Mecanismos de Cifrado en Reposo y en Tránsito

-- Ejemplo configuración PostgreSQL
-- Transparent Data Encryption (TDE)
ALTER SYSTEM SET shared_preload_libraries = 'pg_tde';
ALTER SYSTEM SET pg_tde.keyring_configuration = 'aws-kms';

# AWS S3 Bucket Encryption
aws_s3_bucket_server_side_encryption_configuration:
  rule:
    apply_server_side_encryption_by_default:
      sse_algorithm: "aws:kms"
      kms_master_key_id: "arn:aws:kms:region:account:key/key-id"

// Configuración de cifrado a nivel de aplicación
const crypto = require('crypto');
const algorithm = 'aes-256-gcm';

function encryptData(text, key) {
  const iv = crypto.randomBytes(16);
  const cipher = crypto.createCipher(algorithm, key, iv);
  
  let encrypted = cipher.update(text, 'utf8', 'hex');
  encrypted += cipher.final('hex');
  
  const authTag = cipher.getAuthTag();
  return {
    encrypted,
    iv: iv.toString('hex'),
    authTag: authTag.toString('hex')
  };
}

# Configuración segura TLS
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-CHACHA20-POLY1305;
ssl_prefer_server_ciphers off;
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:50m;
ssl_stapling on;
ssl_stapling_verify on;

# HSTS
add_header Strict-Transport-Security "max-age=63072000" always;

graph TB
    A[HSM Principal] --> B[KMS Regional]
    B --> C[Claves de Cifrado de Datos]
    B --> D[Claves de Cifrado de Claves]
    
    E[Aplicaciones] --> F[SDK Cifrado]
    F --> B
    
    G[Rotación Automática] --> B
    H[Auditoría] --> I[Logs de Acceso]
    B --> I

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DivisionCeroKMSPolicy",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::ACCOUNT:role/DivisionCero-EncryptionRole"
      },
      "Action": [
        "kms:Encrypt",
        "kms:Decrypt",
        "kms:ReEncrypt*",
        "kms:GenerateDataKey*",
        "kms:DescribeKey"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "kms:EncryptionContext:Department": "Engineering"
        }
      }
    }
  ]
}

// Configuración crypto-js para frontend
import CryptoJS from 'crypto-js';

const encryptionConfig = {
  keySize: 256 / 32,
  ivSize: 128 / 32,
  mode: CryptoJS.mode.GCM,
  padding: CryptoJS.pad.NoPadding
};

function encryptSensitiveData(data, passphrase) {
  const salt = CryptoJS.lib.WordArray.random(256 / 8);
  const key = CryptoJS.PBKDF2(passphrase, salt, {
    keySize: encryptionConfig.keySize,
    iterations: 100000
  });
  
  const iv = CryptoJS.lib.WordArray.random(encryptionConfig.ivSize);
  const encrypted = CryptoJS.AES.encrypt(data, key, {
    iv: iv,
    mode: encryptionConfig.mode
  });
  
  return {
    salt: salt.toString(CryptoJS.enc.Hex),
    iv: iv.toString(CryptoJS.enc.Hex),
    encrypted: encrypted.toString()
  };
}

-- Extensión de cifrado pgcrypto
CREATE EXTENSION IF NOT EXISTS pgcrypto;

-- Tabla con campos cifrados
CREATE TABLE usuarios_datos_sensibles (
    id SERIAL PRIMARY KEY,
    email VARCHAR(255),
    documento_cifrado BYTEA,
    telefono_cifrado BYTEA,
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
);

-- Función para insertar datos cifrados
CREATE OR REPLACE FUNCTION insertar_usuario_seguro(
    p_email VARCHAR(255),
    p_documento TEXT,
    p_telefono TEXT,
    p_clave TEXT
)
RETURNS INTEGER AS $$
DECLARE
    nuevo_id INTEGER;
BEGIN
    INSERT INTO usuarios_datos_sensibles (
        email,
        documento_cifrado,
        telefono_cifrado
    )
    VALUES (
        p_email,
        pgp_sym_encrypt(p_documento, p_clave),
        pgp_sym_encrypt(p_telefono, p_clave)
    )
    RETURNING id INTO nuevo_id;
    
    RETURN nuevo_id;
END;
$$ LANGUAGE plpgsql;

# Configuración de secretos cifrados en K8s
apiVersion: v1
kind: Secret
metadata:
  name: divisioncero-encryption-keys
  namespace: production
type: Opaque
data:
  database-key: <base64-encoded-key>
  api-secret: <base64-encoded-secret>
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: divisioncero-api
spec:
  template:
    spec:
      containers:
      - name: api
        image: divisioncero/api:latest
        env:
        - name: ENCRYPTION_KEY
          valueFrom:
            secretKeyRef:
              name: divisioncero-encryption-keys
              key: database-key
        volumeMounts:
        - name: tls-certs
          mountPath: /etc/tls
          readOnly: true
      volumes:
      - name: tls-certs
        secret:
          secretName: divisioncero-tls-certs

