Kryptonite for Apache Kafka

  True Client-Side Encryption

Sensitive plaintext never leaves the client-side application.

Neither Kafka brokers nor any intermediary Kafka proxy infrastructure ever gets to see sensitive payload fields in plaintext. Encryption / Decryption of data happens exclusively within the security perimeter of the client-side application.

  Field-Level Scope

Configure which payload fields need this extra level of data protection.

It's not an all or nothing approach. Need to encrypt just one field, a handful of fields, or maybe all payload fields? Everything else stays untouched and is still directly processable by any downstream applications.

  Flexible Key Management

You decide how to manage cryptographic keys.

Quickly need to inline keysets for development? Need to store keysets in a cloud key management systems (KMS)? Want to encrypt keysets with a key encryption key (KEK) stored in a cloud provider's KMS? GCP Cloud KMS, AWS KMS, and Azure Key Vault are supported - the choice is yours!

  Four Ready-Made Integrations

Apache Kafka Connect SMTs, Apache Flink UDFs, ksqlDB UDFs, and a Quarkus Funqy HTTP service. No custom serializers or any custom code required as the encrypt/decrypt capabilities are largely based on flexible configuration options.

  Versatile Encryption Capabilities

By default, all modules apply probabilistic encryption using AES GCM 256-bit encryption. If your use case requires deterministic encryption you can choose AES GCM SIV. In order to allow for format-preserving encryption, FF3-1 is currently supported.

  Built on top of Google Tink

Cryptographic primitives come directly from Tink. It's a vetted and widely deployed open-source cryptography library implemented and maintained by cryptographers and security engineers at Google. If you want to learn more read What is Tink?