Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR implements envelope encryption by adding model to store Keysets. This PR build on top of #2.
db_key
is added to point to keyset stored using the provided model.EncryptedBinaryField
which use thedb_keyset
named encryption keyset configuration.EncryptedField
is implemented, I don't think it is possible to make keyset name user configurable.tink.KeysetHandle
, instead using primitives directly.KeysetHandle
is heavily opinionated in safe key handling in file-based formats (eg. there is no public API to save plaintext key material at all)tink.core.PrimitiveSet
instances. This allow for key versions to be lazily-loaded, reducing KMS API calls.manage.py tink
management command is added. It containspython manage.py tink create-keyset keyset-name AES256_GCM
- Create keyset and a default key from key template (only aead/daead supported) (tinkey create-keyset --in keyset.json --key-template AES256_GCM
)python manage.py tink add-key keyset-name AES256_GCM
- Create new key in keyset (tinkey add-key --in keyset.json --key-template AES256_GCM
)python manage.py tink promote-key keyset-name key-id
- Promote key in keyset (tinkey promote-key --in keyset.json --key-id key-id
)python manage.py tink list-keyset keyset-name
- List keys in keyset (tinkey list-keyset --in keyset.json
)python manage.py tink delete-keyset keyset-name
- Delete keyset and associated keyspython manage.py tink unsafe-export-keyset keyset-name
- Export keyset to Tinkey-compatible format (will include key material!)key_id
is also database primary key, so I didn't implement import from tinkey operation as ID may collide.Other non blocking improvements (not sure if I will implement, the PR is already feature complete as-is)