aissemble-extensions-encryption-vault-python

aiSSEMBLE™ Extensions Data Encryption Vault Python

This module provides a package for encrypting Python based pipeline data. There are multiple encryption algorithms available. Each with their own strengths and weaknesses as outlined below.

Strategy	Description
VaultRemoteEncryptionStrategy	Leverages the Hashicorp Vault secrets as a service capabilities. This is a highly recommended strategy given it follows best practices and has the advantage of a large developer base working to secure the service.
VaultLocalEncryptionStrategy	Leverages the Vault service to provide encryption keys (key rotation and secure storage) but allows for local encryption. This is a good option if you have to encrypt large data objects. It can also provide a performance boost over remote Vault encryption given there is no need for a roundtrip to the server for each data element.
AesCbcEncryptionStrategy	A good basic 128 bit encryption strategy. To use this you only need to supply a single encryption key in the encrypt.properties file (128 bit or 16 character). This algorithm works well, but is less efficient than the AES GCM algorithm.
AesGcm96EncryptionStrategy	This is a good strategy for most encryption needs. It is efficient and strong against most attacks. You can optionally use an encryption key retrieved from the Vault service with this strategy.

The following example illustrates how to perform encryption.

1. Example usage

   • Add the following to your code

   VaultRemoteEncryptionStrategy

   # Uses remote Vault encryption
   from aissemble_encrypt.vault_remote_encryption_strategy import VaultRemoteEncryptionStrategy
   
   vault_remote = VaultRemoteEncryptionStrategy()
   
   # encrypt plain text data using Vault
   encrypted_value = vault_remote.encrypt('SOME PLAIN TEXT')
   
   # decrypt cipher text data using Vault
   decrypted_value = vault_remote.decrypt(encrypted_value)
   

   NOTE: If you are encrypting your data through a User Defined Function (udf) in PySpark you need to use the VaultLocalEncryptionStrategy (see below). Currently the remote version causes threading issues. This issue will likely be resolved in a future update to the Hashicorp Vault client

   VaultLocalEncryptionStrategy

   # Uses an encryption key retrieved from the Vault server, but performs the encryption locally.
   from aissemble_encrypt.vault_local_encryption_strategy import VaultLocalEncryptionStrategy
   
   vault_local = VaultLocalEncryptionStrategy()
   
   # encrypt plain text data using local Vault
   encrypted_value = vault_local.encrypt('SOME PLAIN TEXT')
   
   # decrypt cipher text data using local Vault
   decrypted_value = vault_local.decrypt(encrypted_value)
   

   AesCbcEncryptionStrategy

   # Uses the AES CBC encryption
   from aissemble_encrypt.aes_cbc_encryption_strategy import AesCbcEncryptionStrategy
   
   aes_cbc = AesCbcEncryptionStrategy()
   
   # encrypt plain text data using AES CBC
   encrypted_value = aes_cbc.encrypt('SOME PLAIN TEXT')
   
   # decrypt cipher text data using AES CBC
   decrypted_value = aes_cbc.decrypt(encrypted_value)
   

   AesGcm96EncryptionStrategy

   # AES GCM encryption with a 96 bit initialization vector (same algorithm as Vault)
   from aissemble_encrypt.aes_gcm_96_encryption_strategy import AesGcm96EncryptionStrategy
   
   aes_gcm_96 = AesGcm96EncryptionStrategy()
   
   # encrypt plain text data using AES GCM
   encrypted_value = aes_gcm_96.encrypt('SOME PLAIN TEXT')
   
   # decrypt cipher text data using AES CBC
   decrypted_value = aes_gcm_96.decrypt(encrypted_value)
   

AISSEMBLE Data Encryption

This package includes one security client for calling the "Secrets as a Service" encryption service.

Vault encryption

See the extensions-encryption README for more information on how to configure Vault encryption.