DP

1. Write a program to perform encryption and decryption using Caesar cipher (substitutional cipher).

def encrypt(text, key):
    result = ""
    for char in text:
        if char.isalpha():
            base = ord('A') if char.isupper() else ord('a')
            result += chr((ord(char) - base + key) % 26 + base)
        else:
            result += char
    return result


def decrypt(text, key):
    result = ""
    for char in text:
        if char.isalpha():
            base = ord('A') if char.isupper() else ord('a')
            result += chr((ord(char) - base - key) % 26 + base)
        else:
            result += char
    return result


# -------------------------------
# Main Program
# -------------------------------
text = input("Enter text: ")
key = int(input("Enter key (shift value): "))

encrypted = encrypt(text, key)
print("Encrypted text:", encrypted)

decrypted = decrypt(encrypted, key)
print("Decrypted text:", decrypted)

-------
2. Write a program to perform encryption and decryption using Rail Fence Cipher. (transpositional cipher)

# Rail Fence Cipher Encryption
def encrypt_rail_fence(text, key):
    rail = [['\n' for _ in range(len(text))]
            for _ in range(key)]

    # To determine the direction
    dir_down = False
    row, col = 0, 0

    for i in range(len(text)):
        # change direction when you reach top or bottom
        if row == 0 or row == key - 1:
            dir_down = not dir_down

        rail[row][col] = text[i]
        col += 1

        # move up or down
        row += 1 if dir_down else -1

    # build the result
    result = []
    for i in range(key):
        for j in range(len(text)):
            if rail[i][j] != '\n':
                result.append(rail[i][j])

    return "".join(result)


# Rail Fence Cipher Decryption
def decrypt_rail_fence(cipher, key):
    rail = [['\n' for _ in range(len(cipher))]
            for _ in range(key)]

    # Mark the positions with '*'
    dir_down = None
    row, col = 0, 0

    for i in range(len(cipher)):
        if row == 0:
            dir_down = True
        if row == key - 1:
            dir_down = False

        rail[row][col] = '*'
        col += 1
        row += 1 if dir_down else -1

    # Fill the marked positions with cipher characters
    index = 0
    for i in range(key):
        for j in range(len(cipher)):
            if rail[i][j] == '*' and index < len(cipher):
                rail[i][j] = cipher[index]
                index += 1

    # Read the text by zig-zag manner
    result = []
    row, col = 0, 0

    for i in range(len(cipher)):
        if row == 0:
            dir_down = True
        if row == key - 1:
            dir_down = False

        result.append(rail[row][col])
        col += 1
        row += 1 if dir_down else -1

    return "".join(result)


# -------------------------------------
# Main Program
# -------------------------------------
text = input("Enter text: ")
key = int(input("Enter key (number of rails): "))

encrypted = encrypt_rail_fence(text, key)
print("Encrypted Text:", encrypted)

decrypted = decrypt_rail_fence(encrypted, key)
print("Decrypted Text:", decrypted)

-------
3. Vigenère Cipher

# Function to generate the key
def generate_key(text, key):
    key = list(key)
    if len(key) < len(text):
        for i in range(len(text) - len(key)):
            key.append(key[i % len(key)])
    return "".join(key)

# Encrypt the plaintext
def encrypt(text, key):
    cipher_text = []
    for i in range(len(text)):
        if text[i].isalpha():
            shift = ord(key[i].upper()) - ord('A')
            base = ord('A') if text[i].isupper() else ord('a')
            cipher_text.append(chr((ord(text[i]) - base + shift) % 26 + base))
        else:
            cipher_text.append(text[i])
    return "".join(cipher_text)

# Decrypt the ciphertext
def decrypt(cipher, key):
    orig_text = []
    for i in range(len(cipher)):
        if cipher[i].isalpha():
            shift = ord(key[i].upper()) - ord('A')
            base = ord('A') if cipher[i].isupper() else ord('a')
            orig_text.append(chr((ord(cipher[i]) - base - shift) % 26 + base))
        else:
            orig_text.append(cipher[i])
    return "".join(orig_text)

