Encrypted Model

import requests

resp = requests.get("https://mycompany.blackbox.ai/enc/nvidia/nemotron-49b-v1.5/health")
print(resp.json())

const resp = await fetch("https://mycompany.blackbox.ai/enc/nvidia/nemotron-49b-v1.5/health");
console.log(await resp.json());

import requests

resp = requests.get("https://mycompany.blackbox.ai/enc/nvidia/nemotron-49b-v1.5/attestation")
attestation = resp.json()
server_public_key = attestation["public_key"]
print(server_public_key)

const resp = await fetch("https://mycompany.blackbox.ai/enc/nvidia/nemotron-49b-v1.5/attestation");
const attestation = await resp.json();
const serverPublicKey = attestation.public_key;
console.log(serverPublicKey);

# Requires: pip install cryptography
import base64, json, os
from cryptography.hazmat.primitives.asymmetric import ec
from cryptography.hazmat.primitives import serialization, hashes
from cryptography.hazmat.primitives.kdf.hkdf import HKDF
from cryptography.hazmat.primitives.ciphers.aead import AESGCM

# Paste the public_key and session_id values from Step 2 here
SERVER_PUBLIC_KEY_PEM = """-----BEGIN PUBLIC KEY-----
MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEq...
-----END PUBLIC KEY-----
"""
SESSION_ID = "f3c1a8b2-9d4e-4a6f-8b21-7c5e0d9a1b34"

server_pub = serialization.load_pem_public_key(SERVER_PUBLIC_KEY_PEM.encode())

# Generate a one-time ephemeral keypair
local_priv = ec.generate_private_key(ec.SECP384R1())
local_pub  = local_priv.public_key()

# ECDH → shared secret → AES-256 key via HKDF
shared  = local_priv.exchange(ec.ECDH(), server_pub)
aes_key = HKDF(algorithm=hashes.SHA256(), length=32,
               salt=None, info=b"handshake data").derive(shared)

# Your conversation history
history = [
    {"role": "system", "content": "You are a helpful AI assistant."},
    {"role": "user",   "content": "Hello! What model are you?"},
]

# First message in a session uses nonce=1000.
# Increment the nonce by 1 for every subsequent message in the same session.
nonce = 1000
iv    = os.urandom(12)
ct    = AESGCM(aes_key).encrypt(iv, json.dumps(history).encode(), None)

# Sign: nonce(8 bytes BE) || iv || ciphertext
sig = local_priv.sign(nonce.to_bytes(8, 'big') + iv + ct,
                      ec.ECDSA(hashes.SHA256()))

# Serialize your ephemeral public key
pub_pem = local_pub.public_bytes(
    serialization.Encoding.PEM,
    serialization.PublicFormat.SubjectPublicKeyInfo,
).decode()

# Build the request body
body = {
    "peer_public_key": pub_pem,
    "session_id":      SESSION_ID,
    "payload": {
        "nonce":      nonce,
        "iv":         base64.b64encode(iv).decode(),
        "ciphertext": base64.b64encode(ct).decode(),
        "signature":  base64.b64encode(sig).decode(),
    }
}

# Save to disk for the next step
with open("/tmp/request.json",   "w") as f: json.dump(body, f)
with open("/tmp/aes_key.hex",    "w") as f: f.write(aes_key.hex())
with open("/tmp/server_pub.pem", "w") as f: f.write(SERVER_PUBLIC_KEY_PEM)

print("Request body  → /tmp/request.json")
print("AES key       → /tmp/aes_key.hex")

// Requires: Node.js 18+ (uses built-in crypto — no npm install needed)
const crypto = require("crypto");
const fs     = require("fs");

const SERVER_PUBLIC_KEY_PEM = `-----BEGIN PUBLIC KEY-----
MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEq...
-----END PUBLIC KEY-----
`;
const SESSION_ID = "f3c1a8b2-9d4e-4a6f-8b21-7c5e0d9a1b34";  // from Step 2

// Generate a one-time ephemeral P-384 keypair
const { privateKey, publicKey } = crypto.generateKeyPairSync("ec", {
  namedCurve: "P-384",
  publicKeyEncoding:  { type: "spki",  format: "pem" },
  privateKeyEncoding: { type: "pkcs8", format: "pem" },
});

// ECDH → HKDF-SHA256 → 32-byte AES key
const sharedSecret = crypto.diffieHellman({
  privateKey: crypto.createPrivateKey(privateKey),
  publicKey:  crypto.createPublicKey(SERVER_PUBLIC_KEY_PEM),
});
const aesKey = crypto.hkdfSync(
  "sha256", sharedSecret, Buffer.alloc(0), "handshake data", 32
);

const history = [
  { role: "system", content: "You are a helpful AI assistant." },
  { role: "user",   content: "Hello! What model are you?" },
];

// AES-256-GCM encrypt
// First message in a session uses nonce=1000.
// Increment the nonce by 1 for every subsequent message in the same session.
const nonce  = 1000;
const iv     = crypto.randomBytes(12);
const cipher = crypto.createCipheriv("aes-256-gcm", aesKey, iv);
const enc    = Buffer.concat([
  cipher.update(JSON.stringify(history), "utf8"),
  cipher.final(),
]);
const ciphertext = Buffer.concat([enc, cipher.getAuthTag()]);

