wrapped RSA key: {wrapped_rsa_key.decode('utf-8')}") if __name__ == "__main__": parser = argparse.ArgumentParser( description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter ) parser.add_argument("--key_file", help="File containing your binary private key.") args = parser.parse_args() main(args.key_file)