initial scaffolding for SDK encryption by Lance-Drane · Pull Request #37 · INTERSECT-SDK/python-sdk

Lance-Drane · 2025-10-02T18:52:57Z

Needs to be completed before done:

- basic scaffolding for encryption (Lance)
- encryption implementation (Marshall/Jesse/Andrew/etc.)
- e2e / integration test examples (Lance/Marshall/Jesse/Andrew/etc.)

(I don't really care too much about unit tests, but you can unit test the encryption function itself if you want)

To add the capability endpoints for a Service (which, IIRC, is just the get_public_key function), add it to IntersectSdkCoreCapability (https://github.com/INTERSECT-SDK/python-sdk/blob/candidate-0.9.0/src/intersect_sdk/capability/universal_capability/universal_capability.py), it should be annotated with @intersect_message . If we need additional state in the capability, we can modify the constructor for this capability and potentially the service as well.

Then you can call the capability with intersect_sdk.<YOUR_FUNCTION_NAME_HERE> as the operation from clients.

The actual encrypt/decrypt functions I would prefer to be separated out into utility functions in another file somewhere under the _internal directory, because both the Service and the Client will use them and users also have no reason to ever use this function themselves. I have marked the areas which need the inserted functions with #TODO comments, there should be one of each in client.py and two of each in service.py.

Signed-off-by: Lance-Drane <Lance-Drane@users.noreply.github.com>

marshallmcdonnell · 2026-02-06T14:40:51Z

UPDATE:

I finally took a stab at adding the encryption into the SDK for this PR!
Mainly, added the encryption module to hold data models and utility functions for encryption and decryption
I am WIP for the service.py and client.py adding in the encryption and decryption TODO spots
- The decryption is relatively simple since it is just to receive an encrypted message and, using local key pair stuff, decrypt the message; I am probably messing it up where I also try to cast it to the unencrypted data model, though
- The more challenging one is the encryption, since this requires client or service to first send a message to get the public key, receive it, and then do the encryption
  - In all honestly, the current state is me throwing LLM coding agent at it first to get an idea of how to start; doesn't seem to work so I'll start working on that

One thing that is sort of blocking me:

I have unit tests passing but need integration and end-to-end testing
Trying to use the docker compose, I cannot get the rabbitmq and minio to work now for me (getting connection refused and such); it might be a network thing locally for me but also noticed we are now on RabbitMQ 4, so not sure if that could also be a culprit
Digging into that now!

Lance-Drane · 2026-06-24T15:27:34Z

        )
+
+    @intersect_message()
+    def get_public_key(self) -> Dict[str, str]:


we should be more explicit with the typing here, we can use Union types if necessary

Lance-Drane · 2026-06-24T15:36:57Z

+from pydantic import BaseModel
+
+class IntersectDecryptedPayload(BaseModel):
+    model: BaseModel


this might need to be an Any typing because we don't necessarily require BaseModels as the input/output models

Lance-Drane · 2026-06-24T15:38:03Z

 - If your Content-Type value is ANYTHING ELSE, you MUST mark it as "bytes" . In this instance, INTERSECT will not base64-encode or base64-decode the value.
 """
+
+IntersectEncryptionScheme = Literal['NONE', 'RSA']


move to intersect-sdk-common: https://github.com/INTERSECT-SDK/intersect-python-common

be more explicit in the RSA typing, i.e. RSA_AES_2048

Lance-Drane · 2026-06-24T15:40:10Z

+from .aes_cypher import AESCipher
+from .client_encryption import intersect_payload_encrypt
+from .service_decryption import intersect_payload_decrypt
+
+
+__all__ = (
+    'AESCipher',
+    'intersect_payload_encrypt',
+    'intersect_payload_decrypt',


Everything in this namespace should probably be moved to intersect-sdk-common: https://github.com/INTERSECT-SDK/intersect-python-common

Lance-Drane · 2026-06-24T15:43:18Z

+        # Generate a key pair for encryption
+        self._private_key: rsa.RSAPrivateKey = rsa.generate_private_key(
+            public_exponent=65537, key_size=2048
+        )
+        self._public_key = self._private_key.public_key()
+
+        # Get the PEM encoded public key
+        self._public_key_pem = self._public_key.public_bytes(
+            encoding=serialization.Encoding.PEM,
+            format=serialization.PublicFormat.SubjectPublicKeyInfo,
+        ).decode()
+
+        self._private_key.private_bytes(
+            encoding=serialization.Encoding.PEM,
+            format=serialization.PrivateFormat.TraditionalOpenSSL,
+            encryption_algorithm=serialization.NoEncryption(),
+        )


we should use a configuration parameter (both here and the Client) to ensure that we can always regenerate the same public/private key. We should also have some logic to allow for key rotation without necessarily restarting the Service/Client.

