def create(cls, device_id, values, **kwargs):
"""Create a new entry.
This generates a master key and encrypts it with the public key
from the device from which the new entry get's created.
The master key is used to encrypt the values.
The master key is never stored.
"""
salt = get_salt()
master_key = os.urandom(32)
device = Device.objects.get(pk=device_id)
device_key = public_key_encrypt(device.loaded_public_key, master_key)
encrypted = {
key: fernet_encrypt(value, master_key, salt)
for key, value in values.items()}
keys = {device.id.hex: force_text(base64.b64encode(device_key))}
return cls.objects.create(salt=salt, keys=keys, values=encrypted, **kwargs)
def test_get_salt():
assert len(get_salt()) == 32
