{"action":"created","issue":{"url":"https://api.github.com/repos/jlafon/PynamoDB/issues/155","repository_url":"https://api.github.com/repos/jlafon/PynamoDB","labels_url":"https://api.github.com/repos/jlafon/PynamoDB/issues/155/labels{/name}","comments_url":"https://api.github.com/repos/jlafon/PynamoDB/issues/155/comments","events_url":"https://api.github.com/repos/jlafon/PynamoDB/issues/155/events","html_url":"https://github.com/jlafon/PynamoDB/issues/155","id":174936353,"number":155,"title":"Advice on adding encryption support","user":{"login":"csimmons0","id":15880996,"avatar_url":"https://avatars.githubusercontent.com/u/15880996?v=3","gravatar_id":"","url":"https://api.github.com/users/csimmons0","html_url":"https://github.com/csimmons0","followers_url":"https://api.github.com/users/csimmons0/followers","following_url":"https://api.github.com/users/csimmons0/following{/other_user}","gists_url":"https://api.github.com/users/csimmons0/gists{/gist_id}","starred_url":"https://api.github.com/users/csimmons0/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/csimmons0/subscriptions","organizations_url":"https://api.github.com/users/csimmons0/orgs","repos_url":"https://api.github.com/users/csimmons0/repos","events_url":"https://api.github.com/users/csimmons0/events{/privacy}","received_events_url":"https://api.github.com/users/csimmons0/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2016-09-04T07:43:28Z","updated_at":"2016-09-11T07:43:46Z","closed_at":"2016-09-11T07:43:46Z","body":"Hi. First of all, apologies if opening an issue isn't the best way to start this dialogue. I tried posting to the Google group, but it appears that I don't have permissions to start a thread there.\r\n\r\nI would like to add support for symmetric encryption to PynamoDB. What I have in mind would be similar to the Java library for encrypting data in DynamoDB (https://github.com/awslabs/aws-dynamodb-encryption-java). I'd like to get others' thoughts on how to implement this feature--especially the thoughts of those who would be approving my pull request.\r\n    \r\nI don't know this code base well at all, as I've been using boto3, but here's what I'm thinking after reading some of the code:\r\n\r\n1. It looks like the _serialize and from_raw_data functions in models.py are the places to do the encryption and decryption, respectively. I see two possible approaches to controlling whether a Model encrypts its data. The approach that I'm leaning toward is to give the base Model class a member that determines whether it encrypts its data and to examine that member in _serialize and from_raw_data. The other approach that comes to mind is to define an EncryptedModel class that inherits from Model and overrides those two functions.\r\n\r\n2. There needs to be a way to make certain attributes within a Model non-encrypted. I think that a good way to meet this requirement is to add a \"do_not_encrypt\"  field to the Attribute class. \r\n\r\n3. I'm not sure what the best way to specify where a Model gets its encryption key(s) from is, but one possibility is to give the Model class an \"encryption_key_source\" member that refers to some object that produces the necessary information. The common use case might involve creating a single encryption key source and pointing all of one's Model subclasses to it.\r\n\r\nPlease let me know what you think."},"comment":{"url":"https://api.github.com/repos/jlafon/PynamoDB/issues/comments/246167056","html_url":"https://github.com/jlafon/PynamoDB/issues/155#issuecomment-246167056","issue_url":"https://api.github.com/repos/jlafon/PynamoDB/issues/155","id":246167056,"user":{"login":"csimmons0","id":15880996,"avatar_url":"https://avatars.githubusercontent.com/u/15880996?v=3","gravatar_id":"","url":"https://api.github.com/users/csimmons0","html_url":"https://github.com/csimmons0","followers_url":"https://api.github.com/users/csimmons0/followers","following_url":"https://api.github.com/users/csimmons0/following{/other_user}","gists_url":"https://api.github.com/users/csimmons0/gists{/gist_id}","starred_url":"https://api.github.com/users/csimmons0/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/csimmons0/subscriptions","organizations_url":"https://api.github.com/users/csimmons0/orgs","repos_url":"https://api.github.com/users/csimmons0/repos","events_url":"https://api.github.com/users/csimmons0/events{/privacy}","received_events_url":"https://api.github.com/users/csimmons0/received_events","type":"User","site_admin":false},"created_at":"2016-09-11T07:43:46Z","updated_at":"2016-09-11T07:43:46Z","body":"I decided not to go down this path after doing more research.  I do believe that adding encryption in the manner described above would not be too difficult; however, I fear that ensuring compatibility with the Java encryption library, such that one could access the same encrypted tables in Java and Python, would be significantly more difficult. The ability to access tables with Java is necessary as long as Java is the only language with support for transactions in DynamoDB. Rather than implement both encryption and transactions in Python, I decided to rewrite my backend in Java."}}
{"actor":{"display_login":"csimmons0"}}