Lance-Drane · 2026-06-24T15:57:47Z

+        """Basic status function which returns a hard-coded string."""
+        return 'Up'
+
+    @intersect_message()


may want to explicitly set the encryption schemes to the RSA scheme only, to enforce the encryption

Lance-Drane · 2026-06-24T15:58:36Z

+step three: start up client with user callback
+"""
+intersect_client.startup(user_callback=user_callback)
+


this will need to call intersect_sdk.get_public_key before calling say_hello_to_name

Lance-Drane requested review from andrewfayres, jrmcgaha-dev and marshallmcdonnell October 2, 2025 18:52

Lance-Drane assigned marshallmcdonnell and Lance-Drane Oct 2, 2025

marshallmcdonnell force-pushed the 30-add-encryption branch from dcb1cab to 1081765 Compare February 6, 2026 03:26

30 - initial scaffolding for SDK encryption

94e17fb

Signed-off-by: Lance-Drane <Lance-Drane@users.noreply.github.com>

marshallmcdonnell force-pushed the 30-add-encryption branch from 1081765 to 94e17fb Compare February 6, 2026 03:35

marshallmcdonnell added 7 commits February 5, 2026 23:49

Adds cryptography dependency

0e64d7e

Adds encryption module to _internal

e3b1eec

Adds public_key to universal core capability

5915bc2

Adds encryption to service w/ testing + fixes

990d197

Added encryption to client + fix to service

b4c4b43

Adds tests for client encryption code

9ff8f5d

Adds 5_hello_world_rsa example + integration test

f1738f9

marshallmcdonnell changed the title ~~Draft: initial scaffolding for SDK encryption~~ initial scaffolding for SDK encryption Feb 6, 2026

Adding candidate branches for ci workflow

6dd6664

Lance-Drane commented Jun 24, 2026

View reviewed changes

Lance-Drane assigned gecage952 Jun 24, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

initial scaffolding for SDK encryption#37

initial scaffolding for SDK encryption#37
Lance-Drane wants to merge 9 commits into
candidate-0.9.0from
30-add-encryption

Lance-Drane commented Oct 2, 2025 •

edited by marshallmcdonnell

Loading

Uh oh!

marshallmcdonnell commented Feb 6, 2026

Uh oh!

Lance-Drane Jun 24, 2026

Uh oh!

Lance-Drane Jun 24, 2026

Uh oh!

Lance-Drane Jun 24, 2026

Uh oh!

Lance-Drane Jun 24, 2026 •

edited

Loading

Uh oh!

Lance-Drane Jun 24, 2026

Uh oh!

Lance-Drane Jun 24, 2026

Uh oh!

Lance-Drane Jun 24, 2026

Uh oh!

Lance-Drane Jun 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

Lance-Drane commented Oct 2, 2025 • edited by marshallmcdonnell Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

marshallmcdonnell commented Feb 6, 2026

Uh oh!

Lance-Drane Jun 24, 2026

Choose a reason for hiding this comment

Uh oh!

Lance-Drane Jun 24, 2026

Choose a reason for hiding this comment

Uh oh!

Lance-Drane Jun 24, 2026

Choose a reason for hiding this comment

Uh oh!

Lance-Drane Jun 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Lance-Drane Jun 24, 2026

Choose a reason for hiding this comment

Uh oh!

Lance-Drane Jun 24, 2026

Choose a reason for hiding this comment

Uh oh!

Lance-Drane Jun 24, 2026

Choose a reason for hiding this comment

Uh oh!

Lance-Drane Jun 24, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Lance-Drane commented Oct 2, 2025 •

edited by marshallmcdonnell

Loading

Lance-Drane Jun 24, 2026 •

edited

Loading