// Métricas Prometheus para cifrado
const prometheus = require('prom-client');

const encryptionMetrics = {
  operationsTotal: new prometheus.Counter({
    name: 'encryption_operations_total',
    help: 'Total encryption operations',
    labelNames: ['operation', 'algorithm', 'status']
  }),
  
  keyRotationGauge: new prometheus.Gauge({
    name: 'encryption_key_age_days',
    help: 'Age of encryption keys in days',
    labelNames: ['key_id', 'key_type']
  }),
  
  tlsConnectionsGauge: new prometheus.Gauge({
    name: 'tls_connections_active',
    help: 'Active TLS connections by version',
    labelNames: ['tls_version', 'cipher_suite']
  })
};

#!/bin/bash
# Script de rotación de claves automatizada

set -euo pipefail

ENVIRONMENT=${1:-staging}
KMS_KEY_ID="arn:aws:kms:us-east-1:ACCOUNT:key/KEY-ID"

echo "Iniciando rotación de claves para entorno: $ENVIRONMENT"

# 1. Crear nueva versión de clave
aws kms create-key \
  --policy file://kms-policy.json \
  --description "DivisionCero $ENVIRONMENT encryption key $(date +%Y%m%d)" \
  --key-usage ENCRYPT_DECRYPT \
  --key-spec SYMMETRIC_DEFAULT

# 2. Actualizar alias
NEW_KEY_ID=$(aws kms list-keys --query "Keys[0].KeyId" --output text)
aws kms update-alias \
  --alias-name "alias/divisioncero-$ENVIRONMENT" \
  --target-key-id "$NEW_KEY_ID"

# 3. Notificar a equipos
curl -X POST "$SLACK_WEBHOOK" \
  -H 'Content-type: application/json' \
  --data "{\"text\":\"🔐 Rotación de claves completada para $ENVIRONMENT\"}"

echo "Rotación completada. Nueva clave: $NEW_KEY_ID"

#!/usr/bin/env python3
"""
Script de verificación de conformidad criptográfica
"""

import ssl
import socket
import subprocess
import json
from datetime import datetime

def verificar_tls_endpoint(hostname, port=443):
    """Verifica la configuración TLS de un endpoint"""
    context = ssl.create_default_context()
    
    try:
        with socket.create_connection((hostname, port), timeout=10) as sock:
            with context.wrap_socket(sock, server_hostname=hostname) as ssock:
                cipher = ssock.cipher()
                cert = ssock.getpeercert()
                
                return {
                    'hostname': hostname,
                    'tls_version': ssock.version(),
                    'cipher_suite': cipher[0] if cipher else None,
                    'certificate_expires': cert.get('notAfter'),
                    'compliant': cipher[0] in APPROVED_CIPHERS if cipher else False
                }
    except Exception as e:
        return {
            'hostname': hostname,
            'error': str(e),
            'compliant': False
        }

def verificar_base_datos():
    """Verifica configuración de cifrado en BD"""
    try:
        result = subprocess.run([
            'psql', '-h', 'localhost', '-U', 'postgres',
            '-c', 'SHOW ssl;'
        ], capture_output=True, text=True)
        
        return {
            'ssl_enabled': 'on' in result.stdout,
            'compliant': 'on' in result.stdout
        }
    except Exception as e:
        return {'error': str(e), 'compliant': False}

# Constantes de conformidad
APPROVED_CIPHERS = [
    'TLS_AES_256_GCM_SHA384',
    'TLS_CHACHA20_POLY1305_SHA256',
    'ECDHE-RSA-AES256-GCM-SHA384'
]

if __name__ == "__main__":
    endpoints = [
        'api.divisioncero.com',
        'app.divisioncero.com',
        'admin.divisioncero.com'
    ]
    
    report = {
        'timestamp': datetime.now().isoformat(),
        'endpoints': [],
        'database': verificar_base_datos()
    }
    
    for endpoint in endpoints:
        report['endpoints'].append(verificar_tls_endpoint(endpoint))
    
    print(json.dumps(report, indent=2))

# Template de evidencia de cumplimiento
evidencia_cifrado:
  fecha: "2024-03-20"
  auditor: "[email protected]"
  alcance:
    - "Aplicaciones web principales"
    - "Bases de datos productivas"
    - "Comunicaciones inter-servicios"
  
  hallazgos:
    - control: "A.10.1.1 - Política de uso de controles criptográficos"
      estado: "CUMPLE"
      evidencia: "Documento mecanismos-cifrado.mdx v2.1.0"
    
    - control: "A.10.1.2 - Gestión de llaves"
      estado: "CUMPLE"
      evidencia: "AWS KMS configurado con rotación automática"
  
  excepciones:
    - sistema: "Sistema legacy CRM v1.0"
      justificacion: "Migración programada Q2 2024"
      plan_mitigacion: "Segmentación de red + monitoreo adicional"