Below is a comprehensive breakdown of what each part of your Flask + PKI-based Secure Chat App code does:

from flask import Flask, request, session, ...
from cryptography.hazmat.primitives import ...
from Crypto.Cipher import AES
...

• Flask: Web framework to handle routing, sessions, file uploads.
• Cryptography & PyCrypto: Used for asymmetric (RSA) and symmetric (AES) encryption, certificate generation, signing, and verifying.
• SQLite3: Lightweight database for storing users, messages, files.
• os, io, secrets, logging: For file management, generating tokens, logging, and in-memory file handling.

app = Flask(__name__)
app.secret_key = secrets.token_hex(16)
UPLOAD_FOLDER = 'Uploads'
...

• Initializes Flask app.
• Generates a random secret key for session security.
• Creates a folder to store uploaded files (if not already exists).
• Configures logging.

ca_private_key = rsa.generate_private_key(...)

• Creates a Certificate Authority (CA) private/public key for issuing certificates to users.

def init_db():

• Creates 3 tables:

  1. users: Stores username, role, public key, certificate.
  2. chats: Stores chat messages (sender, receiver, message, timestamp, signature).
  3. files: Stores encrypted files (with encrypted AES key), filename, sender/receiver.

• Generates user’s RSA key pair.
• Creates a self-signed certificate for the user, signed by the CA.

• Verifies the certificate's signature using the CA’s public key.

• Extracts details like subject, issuer, validity period, and serial number from the certificate.

• Signs the data (message or filename) using user’s private key (PKCS#1 v1.5 + SHA-256).

• Verifies that the signature matches the data using the public key.

• Encrypts the file content using AES.
• Encrypts the AES key using the receiver’s RSA public key.

• Decrypts AES key using the user’s private key.
• Decrypts file content using AES.

def starts_with_filter(...)

• Adds a custom filter starts_with for template use (e.g., to check if strings start with a prefix).

• Renders the homepage (e.g., links to login/register).

• GET: Displays registration form.

• POST:

  • Gets username & role from form.
  • Checks for existing user.
  • Generates keys and certificate.
  • Stores public key and certificate in DB.
  • Saves private key and certificate in session (for further use).
  • Redirects to /show_key.

• Displays:

  • User’s private key
  • Certificate PEM
  • Parsed certificate details.

• Sends user’s certificate as a .pem download.

• GET: Renders login form.

• POST:

  • Accepts username and pasted private key PEM.
  • Reconstructs public key and validates against DB.
  • Verifies that certificate is valid and matches.
  • Logs user in by saving session values.

• Core chat handler.

• GET:

  • Loads all private/public chats and related users.
  • Verifies signatures and certificates for integrity.
  • Groups private chats per user.

• POST:

  • Sends message:

    • Signs it with private key.
    • Inserts into DB (private/public depending on form).

• DELETE:

  • Deletes a message if sender matches session user.

• Accepts file upload.

• Encrypts the file using:

  • AES for content.
  • RSA (receiver's key) for the AES key.

• Signs the filename using sender's private key.

• Stores encrypted file in the DB.

• Retrieves file by ID.
• Verifies signature using sender’s public key.
• Decrypts AES key and content.
• Returns file to user.

app.run(host='0.0.0.0', port=25569, debug=True)

• Starts the Flask development server on port 25569.