# -----------------------------------
# Main program
# -----------------------------------
text = input("Enter text: ")
keyword = input("Enter key: ")

key = generate_key(text, keyword)

encrypted = encrypt(text, key)
print("Encrypted Text:", encrypted)

decrypted = decrypt(encrypted, key)
print("Decrypted Text:", decrypted)

-------
4. Write a Python program that defines a function and takes a password string as input and returns its SHA-256 hashed representation as a hexadecimal string.

import hashlib

def sha256_hash(password):
    # Encode string to bytes, then hash using SHA-256
    hash_object = hashlib.sha256(password.encode())
    # Return hexadecimal representation
    return hash_object.hexdigest()

# Main program
password = input("Enter password: ")
hashed_password = sha256_hash(password)

print("SHA-256 Hash:", hashed_password)

-------
5. Write a Python program that reads a file containing a list of usernames and passwords, one pair per line (separated by a comma). It checks each password to see if it has been leaked in a data breach. You can use the "Have I Been Pwned" API (https://haveibeenpwned.com/API/v3) to check if a password has been leaked.

On terminal - pip3 install requests, navigate to same folder by cd and ls

Contents for file "credentials.txt"
alice,Password123
bob,123456
sahana,myStrongPass!

import hashlib
import requests

HIBP_API_RANGE_URL = "https://api.pwnedpasswords.com/range/"


def check_password_pwned(password):
    """
    Returns the number of times the password appeared in breaches.
    If 0 is returned, password is (so far) not found in HIBP database.
    Uses k-anonymity: only first 5 chars of SHA-1 hash are sent.
    """
    # 1. SHA-1 hash of password (uppercase hex)
    sha1_hash = hashlib.sha1(password.encode('utf-8')).hexdigest().upper()
    prefix = sha1_hash[:5]          # first 5 chars
    suffix = sha1_hash[5:]          # remaining 35 chars

    # 2. Query HIBP range API with prefix
    url = HIBP_API_RANGE_URL + prefix
    response = requests.get(url)

    if response.status_code != 200:
        print(f"Error: HIBP API request failed with status {response.status_code}")
        return -1  # indicate error

    # 3. API returns many suffixes with counts: HASH_SUFFIX:COUNT
    hashes = response.text.splitlines()

    for line in hashes:
        hash_suffix, count = line.split(':')
        if hash_suffix == suffix:
            return int(count)  # password found this many times

    return 0  # not found


def process_credentials_file(filename):
    try:
        with open(filename, 'r') as f:
            for line in f:
                line = line.strip()
                if not line:
                    continue  # skip empty lines

                # Expect: username,password
                try:
                    username, password = line.split(',', 1)
                except ValueError:
                    print(f"Skipping malformed line: {line}")
                    continue

                count = check_password_pwned(password)

                if count == -1:
                    print(f"[ERROR] Could not check password for user: {username}")
                elif count == 0:
                    print(f"[SAFE ] {username} — password not found in breaches.")
                else:
                    print(f"[PWNED] {username} — password found {count} times in breaches!")
    except FileNotFoundError:
        print(f"File '{filename}' not found.")


# ---------------------------
# Main program
# ---------------------------
if __name__ == "__main__":
    filename = input("Enter credentials filename: ")  # e.g., credentials.txt
    process_credentials_file(filename)

-------
6. Write a Python program that generates a password using a random combination of words from a dictionary file.

content for "words.txt"
apple
cloud
river
mountain
python
secure
silver
stone

import random

def generate_password(dictionary_file, num_words=3):
    try:
        # Read words from file
        with open(dictionary_file, "r") as file:
            words = [word.strip() for word in file.readlines() if word.strip()]

        if len(words) < num_words:
            print("Not enough words in dictionary to generate password.")
            return None

        # Randomly choose words
        selected_words = random.sample(words, num_words)

        # Create password (you can add symbols/numbers if needed)
        password = "".join(selected_words)

        return password

    except FileNotFoundError:
        print(f"Dictionary file '{dictionary_file}' not found.")
        return None


