Add Deterministic AEAD Encryption and EncryptedBinaryField

[script3r]

Summary

This PR implements the features from the original PR #2, adding deterministic AEAD encryption and binary field support to django-tink-fields.

Features Added

🔐 Deterministic AEAD Encryption

• DeterministicEncryptedField: Base class for searchable encryption
• Field Variants: TextField, CharField, IntegerField, EmailField, DateField, DateTimeField
• Deterministic Property: Same plaintext always produces same ciphertext
• Searchable Encryption: Enables exact lookups on encrypted data
• AES256-SIV Algorithm: Uses Tink's deterministic AEAD implementation

�� EncryptedBinaryField

• Binary Data Support: Encrypts arbitrary binary data (images, files, etc.)
• Null Handling: Properly handles None values
• Memory Efficient: Uses Django's BinaryField as base

🛠️ Technical Improvements

• Keyset Management: Refactored key management with KeysetManager class
• Memory Leak Fix: Used @cached_property for primitive caching
• Better Error Handling: Improved validation and error messages
• Lookup Support: Deterministic fields support exact and isnull lookups
• Test Coverage: Comprehensive test suite for all new features

Implementation Details

Keyset Generation

• Used Argument wrong!
  org.kohsuke.args4j.CmdLineException: Argument "command" is required

[add-key | convert-keyset | : Command to run
create-keyset | create-public-keyset
| delete-key | destroy-key |
disable-key | enable-key |
list-keyset | list-key-templates |
rotate-keyset | promote-key] to generate proper deterministic AEAD keyset

• Added "deterministic" keyset configuration
• Proper primitive registration and validation

Field Architecture

• DeterministicEncryptedField inherits from EncryptedField
• Overrides get_db_prep_save to use deterministic encryption
• Maintains backward compatibility with existing fields

Database Integration

• Proper Django field integration
• Binary data handling with connection.Database.Binary
• Lookup class registration for query support

Testing

• ✅ All existing tests pass
• ✅ Deterministic encryption verified (same input → same output)
• ✅ Binary field encryption/decryption working
• ✅ Lookup functionality tested
• ✅ Error handling validated

Usage Examples

# Deterministic encryption
class User(models.Model):
    email = DeterministicEncryptedEmailField(keyset="deterministic")
    name = DeterministicEncryptedCharField(max_length=100, keyset="deterministic")

# Binary data encryption
class Document(models.Model):
    content = EncryptedBinaryField()
    thumbnail = EncryptedBinaryField(null=True)

# Searchable queries
User.objects.filter(email="user@example.com")  # Works with deterministic fields

Security Notes

• Deterministic encryption reveals patterns in data
• Use only when searchability is required
• Regular AEAD fields remain more secure for general use
• Proper AAD (Additional Authenticated Data) support maintained

Breaking Changes

None - this is a purely additive feature that maintains full backward compatibility.

Related

Implements features from PR #2 with modern codebase improvements.