WIP symmetric encryption

[tingaloo]

I rule and have completed some work on Case Manager that's ready for review!

Started work on beefing up security. Added symmetric encryption to the pipe.

• Create Heroku config
• Write script to change existing records?
• Rotate Keys

Need to follow this guide to set up keys.

To search for a user, it looks something like this (notice the new attribute encrypted_name )

2.4.1 :006 > @user = User.all.second
 => #<User _id: BSON::ObjectId('59d314b22cde11189d59151d'), call_order: nil, created_at: Tue, 03 Oct 2017 00:40:18 EDT -04:00, email: "[email protected]", encrypted_name: "QEVuQwEAGPwurjhH68YwvZq7TruafA==", line: nil, modifier_id: nil, patient_ids: [], role: nil, updated_at: Tue, 03 Oct 2017 00:40:18 EDT -04:00, version: 1>
2.4.1 :007 > @user.name
SymmetricEncryption::ConfigError: Call SymmetricEncryption.load! or SymmetricEncryption.cipher= prior to encrypting or decrypting data
2.4.1 :008 > SymmetricEncryption.load!
 => true
2.4.1 :009 > @user.name
 => "testuser3"

https://github.com/rocketjob/symmetric-encryption/blob/master/docs/frameworks.md
https://rocketjob.github.io/symmetric-encryption/

@colinxfleming Let me know what we need to get this thing going.

This pull request makes the following changes:

• Jump starts symmetric encryption for sensitive data.

It relates to the following issue #s:

• Bumps Use attr_encrypted or symmetric_encryption for protecting sensitive data at rest? #413

[colinxfleming]

Well I'll be damned. Nicely done @tingaloo !

It sounds like the steps to rollout are:

• Maybe regen the symmetric-encryption file and chuck it up on heroku?
• Convert our existing data to be symmetrically encrypted
• Figure out a plan on how to rotate keys in the event of a security failure?

If we run rake db:seed off of master, what steps do we need to take to encrypt everything that already exists? I think that'll give us a hint of what the next steps are on the second bullet.

[tingaloo]

I'll leave the regeneration to you.

Here is how to add encryption to existing DB, btw I didn't run rake db:seed

2.4.1 :002 > @user = User.first
 => #<User _id: BSON::ObjectId('59d6e4b42cde1127ba38f23f'), call_order: ["59d6e4b52cde1127ba38f25d", "59d6e4b52cde1127ba38f261", "59d6e4b52cde1127ba38f259", "59d6e4b52cde1127ba38f255", "59d6e4b52cde1127ba38f251", "59d6e4b52cde1127ba38f24d"], created_at: Thu, 05 Oct 2017 22:04:36 EDT -04:00, email: "[email protected]", encrypted_name: nil, line: nil, modifier_id: nil, name: "testuser (admin)", patient_ids: [BSON::ObjectId('59d6e4b52cde1127ba38f24d'), BSON::ObjectId('59d6e4b52cde1127ba38f251'), BSON::ObjectId('59d6e4b52cde1127ba38f255'), BSON::ObjectId('59d6e4b52cde1127ba38f259'), BSON::ObjectId('59d6e4b52cde1127ba38f261'), BSON::ObjectId('59d6e4b52cde1127ba38f25d')], role: "admin", updated_at: Thu, 05 Oct 2017 22:05:20 EDT -04:00, version: 1>
2.4.1 :003 > @user.name
 => nil
2.4.1 :004 > @user.name = "testuser (admin)"
 => "testuser (admin)"
2.4.1 :005 > @user.save
 => true
2.4.1 :006 > @user
 => #<User _id: BSON::ObjectId('59d6e4b42cde1127ba38f23f'), call_order: ["59d6e4b52cde1127ba38f25d", "59d6e4b52cde1127ba38f261", "59d6e4b52cde1127ba38f259", "59d6e4b52cde1127ba38f255", "59d6e4b52cde1127ba38f251", "59d6e4b52cde1127ba38f24d"], created_at: Thu, 05 Oct 2017 22:04:36 EDT -04:00, email: "[email protected]", encrypted_name: "QEVuQwEAPblVUc8kebsJRXcnvW8z06v76io78eCO4IT/PZWbLeQ=", line: nil, modifier_id: nil, name: "testuser (admin)", patient_ids: [BSON::ObjectId('59d6e4b52cde1127ba38f24d'), BSON::ObjectId('59d6e4b52cde1127ba38f251'), BSON::ObjectId('59d6e4b52cde1127ba38f255'), BSON::ObjectId('59d6e4b52cde1127ba38f259'), BSON::ObjectId('59d6e4b52cde1127ba38f261'), BSON::ObjectId('59d6e4b52cde1127ba38f25d')], role: "admin", updated_at: Thu, 05 Oct 2017 22:14:59 EDT -04:00, version: 1>
2.4.1 :007 > @user.name
 => "testuser (admin)"
2.4.1 :008 > user = User.where(encrypted_name: SymmetricEncryption.encrypt('testuser (admin)')).first
 => #<User _id: BSON::ObjectId('59d6e4b42cde1127ba38f23f'), call_order: ["59d6e4b52cde1127ba38f25d", "59d6e4b52cde1127ba38f261", "59d6e4b52cde1127ba38f259", "59d6e4b52cde1127ba38f255", "59d6e4b52cde1127ba38f251", "59d6e4b52cde1127ba38f24d"], created_at: Thu, 05 Oct 2017 22:04:36 EDT -04:00, email: "[email protected]", encrypted_name: "QEVuQwEAPblVUc8kebsJRXcnvW8z06v76io78eCO4IT/PZWbLeQ=", line: nil, modifier_id: nil, name: "testuser (admin)", patient_ids: [BSON::ObjectId('59d6e4b52cde1127ba38f24d'), BSON::ObjectId('59d6e4b52cde1127ba38f251'), BSON::ObjectId('59d6e4b52cde1127ba38f255'), BSON::ObjectId('59d6e4b52cde1127ba38f259'), BSON::ObjectId('59d6e4b52cde1127ba38f261'), BSON::ObjectId('59d6e4b52cde1127ba38f25d')], role: "admin", updated_at: Thu, 05 Oct 2017 22:14:59 EDT -04:00, version: 1>

In short, we can reassign the name and it will generate an encrypted_name automatically.

For 3, this is the guide, maybe worry about it later?

[colinxfleming]

I'm going to close this, not because I don't want to do it, but because I think we're going to engage in some Holistic Thinking about this soon. We can and should use the commits from this if it becomes a priority, but we're not actively working on it right now.