ShieldMod

Supporting both web sessions and desktop JWT tokens with hardware binding

@router.post("/client/login")
async def client_login(
    credentials: ClientLoginRequest,
    db: AsyncSession = Depends(get_db)
):
    # Validate credentials
    user = await authenticate_user(db, credentials.username, credentials.password)

    # Check/register device
    device = await device_service.get_or_create_device(
        db, user.id, credentials.hwid
    )

    # Check device limits
    if device.is_new and user.device_count >= user.max_devices:
        raise HTTPException(400, "Device limit reached")

    # Generate tokens
    access_token = create_access_token(user.id, device.id)
    refresh_token = create_refresh_token(user.id, device.id)

    return {
        "access_token": access_token,
        "refresh_token": refresh_token,
        "device_id": device.id
    }

Server-side file encryption with authenticated encryption

def encrypt_file(plaintext: bytes, key: bytes) -> bytes:
    nonce = os.urandom(12)  # 96-bit nonce
    cipher = Cipher(algorithms.AES(key), modes.GCM(nonce))
    encryptor = cipher.encryptor()
    ciphertext = encryptor.update(plaintext) + encryptor.finalize()

    # Format: nonce (12) + ciphertext (variable) + tag (16)
    return nonce + ciphertext + encryptor.tag

def derive_user_key(user_id: str, access_token: str) -> bytes:
    hkdf = HKDF(
        algorithm=hashes.SHA256(),
        length=32,
        salt=user_id.encode(),
        info=b"file_decryption_key"
    )
    return hkdf.derive(access_token.encode())

Files decrypted entirely in memory - plaintext never touches disk

std::vector<uint8_t> DecryptFile(
    const std::vector<uint8_t>& encrypted,
    const std::string& userId,
    const std::string& accessToken
) {
    // Derive key using HKDF
    auto key = HKDF_SHA256(accessToken, userId, "file_key", 32);

    // Extract nonce, ciphertext, and tag
    auto nonce = std::vector<uint8_t>(
        encrypted.begin(), encrypted.begin() + 12);
    auto tag = std::vector<uint8_t>(
        encrypted.end() - 16, encrypted.end());
    auto ciphertext = std::vector<uint8_t>(
        encrypted.begin() + 12, encrypted.end() - 16);

    // Decrypt with AES-256-GCM
    return AES_GCM_Decrypt(ciphertext, key, nonce, tag);
}

Stable device identification from multiple hardware components

std::string GenerateHWID() {
    std::string components;

    // CPU ID
    int cpuInfo[4];
    __cpuid(cpuInfo, 0);
    components += std::to_string(cpuInfo[1]) + std::to_string(cpuInfo[3]);

    // Motherboard serial (via WMI)
    components += GetWMIProperty("Win32_BaseBoard", "SerialNumber");

    // Windows Product ID
    components += GetRegistryValue(
        "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion",
        "ProductId"
    );

    // Hash everything together
    return SHA256(components);
}