# ---------------------------
# Main Program
# ---------------------------
dictionary_file = input("Enter dictionary filename: ")   # e.g., words.txt

password = generate_password(dictionary_file)

if password:
    print("Generated Password:", password)

--------
7. Brute Force attack on password

import itertools
import string

def brute_force_attack(password):
    characters = string.ascii_lowercase   # a–z
    attempts = 0

    print("Starting brute-force simulation...\n")

    # Try increasing lengths until found
    for length in range(1, 6):  # limit to length 5 for safety
        for combo in itertools.product(characters, repeat=length):
            guess = "".join(combo)
            attempts += 1

            if guess == password:
                print(f"Password found: {guess}")
                print(f"Total attempts: {attempts}")
                return True

    print("Password not found within the attempt limit.")
    return False


# -------------------------
# Main Program
# -------------------------
target_password = input("Enter the password to brute-force (lowercase only): ")
brute_force_attack(target_password)

---------
8. Digitally sign document

Download Adobe Acrobat Reader DC
➤ Create digital ID
↪ name, email, name of org, serial no. & expiration Date
↳ Edit → Preferences → Signature → Identities & trusted certificates →
A new digital ID → Next →
fill details → Next → Create Password
➤ Customize appearence of DS
→ Open any PDF Sample
→ click sign, Add signature
→ Place signature in blank space & take ss
→ convert image png/pdf sign.pdf
→ Edit → Preferences → Creation & Appearence
→ Create new appearence → Give title
➤ Imported graphic → Import pdf file
→ Configure text → OK → × → ×
Now add PDF file on which u want to place
→ Tools
→ Certificate
→ Digitally signed → Draw in area using mouse
→ Select → Then appearence → lock the pdf → password



Below is your **ULTIMATE CASE-STUDY CHEAT SHEET** for the **Digital Personal Data Protection Act, 2023**, fully based on your uploaded PDF.
This is structured so that **the moment you read a case, you can immediately tell: “This belongs to Section __”** and also quote the *exact relevant line* from the Act.

All statements below are sourced directly from the uploaded **DPDP Act, 2023** PDF.


---

# ✅ **CHEAT SHEET — Identify Case Study → Section in 5 Seconds**

Each section has:

### • **What the section covers**

### • **Keywords you must detect in case studies**

### • **When to apply it**

### • **Exact line from Act to quote** (paraphrased but accurate)

---

# 🔵 **CHAPTER I — PRELIMINARY**

## **SECTION 2 — DEFINITIONS**

### **Use when case involves:**

* Is this *personal data*?
* Who is *Data Fiduciary / Data Principal*?
* What counts as *processing*?

### **Keywords:**

“Identifiable information”, “processing”, “digital data”, “data fiduciary”, “data processor”.

### **Relevant line to quote:**

* *Personal data means any data about an individual who is identifiable.* (Sec 2(t))
* *Processing includes collection, storage, sharing, erasure, etc.* (Sec 2(x))


---

## **SECTION 3 — APPLICATION OF THE ACT**

### **Use when case describes exemption from Act.**

### **Keywords:**

* “Publicly available data”
* “Domestic/personal use”
* “Data collected outside India but used for Indian users”

### **Relevant line:**

* *Act does not apply to personal or domestic use, or data made publicly available by the data principal.* (Sec 3(c))


---

# 🔵 **CHAPTER II — OBLIGATIONS OF DATA FIDUCIARY**

---

## **SECTION 4 — GROUNDS FOR PROCESSING PERSONAL DATA**

### **Use when:**

Company processes data without lawful basis.

### **Keywords:**

“Lawful purpose”, “consent not taken”, “illegitimate processing”.

### **Relevant line:**

* *Personal data may be processed only for a lawful purpose with consent or legitimate uses.* (Sec 4(1))


---

## **SECTION 5 — NOTICE**

### **Use when:**

User was not told why data is collected or how it will be used.

### **Keywords:**

“No notice given”, “no privacy policy”, “hidden processing”.

### **Relevant line:**

* *Every request for consent must be accompanied by a notice informing purpose and data categories.* (Sec 5(1))


---

## **SECTION 6 — CONSENT**

### **Use when:**

The case involves invalid or missing consent.

