import hashlib

# File integrity check
def file_hash(path: str) -> str:
    h = hashlib.sha256()
    with open(path, 'rb') as f:
        for chunk in iter(lambda: f.read(8192), b''):
            h.update(chunk)
    return h.hexdigest()

# HMAC (keyed hash — prevents length extension attacks)
import hmac
mac = hmac.new(key.encode(), message.encode(), hashlib.sha256)
print(mac.hexdigest())

# Argon2id (recommended)
from argon2 import PasswordHasher, Type

ph = PasswordHasher(time_cost=3, memory_cost=65536, parallelism=4, hash_len=32, type=Type.ID)
hashed = ph.hash("my_secure_password")
# $argon2id$v=19$m=65536,t=3,p=4$...

valid = ph.verify(hashed, "my_secure_password")  # True

# bcrypt
import bcrypt
hashed = bcrypt.hashpw(password.encode(), bcrypt.gensalt(rounds=12))
bcrypt.checkpw(password.encode(), hashed)   # True/False

from cryptography.hazmat.primitives.ciphers.aead import AESGCM
import os

# Generate key (store securely!)
key = AESGCM.generate_key(bit_length=256)
aesgcm = AESGCM(key)

# Encrypt
nonce = os.urandom(12)   # 96-bit nonce, must be unique per message
ciphertext = aesgcm.encrypt(nonce, plaintext.encode(), None)

# Decrypt
plaintext = aesgcm.decrypt(nonce, ciphertext, None).decode()
# Raises InvalidTag if data tampered

from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey

# Generate key pair
private_key = Ed25519PrivateKey.generate()
public_key = private_key.public_key()

# Sign
signature = private_key.sign(message.encode())

# Verify
try:
    public_key.verify(signature, message.encode())
    print("Valid signature")
except Exception:
    print("Invalid signature")

TLS 1.3 Handshake (simplified):
Client → Server: ClientHello (supported cipher suites, key share)
Server → Client: ServerHello + Certificate + (CertificateVerify)
Both:            Derive session keys from key exchange
→ Encrypted application data

Key management lifecycle:
Generation → Storage → Distribution → Rotation → Revocation → Destruction

✓ Store keys in dedicated secrets managers (AWS KMS, HashiCorp Vault, Azure Key Vault)
✓ Rotate keys regularly (annually for AES, per-session for TLS)
✓ Never hardcode keys in source code
✓ Separate encryption keys from encrypted data
✓ Use envelope encryption: data encrypted with DEK, DEK encrypted with KEK