// ECDSA-SHA256 sign: nonce(8 bytes BE) || iv || ciphertext
const nonceBuf = Buffer.alloc(8);
nonceBuf.writeBigUInt64BE(BigInt(nonce));
const dataToSign = Buffer.concat([nonceBuf, iv, ciphertext]);
const signature  = crypto.sign("sha256", dataToSign, {
  key: crypto.createPrivateKey(privateKey),
  dsaEncoding: "der",
});

const body = {
  peer_public_key: publicKey,
  session_id:      SESSION_ID,
  payload: {
    nonce,
    iv:         iv.toString("base64"),
    ciphertext: ciphertext.toString("base64"),
    signature:  signature.toString("base64"),
  },
};

fs.writeFileSync("/tmp/request.json",   JSON.stringify(body));
fs.writeFileSync("/tmp/aes_key.hex",    Buffer.from(aesKey).toString("hex"));
fs.writeFileSync("/tmp/server_pub.pem", SERVER_PUBLIC_KEY_PEM);

console.log("Request body  → /tmp/request.json");
console.log("AES key       → /tmp/aes_key.hex");

import json, os, requests

with open("/tmp/request.json") as f:
    body = json.load(f)

resp = requests.post(
    "https://mycompany.blackbox.ai/enc/nvidia/nemotron-49b-v1.5/message",
    headers={
        "Authorization": f"Bearer {os.environ['BLACKBOX_API_KEY']}",
        "Content-Type": "application/json",
    },
    json=body,
)

with open("/tmp/response.json", "w") as f:
    json.dump(resp.json(), f)

print("Response saved to /tmp/response.json")

import fs from "fs";

const body = JSON.parse(fs.readFileSync("/tmp/request.json", "utf8"));

const resp = await fetch("https://mycompany.blackbox.ai/enc/nvidia/nemotron-49b-v1.5/message", {
    method: "POST",
    headers: {
        "Authorization": `Bearer ${process.env.BLACKBOX_API_KEY}`,
        "Content-Type": "application/json",
    },
    body: JSON.stringify(body),
});

const data = await resp.json();
fs.writeFileSync("/tmp/response.json", JSON.stringify(data));
console.log("Response saved to /tmp/response.json");

import base64, json
from cryptography.hazmat.primitives.asymmetric import ec
from cryptography.hazmat.primitives import serialization, hashes
from cryptography.hazmat.primitives.ciphers.aead import AESGCM

with open("/tmp/response.json") as f:
    resp = json.load(f)
with open("/tmp/aes_key.hex") as f:
    aes_key = bytes.fromhex(f.read().strip())
with open("/tmp/server_pub.pem") as f:
    server_pub = serialization.load_pem_public_key(f.read().encode())

iv    = base64.b64decode(resp["iv"])
ct    = base64.b64decode(resp["ciphertext"])
sig   = base64.b64decode(resp["signature"])
nonce = resp["nonce"]

# Verify the server's signature before trusting the content
server_pub.verify(sig, nonce.to_bytes(8, 'big') + iv + ct,
                  ec.ECDSA(hashes.SHA256()))

# Decrypt
reply = AESGCM(aes_key).decrypt(iv, ct, None).decode()
print("Assistant:", reply)

// Requires: Node.js 18+ — no npm install needed
const crypto = require("crypto");
const fs     = require("fs");

const resp      = JSON.parse(fs.readFileSync("/tmp/response.json", "utf8"));
const aesKey    = Buffer.from(fs.readFileSync("/tmp/aes_key.hex", "utf8").trim(), "hex");
const serverPem = fs.readFileSync("/tmp/server_pub.pem", "utf8");

const nonce          = resp.nonce;
const iv             = Buffer.from(resp.iv,         "base64");
const ciphertextFull = Buffer.from(resp.ciphertext, "base64");
const sig            = Buffer.from(resp.signature,  "base64");

// Verify the server's signature before trusting the content
const nonceBuf     = Buffer.alloc(8);
nonceBuf.writeBigUInt64BE(BigInt(nonce));
const dataToVerify = Buffer.concat([nonceBuf, iv, ciphertextFull]);

const valid = crypto.verify("sha256", dataToVerify, {
  key: crypto.createPublicKey(serverPem),
  dsaEncoding: "der",
}, sig);
if (!valid) throw new Error("Signature verification failed — response may be tampered");

// AES-256-GCM decrypt (last 16 bytes = auth tag)
const ciphertext = ciphertextFull.slice(0, -16);
const authTag    = ciphertextFull.slice(-16);
const decipher   = crypto.createDecipheriv("aes-256-gcm", aesKey, iv);
decipher.setAuthTag(authTag);
const reply = Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString("utf8");

console.log("Assistant:", reply);

import json, os, requests

with open("/tmp/request.json") as f:
    body = json.load(f)

with requests.post(
    "https://mycompany.blackbox.ai/enc/nvidia/nemotron-49b-v1.5/message_stream",
    headers={
        "Authorization": f"Bearer {os.environ['BLACKBOX_API_KEY']}",
        "Content-Type": "application/json",
        "Accept": "text/event-stream",
    },
    json=body,
    stream=True,
) as resp:
    for line in resp.iter_lines():
        if line:
            chunk = json.loads(line)
            if chunk.get("eos"):
                break
            # Decrypt each chunk the same way as Step 5
            print(chunk)

import fs from "fs";

const body = JSON.parse(fs.readFileSync("/tmp/request.json", "utf8"));

const resp = await fetch("https://mycompany.blackbox.ai/enc/nvidia/nemotron-49b-v1.5/message_stream", {
    method: "POST",
    headers: {
        "Authorization": `Bearer ${process.env.BLACKBOX_API_KEY}`,
        "Content-Type": "application/json",
        "Accept": "text/event-stream",
    },
    body: JSON.stringify(body),
});

const reader = resp.body.getReader();
const decoder = new TextDecoder();

while (true) {
    const { done, value } = await reader.read();
    if (done) break;
    const lines = decoder.decode(value).split("\n").filter(Boolean);
    for (const line of lines) {
        const chunk = JSON.parse(line);
        if (chunk.eos) break;
        // Decrypt each chunk the same way as Step 5
        console.log(chunk);
    }
}