### **Keywords:**

“Pre-ticked boxes”, “forced consent”, “app took extra permissions”, “withdrawing consent ignored”.

### **Relevant line:**

* *Consent must be free, specific, informed, unambiguous and for necessary data only.* (Sec 6(1))
* *Data principal has right to withdraw consent anytime.* (Sec 6(4))


---

## **SECTION 7 — CERTAIN LEGITIMATE USES**

### **Use when:**

Data used **without consent** under legally allowed grounds.

### **Keywords:**

“Government benefit schemes”, “medical emergency”, “legal obligation”, “employment-related processing”.

### **Relevant line:**

* *Data may be processed without consent for subsidies, benefits, medical emergencies, legal obligations, employment purposes, etc.* (Sec 7)


---

## **SECTION 8 — GENERAL OBLIGATIONS OF DATA FIDUCIARY**

### Apply this section MOST FREQUENTLY in case studies.

### **Use when:**

* Data breach
* Data retention violation
* Security lapse
* Accuracy issues
* Grievance redressal failure
* Sharing data with processors without safeguards

### **Keywords:**

“Leak”, “breach”, “company did not secure data”, “kept data after purpose”, “did not erase data”, “did not inform users”.

### **Relevant lines:**

* *Fiduciary must ensure completeness, accuracy, consistency of data.* (Sec 8(3))
* *Must take reasonable security safeguards to prevent breaches.* (Sec 8(5))
* *Must intimate Board and affected data principals about breaches.* (Sec 8(6))
* *Must erase data when purpose is complete or consent withdrawn.* (Sec 8(7))


---

## **SECTION 9 — PROCESSING OF CHILDREN’S DATA**

### **Use when:**

Data of minors <18 is misused or consent from parent not taken.

### **Keywords:**

“Child profile”, “tracking children”, “targeted ads to kids”.

### **Relevant line:**

* *Must obtain verifiable parental consent; behavioural tracking & targeted ads for children are forbidden.* (Sec 9(1),(3))


---

## **SECTION 10 — SIGNIFICANT DATA FIDUCIARY**

### **Use when:**

Case involves large-scale platform (bank, social media, fintech, etc.)

### **Keywords:**

“High-risk processing”, “Data Protection Officer”, “DPIA”, “data audit”.

### **Relevant line:**

* *Significant DF must appoint DPO, conduct DPIA, carry out audits.* (Sec 10(2))


---

# 🔵 **CHAPTER III — RIGHTS OF DATA PRINCIPAL**

---

## **SECTION 11 — RIGHT TO ACCESS INFORMATION**

### **Use when:**

User asks company: “What data do you have about me?”

### **Keywords:**

“Access request”, “show me my data”.

### **Relevant line:**

* *User can request a summary of personal data & all entities it is shared with.* (Sec 11(1))


---

## **SECTION 12 — RIGHT TO CORRECTION, COMPLETION & ERASURE**

### **Use when:**

User asks for correction or deletion but company refuses.

### **Keywords:**

“Delete my account”, “correct wrong data”, “update address”.

### **Relevant line:**

* *Fiduciary must correct inaccurate data and erase personal data when requested unless retention is legally required.* (Sec 12(2),(3))


---

## **SECTION 13 — GRIEVANCE REDRESSAL**

### **Use when:**

Company does not respond to complaints.

### **Keywords:**

“Support didn’t respond”, “no grievance officer”.

### **Relevant line:**

* *DF must provide grievance redressal and respond within the prescribed period.* (Sec 13(2))


---

## **SECTION 14 — RIGHT TO NOMINATE**

### **Use when:**

Case mentions actions after death or incapacity.

---

## **SECTION 15 — DUTIES OF DATA PRINCIPAL**

### **Use when:**

User abuses system, impersonates, files fake complaints.

---

# 🔵 **CHAPTER IV — SPECIAL PROVISIONS**

---

## **SECTION 16 — RESTRICTION ON CROSS-BORDER TRANSFER**

### **Use when:**

Company transfers data to a banned country.

---

## **SECTION 17 — EXEMPTIONS**

### **Use when:**

Processing done for police, court, research, etc.

