use CBC for encryption - interoperable with Cython

Azaion.Services/Security.cs

@@ -17,43 +17,44 @@ public static class Security
     public static string GetApiEncryptionKey(string email, string password, string? hardwareHash) =>
         $"{email}-{password}-{hardwareHash}-#%@AzaionKey@%#---".ToHash();
 
-    public static async Task EncryptTo(this Stream stream, Stream toStream, string key, CancellationToken cancellationToken = default)
+    public static async Task EncryptTo(this Stream inputStream, Stream toStream, string key, CancellationToken cancellationToken = default)
     {
-        if (stream is { CanRead: false }) throw new ArgumentNullException(nameof(stream));
+        inputStream.Seek(0, SeekOrigin.Begin);
+        if (inputStream is { CanRead: false }) throw new ArgumentNullException(nameof(inputStream));
         if (key is not { Length: > 0 }) throw new ArgumentNullException(nameof(key));
 
         using var aes = Aes.Create();
-        aes.Mode = CipherMode.CFB;
+        aes.Mode = CipherMode.CBC;
+        aes.Padding = PaddingMode.PKCS7;
         aes.Key = SHA256.HashData(Encoding.UTF8.GetBytes(key));
         aes.GenerateIV();
         using var encryptor = aes.CreateEncryptor(aes.Key, aes.IV);
 
         await using var cs = new CryptoStream(toStream, encryptor, CryptoStreamMode.Write, leaveOpen: true);
 
-        // Prepend IV to the encrypted data
         await toStream.WriteAsync(aes.IV.AsMemory(0, aes.IV.Length), cancellationToken);
 
         var buffer = new byte[BUFFER_SIZE];
         int bytesRead;
-        while ((bytesRead = await stream.ReadAsync(buffer, cancellationToken)) > 0)
+        while ((bytesRead = await inputStream.ReadAsync(buffer, cancellationToken)) > 0)
             await cs.WriteAsync(buffer.AsMemory(0, bytesRead), cancellationToken);
     }
 
-    public static async Task DecryptTo(this Stream encryptedStream,  Stream toStream, string key, CancellationToken cancellationToken = default)
+    public static async Task DecryptTo(this Stream encryptedStream, Stream toStream, string key, CancellationToken cancellationToken = default)
     {
+        encryptedStream.Seek(0, SeekOrigin.Begin);
         using var aes = Aes.Create();
         aes.Key = SHA256.HashData(Encoding.UTF8.GetBytes(key));
 
-        // Read the IV from the start of the input stream
         var iv = new byte[aes.BlockSize / 8];
         _ = await encryptedStream.ReadAsync(iv, cancellationToken);
         aes.IV = iv;
-        aes.Mode = CipherMode.CFB;
+        aes.Mode = CipherMode.CBC;
+        aes.Padding = PaddingMode.PKCS7;
         using var decryptor = aes.CreateDecryptor(aes.Key, aes.IV);
 
         await using var cryptoStream = new CryptoStream(encryptedStream, decryptor, CryptoStreamMode.Read, leaveOpen: true);
 
-        // Read and write in chunks
         var buffer = new byte[BUFFER_SIZE];
         int bytesRead;
         while ((bytesRead = await cryptoStream.ReadAsync(buffer, cancellationToken)) > 0)