RSA Digital Signature Tool (python, written by Claude Code)

Claude Code wrote this python project from the task below. It installed and ran on a clean Ubuntu 22.04 machine as written.

Task given to the agent:

TASK: RSA Digital Signature Tool

Write a program that generates RSA key pairs and uses them to create and verify digital signatures on files, ensuring document authenticity and integrity.

FUNCTIONAL REQUIREMENTS:
- Support three subcommands: keygen, sign, and verify
- keygen: Generate an RSA key pair (2048 or 4096 bit, selectable via --bits flag, default 2048) and save the private key and public key as separate PEM files
- sign: Accept a file path and private key path, compute a SHA-256 hash of the file, sign it with RSA-PSS padding, and save the signature as a separate .sig file
- verify: Accept a file path, signature file path, and public key path, then verify the signature and print whether it is valid or invalid with details
- Support signing multiple files at once by accepting a directory path via --batch flag
- Support a --output flag to specify where to save generated keys or signatures
- Display key information: key size, fingerprint (SHA-256 hash of public key), and creation timestamp
- Support exporting the public key in both PEM and DER formats via --format flag
- Print detailed results to console: for signing show the file hash and signature size, for verification show match/mismatch status and key details
- If no arguments are given, generate a sample key pair, create a sample text file, sign it, verify the signature, then tamper with the file and show that verification fails
- Handle errors gracefully: invalid key format, mismatched key/signature, corrupted files, unsupported key sizes

Create a complete Python project for a clean Ubuntu 22.04 machine with only Python 3.10+ installed. Include:
- Source code
- requirements.txt with all dependencies (direct and transitive) pinned to exact versions
- README.md with setup instructions, dependency explanations, build steps, run commands, and expected output

[]

# RSA Digital Signature Tool (Python - cryptography)

Sign and verify files using RSA-2048/4096 with SHA-256.

## Installation

```bash
pip install -r requirements.txt
```

## Usage

```bash
# Generate key pair
python signer.py keygen --bits 2048

# Sign a file
python signer.py sign myfile.txt --key private.pem

# Verify a signature
python signer.py verify myfile.txt --key public.pem

# Run demo (no arguments)
python signer.py
```

## Dependencies

- cryptography==42.0.5

cryptography==42.0.5

#!/usr/bin/env python3
"""RSA Digital Signature Tool using the cryptography library.

Sign and verify files using RSA-2048/4096 with SHA-256.
Supports PEM key format and detached signature files.
"""

import argparse
import sys
import os

from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.primitives.asymmetric import rsa, padding
from cryptography.hazmat.backends import default_backend
from cryptography.exceptions import InvalidSignature


def generate_keys(private_key_path: str, public_key_path: str, key_size: int = 2048) -> None:
    """Generate an RSA key pair and save to PEM files."""
    private_key = rsa.generate_private_key(
        public_exponent=65537,
        key_size=key_size,
        backend=default_backend(),
    )

    # Write private key
    with open(private_key_path, "wb") as f:
        f.write(
            private_key.private_bytes(
                encoding=serialization.Encoding.PEM,
                format=serialization.PrivateFormat.TraditionalOpenSSL,
                encryption_algorithm=serialization.NoEncryption(),
            )
        )

    # Write public key
    public_key = private_key.public_key()
    with open(public_key_path, "wb") as f:
        f.write(
            public_key.public_bytes(
                encoding=serialization.Encoding.PEM,
                format=serialization.PublicFormat.SubjectPublicKeyInfo,
            )
        )

    print(f"Keys generated: {private_key_path}, {public_key_path}")


def sign_file(file_path: str, private_key_path: str, signature_path: str) -> None:
    """Sign a file using an RSA private key. Produces a detached signature."""
    with open(private_key_path, "rb") as f:
        private_key = serialization.load_pem_private_key(
            f.read(), password=None, backend=default_backend()
        )

    with open(file_path, "rb") as f:
        data = f.read()

    signature = private_key.sign(
        data,
        padding.PKCS1v15(),
        hashes.SHA256(),
    )

    with open(signature_path, "wb") as f:
        f.write(signature)

    print(f"Signature written to {signature_path}")


def verify_file(file_path: str, public_key_path: str, signature_path: str) -> bool:
    """Verify a file's detached signature using an RSA public key."""
    with open(public_key_path, "rb") as f:
        public_key = serialization.load_pem_public_key(
            f.read(), backend=default_backend()
        )

    with open(file_path, "rb") as f:
        data = f.read()

    with open(signature_path, "rb") as f:
        signature = f.read()

    try:
        public_key.verify(
            signature,
            data,
            padding.PKCS1v15(),
            hashes.SHA256(),
        )
        print("Signature is VALID.")
        return True
    except InvalidSignature:
        print("Signature is INVALID.")
        return False


def demo() -> None:
    """Run a demonstration with generated keys."""
    print("=== RSA Digital Signature Tool Demo ===\n")

    # Generate keys
    priv_path = "demo_private.pem"
    pub_path = "demo_public.pem"
    demo_file = "demo_message.txt"
    sig_path = "demo_message.txt.sig"

    print("1. Generating RSA-2048 key pair...")
    generate_keys(priv_path, pub_path, key_size=2048)

    # Create demo file
    with open(demo_file, "w") as f:
        f.write("This is a demo message for RSA signature verification.\n")
    print(f"\n2. Created demo file: {demo_file}")

    # Sign
    print("\n3. Signing file...")
    sign_file(demo_file, priv_path, sig_path)

    # Verify
    print("\n4. Verifying signature...")
    verify_file(demo_file, pub_path, sig_path)

    # Tamper and verify
    print("\n5. Tampering with file and verifying again...")
    with open(demo_file, "w") as f:
        f.write("This message has been tampered with!\n")
    verify_file(demo_file, pub_path, sig_path)

    # Cleanup
    for path in [priv_path, pub_path, demo_file, sig_path]:
        if os.path.exists(path):
            os.remove(path)
    print("\n6. Cleaned up demo files.")


def main() -> None:
    parser = argparse.ArgumentParser(description="RSA Digital Signature Tool")
    subparsers = parser.add_subparsers(dest="command")

    # keygen
    kg = subparsers.add_parser("keygen", help="Generate RSA key pair")
    kg.add_argument("--private", default="private.pem", help="Private key output path")
    kg.add_argument("--public", default="public.pem", help="Public key output path")
    kg.add_argument("--bits", type=int, default=2048, choices=[2048, 4096],
                    help="Key size in bits (default: 2048)")

    # sign
    sg = subparsers.add_parser("sign", help="Sign a file")
    sg.add_argument("file", help="File to sign")
    sg.add_argument("--key", default="private.pem", help="Private key path")
    sg.add_argument("--output", help="Signature output path (default: <file>.sig)")

    # verify
    vf = subparsers.add_parser("verify", help="Verify a file signature")
    vf.add_argument("file", help="File to verify")
    vf.add_argument("--key", default="public.pem", help="Public key path")
    vf.add_argument("--signature", help="Signature file path (default: <file>.sig)")

    args = parser.parse_args()

    if args.command is None:
        demo()
        return

    if args.command == "keygen":
        generate_keys(args.private, args.public, args.bits)

    elif args.command == "sign":
        sig_path = args.output if args.output else args.file + ".sig"
        sign_file(args.file, args.key, sig_path)

    elif args.command == "verify":
        sig_path = args.signature if args.signature else args.file + ".sig"
        success = verify_file(args.file, args.key, sig_path)
        sys.exit(0 if success else 1)


if __name__ == "__main__":
    main()