### **Keywords:**

“Investigation”, “legal claim”, “court order”, “Sovereignty”, “public order”.

### **Relevant line:**

* *Act does not apply when data is processed for investigation, court functions, enforcing legal rights, research without identifying the data principal.* (Sec 17(1),(2))


---

# 🔵 **CHAPTER V–VII — BOARD, PROCESS, APPEALS**

Use these only when case involves:

* Complaint
* Board inquiry
* Penalty process
* Appeal to tribunal

Not common in exams.

---

# 🔵 **CHAPTER VIII — PENALTIES**

## **SECTION 33 + SCHEDULE**

### **Use when:**

Case study asks: *What penalty applies?*

### **Relevant penalties:**

* Security safeguard breach → up to **₹250 crore**
* Breach of children’s data obligations → **₹200 crore**
* Significant Data Fiduciary obligations → **₹150 crore**
* All other violations → **₹50 crore**



Use this to instantly map case → section:

| Case Study Keyword            | Section                  | Reason                         |
| ----------------------------- | ------------------------ | ------------------------------ |
| Data leak, weak security      | **Sec 8(5)**             | Security safeguards            |
| Company hid breach            | **Sec 8(6)**             | Breach notification            |
| No privacy notice             | **Sec 5**                | Notice requirement             |
| Consent not taken             | **Sec 6**                | Valid consent                  |
| Excessive data collected      | **Sec 6(1)** (necessity) | Only necessary data allowed    |
| Used data for another purpose | **Sec 4 & 6**            | Purpose-specific consent       |
| Tracking children / ads       | **Sec 9**                | Child protection               |
| Government scheme using data  | **Sec 7(b)**             | Legitimate use without consent |
| Legal obligation / Court      | **Sec 7(d,e)**           | Legitimate use                 |
| Medical emergency             | **Sec 7(f,g)**           | Legitimate use                 |
| “Show me my data”             | **Sec 11**               | Right to access                |
| “Correct/delete my data”      | **Sec 12**               | Right to erasure & correction  |
| Complaint not answered        | **Sec 13**               | Grievance redressal            |
| Data kept after purpose       | **Sec 8(7)**             | Data retention rules           |
| Big platform with DPO         | **Sec 10**               | Significant Data Fiduciary     |
| Investigation / police        | **Sec 17**               | Exemptions                     |

--------------
Got it!
Below is a **clean, exam-ready list of “RELEVANT LINES”** — short, precise, and directly taken from the **DPDP Act 2023**, perfectly worded for writing in a case-study answer.

Each line is written EXACTLY how you should quote it in exams — crisp, 1–2 sentences, and based on the actual provisions from the Act.
(All lines are sourced from your uploaded DPDP Act PDF. )

---

# ✅ **SECTION-WISE RELEVANT LINES (Write these in case study answers)**

---

# **SECTION 2 – DEFINITIONS**

### **Relevant line:**

“Personal data means any data about an individual who is identifiable.” (Sec 2(t))
“Processing includes collection, storage, sharing, use, erasure or destruction of personal data.” (Sec 2(x))

---

# **SECTION 3 – APPLICATION OF THE ACT**

### **Relevant line:**

“This Act does not apply to personal or domestic use, or data made publicly available by the Data Principal.” (Sec 3(c))

---

# **SECTION 4 – GROUNDS FOR PROCESSING PERSONAL DATA**

### **Relevant line:**

“Personal data may be processed only for a lawful purpose with the consent of the Data Principal or for legitimate uses.” (Sec 4(1))

---

# **SECTION 5 – NOTICE**

### **Relevant line:**

“Every request for consent shall be accompanied or preceded by a notice describing the personal data and the purpose of processing.” (Sec 5(1))

---

# **SECTION 6 – CONSENT**

### **Relevant lines:**

“Consent shall be free, specific, informed, unconditional and unambiguous with a clear affirmative action.” (Sec 6(1))
“The Data Principal has the right to withdraw consent at any time.” (Sec 6(4))
“On withdrawal of consent, the Data Fiduciary shall cease processing within a reasonable time.” (Sec 6(6))

