Update app.py

app.py

@@ -1,3 +1,5 @@
+from __future__ import annotations  # tuple[...] compatible con Python 3.8+
+
 import gradio as gr
 import secrets
 import string
@@ -6,7 +8,10 @@ import math
 import json
 import os
 import sys
+import tempfile
 from datetime import datetime
+from PIL import Image
+import io
 
 from cryptography.hazmat.primitives.ciphers.aead import AESGCM
 from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey, Ed25519PublicKey
@@ -181,6 +186,103 @@ def aes_gcm_decrypt(ciphertext_b64, key_hex):
         return {"error": str(e), "success": False}
 
 
+# ─── ESTEGANOGRAFÍA AES-256-GCM + LSB ────────────────────────────────────────
+
+END_MARKER = "1111111111111110"  # 0xFFFE en binario — marcador de fin
+
+def steg_hide(image_bytes: bytes, message: str, password: str = "") -> "tuple[bytes, dict]":
+    """
+    1. Cifra el mensaje con AES-256-GCM (clave aleatoria o derivada de password)
+    2. Convierte el ciphertext Base64 a bits
+    3. Incrusta los bits en el LSB de los canales RGB del PNG
+    Retorna (png_bytes, metadata_dict)
+    """
+    # Cifrar primero
+    enc = aes_gcm_encrypt(message, password)
+    if "error" in enc:
+        return None, {"error": enc["error"]}
+
+    payload = enc["ciphertext"]  # string Base64
+    key_hex = enc["key_hex"]
+
+    binary = "".join(format(b, "08b") for b in payload.encode("utf-8"))
+    binary += END_MARKER
+
+    img = Image.open(io.BytesIO(image_bytes)).convert("RGB")
+    pixels = list(img.getdata())
+
+    # Capacidad: 3 bits por pixel (R, G, B)
+    capacity_bits = len(pixels) * 3
+    if len(binary) > capacity_bits:
+        return None, {"error": f"Imagen demasiado pequeña. Necesitas {len(binary)} bits, capacidad: {capacity_bits}"}
+
+    new_pixels = []
+    bit_idx = 0
+
+    for pixel in pixels:
+        r, g, b = pixel
+        if bit_idx < len(binary):
+            r = (r & 0xFE) | int(binary[bit_idx]); bit_idx += 1
+        if bit_idx < len(binary):
+            g = (g & 0xFE) | int(binary[bit_idx]); bit_idx += 1
+        if bit_idx < len(binary):
+            b = (b & 0xFE) | int(binary[bit_idx]); bit_idx += 1
+        new_pixels.append((r, g, b))
+
+    img.putdata(new_pixels)
+    buf = io.BytesIO()
+    img.save(buf, format="PNG")
+
+    return buf.getvalue(), {
+        "key_hex":         key_hex,
+        "key_b64":         enc["key_b64"],
+        "nonce":           enc["nonce"],
+        "payload_bytes":   len(payload.encode()),
+        "bits_used":       len(binary),
+        "image_capacity":  capacity_bits,
+        "algorithm":       "AES-256-GCM + LSB steganography",
+        "key_source":      enc["key_source"],
+    }
+
+def steg_extract(image_bytes: bytes, key_hex: str) -> dict:
+    """
+    1. Extrae los bits LSB de los canales RGB
+    2. Reconstruye el payload Base64 hasta el END_MARKER
+    3. Descifra con AES-256-GCM usando key_hex
+    """
+    img = Image.open(io.BytesIO(image_bytes)).convert("RGB")
+    pixels = list(img.getdata())
+
+    bits = ""
+    for pixel in pixels:
+        for channel in pixel[:3]:
+            bits += str(channel & 1)
+
+    # Buscar END_MARKER reconstruyendo byte a byte
+    chars = []
+    for i in range(0, len(bits) - 7, 8):
+        byte = bits[i:i+8]
+        chars.append(chr(int(byte, 2)))
+        # Comprobar si los últimos 16 bits de chars forman el END_MARKER
+        if len(chars) >= 2:
+            last_two = "".join(format(ord(c), "08b") for c in chars[-2:])
+            if last_two == END_MARKER:
+                chars = chars[:-2]  # quitar los 2 chars del marcador
+                break
+
+    if not chars:
+        return {"error": "No se encontró marcador de fin. ¿Imagen sin datos ocultos?"}
+
+    payload_b64 = "".join(chars)
+
+    # Descifrar
+    dec = aes_gcm_decrypt(payload_b64, key_hex)
+    if not dec.get("success"):
+        return {"error": f"Descifrado fallido: {dec.get('error', 'clave incorrecta')}"}
+
+    return {"plaintext": dec["plaintext"], "success": True}
+
+
 # ─── ARGON2id ────────────────────────────────────────────────────────────────
 
 def argon2id_hash(password):
@@ -834,7 +936,99 @@ with gr.Blocks(title="CryptoBox Pro", css=css) as demo:
         btn_oauth.click(lambda: (lambda r: f"{r['type']}\n{r['secret']}\n\n{r['length']} chars · ~{r['estimated_bits']} bits")(generate_oauth_secret()),
                         [], [api_output])
 
