Replace pycrypto dependency

[jkemp101]

Pycrypto is no longer supported and should be replaced. Cryptography package is probably the best choice

[tsx]

I think the only thing to do here is swapping out the AES encryption helpers with these https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/

[jpmelos]

For anyone deploying this change, this is recommended to be done in several steps as outlined below:

Step 1: Deploy https://github.com/closeio/flask-common/pull/70 that:

• When decrypting:
  • If first byte of encrypted data is \x00, extract first byte as version and try to decrypt the rest of the message;
  • If first byte is not \x00 or if first step fails signature test, it means that first byte is not a version marker, but part of the encrypted data. Decrypt as usual including the first byte.

Step 2: Deploy https://github.com/closeio/flask-common/pull/72 that:

• Prepends a version \x00 to all our encrypted data (these have IV size of 32 bytes).
• This is done after step 1 because if you have several workers in production, there could be a race condition where some workers are generating versioned data before others can understand the new standard.

Step 3: Run a data migration to update existing data (prepend version \x00). Optionally, it can also rotate your key.

Step 4: Deploy https://github.com/closeio/flask-common/pull/75 that:

• Decrypts only by looking at the version, since now everything should be versioned.
  • When decrypting, if it’s version \x01, uses correctly-sized IVs.

Step 5: Deploy https://github.com/closeio/flask-common/pull/71 that:

• Introduces cryptography, swapping pycrypto out.
• Encrypts new data with version \x01 and IV size 16 bytes.
• Decrypts only by looking at the version, since now everything should be versioned.
  • When decrypting, if it’s version \x00, uses the last 16 bytes of the original IV as the corrected IV before passing it to cryptography.

Step 6: (Optional.) Run another data migration to re-encrypt everything with version \x01 and correct IV size. Optionally, it can also rotate your key.

Step 7: (Optional.) Deploy https://github.com/closeio/flask-common/pull/77 that removes treatment for version 0.

If it's been a long time since you last rotated your key, it's recommended to use steps 3 or 6 as a chance to do that.

[jpmelos]

Dependency dropped in https://github.com/closeio/flask-common/pull/71.