---

# **SECTION 7 – CERTAIN LEGITIMATE USES (Processing Without Consent)**

### **Relevant line:**

“A Data Fiduciary may process personal data without consent for government benefits, medical emergencies, legal obligations, court orders, and employment-related purposes.” (Sec 7)

---

# **SECTION 8 – GENERAL OBLIGATIONS OF DATA FIDUCIARY**

### **(a) Accuracy:**

“The Data Fiduciary shall ensure the completeness, accuracy and consistency of personal data used for decisions or disclosure.” (Sec 8(3))

### **(b) Security Safeguards:**

“The Data Fiduciary shall protect personal data by taking reasonable security safeguards to prevent personal data breach.” (Sec 8(5))

### **(c) Breach Notification:**

“The Data Fiduciary shall intimate the Board and each affected Data Principal in the event of a personal data breach.” (Sec 8(6))

### **(d) Data Retention:**

“The Data Fiduciary shall erase personal data when the purpose is no longer served or consent is withdrawn, unless retention is required by law.” (Sec 8(7))

### **(e) Grievance Redressal:**

“The Data Fiduciary shall establish an effective mechanism for grievance redressal.” (Sec 8(10))

---

# **SECTION 9 – PROCESSING OF CHILDREN'S DATA**

### **Relevant lines:**

“The Data Fiduciary shall obtain verifiable parental consent before processing the personal data of a child.” (Sec 9(1))
“The Data Fiduciary shall not undertake tracking, behavioural monitoring or targeted advertising directed at children.” (Sec 9(3))

---

# **SECTION 10 – SIGNIFICANT DATA FIDUCIARY**

### **Relevant lines:**

“A Significant Data Fiduciary shall appoint a Data Protection Officer based in India and responsible to the Board of Directors.” (Sec 10(2)(a))
“It shall conduct periodic Data Protection Impact Assessments and audits.” (Sec 10(2)(c))

---

# **SECTION 11 – RIGHT TO ACCESS INFORMATION**

### **Relevant line:**

“The Data Principal has the right to obtain a summary of personal data being processed and the identities of all Data Fiduciaries with whom it has been shared.” (Sec 11(1))

---

# **SECTION 12 – RIGHT TO CORRECTION & ERASURE**

### **Relevant lines:**

“The Data Fiduciary shall correct inaccurate or misleading personal data on request of the Data Principal.” (Sec 12(2)(a))
“The Data Fiduciary shall erase personal data on request unless retention is required for the specified purpose or by law.” (Sec 12(3))

---

# **SECTION 13 – GRIEVANCE REDRESSAL**

### **Relevant line:**

“The Data Fiduciary shall provide readily available means of grievance redressal and respond within the prescribed period.” (Sec 13(2))

---

# **SECTION 14 – NOMINATION**

### **Relevant line:**

“The Data Principal may nominate an individual who shall exercise her rights in case of death or incapacity.” (Sec 14(1))

---

# **SECTION 15 – DUTIES OF DATA PRINCIPAL**

### **Relevant line:**

“The Data Principal shall not impersonate another person or provide false information and must not file frivolous complaints.” (Sec 15)

---

# **SECTION 16 – RESTRICTION ON CROSS-BORDER TRANSFER**

### **Relevant line:**

“The Central Government may restrict transfer of personal data by notification to specified countries.” (Sec 16(1))

---

# **SECTION 17 – EXEMPTIONS**

### **Relevant lines:**

“The provisions of Chapters II and III do not apply where processing is necessary for enforcing legal rights, judicial functions, investigation of offences, or research.” (Sec 17(1),(2))

---

# **SECTION 33 + SCHEDULE – PENALTIES**

### **Relevant line:**

“The Board may impose monetary penalties up to ₹250 crore depending on the nature, gravity and duration of the breach.” (Sec 33(1), Schedule)

---

# ✅ If you want, I can also prepare:

### ✔ A one-page **“Relevant Lines Only” PDF**

### ✔ Case studies mapped → exact section + relevant line

### ✔ A memory-friendly table for last-minute revision

Just tell me!