Implementing Right to Erasure with CSFLE

1
# flaskapp/db_queries.py
2
3
@aws_credential_handler
4
def create_key(userId):
5
    data_key_id = \
6
        app.mongodb_encryption_client.create_data_key(kms_provider,
7
            master_key, key_alt_names=[userId])
8
    return data_key_id

1
# flaskapp/user.py
2
3
def save(self):
4
        dek_id = db_queries.create_key(self.username)
5
        result = app.mongodb[db_name].user.insert_one(
6
            {
7
                "username": self.username,
8
                "password_hash": self.password_hash,
9
                "dek_id": dek_id,
10
                "createdAt": datetime.now(),
11
            }
12
        )
13
        if result:
14
            self.id = result.inserted_id
15
            return True
16
        else:
17
            return False

1
{
2
   "name": "shoe size",
3
   "value": "10",
4
   "username": "tom"
5
}

1
# flaskapp/db_queries.py
2
3
# Fields to encrypt, and the algorithm to encrypt them with
4
ENCRYPTED_FIELDS = {
5
    # Deterministic encryption for username, because we need to search on it
6
    "username": Algorithm.AEAD_AES_256_CBC_HMAC_SHA_512_Deterministic,
7
    # Random encryption for value, as we don't need to search on it
8
    "value": Algorithm.AEAD_AES_256_CBC_HMAC_SHA_512_Random,
9
}

1
# flaskapp/db_queries.py
2
3
def insert_data(document):
4
    document["username"] = current_user.username
5
    # Loop over the field names (and associated algorithm) we want to encrypt
6
    for field, algo in ENCRYPTED_FIELDS.items():
7
        # if the field exists in the document, encrypt it
8
        if document.get(field):
9
            document[field] = encrypt_field(document[field], algo)
10
    # Insert document (now with encrypted fields) to the data collection
11
    app.data_collection.insert_one(document)

1
# flaskapp/db_queries.py
2
3
# Encrypt a single field with the given algorithm
4
@aws_credential_handler
5
def encrypt_field(field, algorithm):
6
    try:
7
        field = app.mongodb_encryption_client.encrypt(
8
            field,
9
            algorithm,
10
            key_alt_name=current_user.username,
11
        )
12
        return field
13
    except pymongo.errors.EncryptionError as ex:
14
        # Catch this error in case the DEK doesn't exist. Log a warning and 
15
        # re-raise the exception
16
        if "not all keys requested were satisfied" in ex._message:
17
            app.logger.warn(
18
                f"Encryption failed: could not find data encryption key for user: {current_user.username}"
19
            )
20
        raise ex

1
# flaskapp/db_queries.py
2
3
def fetch_all_data_unencrypted(decrypt=False):
4
    results = list(app.data_collection.find())
5
6
    if decrypt:
7
        for field in ENCRYPTED_FIELDS.keys():
8
            for result in results:
9
                if result.get(field):
10
                    result[field], result["encryption_succeeded"] = decrypt_field(result[field])
11
    return results

1
# flaskapp/db_queries.py
2
3
# Try to decrypt a field, returning a tuple of (value, status). This will be either (decrypted_value, True), or (raw_cipher_text, False) if we couldn't decrypt
4
def decrypt_field(field):
5
    try:
6
        # We don't need to pass the DEK or algorithm to decrypt a field
7
        field = app.mongodb_encryption_client.decrypt(field)
8
        return field, True
9
    # Catch this error in case the DEK doesn't exist.
10
    except pymongo.errors.EncryptionError as ex:
11
        if "not all keys requested were satisfied" in ex._message:
12
            app.logger.warn(
13
                "Decryption failed: could not find data encryption key to decrypt the record."
14
            )
15
            # If we can't decrypt due to missing DEK, return the "raw" value.
16
            return field, False
17
        raise ex