Jt+jc/encryption improvement

[Jtang-1]

Product Description

Technical Summary

Ticket: https://dimagi.atlassian.net/browse/SAAS-16191

Introduces a solution for these code scan alerts:
https://github.com/dimagi/commcare-hq/security/code-scanning/295
https://github.com/dimagi/commcare-hq/security/code-scanning/296

CodeQL recommends using CBC cipher mode instead of ECB. From the doc:

ECB should not be used as a mode for encryption as it has dangerous weaknesses. Data is encrypted the same way every time, which means that the same plaintext input will always produce the same ciphertext. This behavior makes messages encrypted with ECB more vulnerable to replay attacks.

This PR introduces a encryption and decryption function that uses ECB as well as a helper function to convert existing ECB encrypted strings to a CBC encrypted string.

Many models store either a password, API key, etc. that is encrypted with ECB. Those fields will need to be migrated to be CBC encrypted. This PR begins the migration process for only EmailSettings model.

Feature Flag

Not specific to a feature flag but the model effected is only relevant for this feature flag https://www.commcarehq.org/hq/flags/edit/custom_email_gateway/

Safety Assurance

Safety story

Locally tested

Automated test coverage

Added tests that the encryption and decryption with CBC results in the expected plaintext.
Also tests that the function for reencryption from ECB to CBC on the EmailSettings model existing password field results in password_cbc being populated with the same plaintext password.

QA Plan

no QA

Migrations

• The migrations in this code can be safely applied first independently of the code

This is the first phase which includes:

• Encrypting fields with CBC mode and storing it in a new field in the model
• Write to both existing ECB and new CBC field
• Continue reading from ECB field

Following PRs will:

• Update: read from only new CBC field
• Update: write to only the new CBC field
• Delete ECB password field

Rollback instructions

• This PR can be reverted after deploy with no further considerations

Labels & Review

• Risk label is set correctly
• The set of people pinged as reviewers is appropriate for the level of risk of the change

[sentry-io]

🔍 Existing Issues For Review

Your pull request is modifying functions with the following pre-existing issues:

📄 File: corehq/motech/utils.py

Function	Unhandled Issue
b64_aes_decrypt	UnicodeDecodeError: 'utf-8' codec can't decode byte 0xb1 in position 0: invalid start byte ... Event Count: 1

---

_{Did you find this useful? React with a 👍 or 👎}