Encrypt the original SACC file before saving it to disk

[arthurmloureiro]

To avoid accidental unblinding, we should encrypt the original sacc file before saving it. We should also save the encryption key in a text file and provide the user with a smokescreen function to decrypt (unblind) the original SACC.

To Do:

• Implement encryption/decryption functions for SACC files
• Save the key in a re-usable way
• Implement unit tests
• Update documentation
• Add example of how to decrypt from the command line to the documentation.
• Update environment.yaml with new dependencies
• Update pyproject.toml with the new dependencies

Tagging @jablazek and @jessmuir for comments :)

[arthurmloureiro]

We can use the cryptography python package for that.

The follwing is a rough sketch that worked on a notebook:

import pylab as plt
import sacc
from cryptography.fernet import Fernet

# example sacc to encrypt
path_to_sacc = "../examples/cosmic_shear/cosmicshear_sacc.fits"

# Generate a key and save it securely
key = Fernet.generate_key()
cipher_suite = Fernet(key)

# Read and encrypt the FITS file data
with open(path_to_sacc, 'rb') as file:
    file_data = file.read()
encrypted_data = cipher_suite.encrypt(file_data)

# Save the encrypted data to a new file
with open('encrypted_file.fits', 'wb') as file:
    file.write(encrypted_data)

The resulting fits file cannot be read by SACC in any way until it is decrypted properly using:

# decrypting the file and testing if it got corrupted or not:
# Load the key and initialize the cipher
cipher_suite = Fernet(key)

# Read the encrypted file and decrypt it
with open('encrypted_file.fits', 'rb') as file:
    encrypted_data = file.read()
decrypted_data = cipher_suite.decrypt(encrypted_data)

# Save the decrypted data back to a FITS file
with open('decrypted_file.fits', 'wb') as file:
    file.write(decrypted_data)

We need to find a safe way to store the decryption key though.