-    # ── TAB 10 — Auditoría ───────────────────────────────────────────────────
+    # ── TAB 10 — Esteganografía ───────────────────────────────────────────────
+    with gr.Tab("Esteganografía"):
+        gr.Markdown("""
+        ### AES-256-GCM + LSB Steganography
+        Cifra el mensaje con AES-256-GCM y esconde el ciphertext en el bit menos significativo
+        de cada canal RGB de la imagen PNG. Sin la clave, la imagen parece normal.
+        """)
+
+        with gr.Row():
+            # ── OCULTAR ──────────────────────────────────────────────────────
+            with gr.Column():
+                gr.Markdown("#### 🔒 Ocultar mensaje")
+                steg_image_in   = gr.Image(label="Imagen portadora (PNG recomendado)",
+                                           type="filepath", sources=["upload"])
+                steg_msg_in     = gr.Textbox(label="Mensaje a ocultar", lines=4)
+                steg_pwd_in     = gr.Textbox(label="Contraseña (opcional; si vacío → clave aleatoria)",
+                                             type="password")
+                btn_steg_hide   = gr.Button("Cifrar + Ocultar", variant="primary")
+                steg_key_out    = gr.Textbox(label="🔑 Clave AES-256 (HEX) — guárdala",
+                                             interactive=False, elem_classes=["mono"])
+                steg_info_out   = gr.HTML()
+                steg_image_out  = gr.Image(label="Imagen con mensaje oculto",
+                                           type="filepath", interactive=False)
+
+            # ── EXTRAER ──────────────────────────────────────────────────────
+            with gr.Column():
+                gr.Markdown("#### 🔓 Extraer mensaje")
+                steg_image_ext  = gr.Image(label="Imagen con datos ocultos",
+                                           type="filepath", sources=["upload"])
+                steg_key_in     = gr.Textbox(label="Clave AES-256 (HEX)")
+                btn_steg_ext    = gr.Button("Extraer + Descifrar", variant="primary")
+                steg_result_out = gr.Textbox(label="Mensaje recuperado",
+                                             interactive=False, lines=6,
+                                             elem_classes=["mono"])
+
+        # ── Handlers ─────────────────────────────────────────────────────────
+        def on_steg_hide(image_path, message, password):
+            if not image_path:
+                return "", '<div class="info-box">⚠️ Sube una imagen</div>', None
+            if not message:
+                return "", '<div class="info-box">⚠️ Escribe un mensaje</div>', None
+
+            with open(image_path, "rb") as f:
+                image_bytes = f.read()
+
+            png_bytes, meta = steg_hide(image_bytes, message, password)
+
+            if png_bytes is None:
+                return "", f'<div class="info-box">❌ {meta["error"]}</div>', None
+
+            # Guardar imagen resultante en temp — compatible Linux/Windows/macOS
+            out_path = os.path.join(tempfile.gettempdir(), "steg_output.png")
+            with open(out_path, "wb") as f:
+                f.write(png_bytes)
+
+            info_html = (
+                f'<div class="ok-box">'
+                f'<b>Algoritmo:</b> {meta["algorithm"]}<br>'
+                f'<b>Fuente clave:</b> {meta["key_source"]}<br>'
+                f'<b>Nonce:</b> {meta["nonce"]}<br>'
+                f'<b>Bits usados:</b> {meta["bits_used"]} / {meta["image_capacity"]}<br>'
+                f'<b>Ocupación:</b> {meta["bits_used"]/meta["image_capacity"]*100:.2f}%'
+                f'</div>'
+            )
+            return meta["key_hex"], info_html, out_path
+
+        def on_steg_extract(image_path, key_hex):
+            if not image_path:
+                return "⚠️ Sube una imagen"
+            if not key_hex:
+                return "⚠️ Introduce la clave AES-256 en hex"
+
+            with open(image_path, "rb") as f:
+                image_bytes = f.read()
+
+            result = steg_extract(image_bytes, key_hex)
+
+            if not result.get("success"):
+                return f"❌ {result.get('error', 'Error desconocido')}"
+            return result["plaintext"]
+
+        btn_steg_hide.click(
+            on_steg_hide,
+            [steg_image_in, steg_msg_in, steg_pwd_in],
+            [steg_key_out, steg_info_out, steg_image_out],
+        )
+        btn_steg_ext.click(
+            on_steg_extract,
+            [steg_image_ext, steg_key_in],
+            [steg_result_out],
+        )    
+
+    # ── TAB 11 — Auditoría ───────────────────────────────────────────────────
     with gr.Tab("Auditoría"):
         gr.Markdown("### Información del sistema y suite de tests criptográficos")
         with gr.Row():