Kryptonite for Apache Kafka

  True Client-Side Encryption

Sensitive plaintext never leaves the client-side application.

Neither Kafka brokers nor any intermediary gateway or reverse proxy infrastructure ever gets to see sensitive payload fields in plaintext. Encryption / Decryption of data happens only within the security perimeter of the client application.

  Field-Level Scope

Configure which payload fields need this extra level of data protection.

It's not an all or nothing approach. Need to encrypt just one field, a handful of fields, or maybe all payload fields? Everything else stays untouched and is still directly processable by any downstream applications.

  Flexible Key Management

You decide how to manage cryptographic keys.

Quickly need to inline keysets for development? Need to store keysets in a cloud key management systems (KMS)? Want to encrypt keysets with a key encryption key (KEK) stored in a cloud provider's KMS? GCP Cloud KMS, AWS KMS, and Azure Key Vault are supported - the choice is yours!

  Ready-Made Integrations

Apache Kafka Connect SMTs, Apache Flink UDFs, ksqlDB UDFs, a Quarkus Funqy HTTP service, and a dedicated Kroxylicious filter. You don't need custom serializers or custom code because flexible configuration options drive the encrypt/decrypt capabilities.

  Versatile Encryption Capabilities

By default, all modules apply probabilistic encryption using AES GCM 256-bit encryption. If your use case requires deterministic encryption, you can choose AES GCM SIV. To support format-preserving encryption, FF3-1 is currently available.

  Built on top of Google Tink

Cryptographic primitives come directly from Tink. It's a vetted and widely deployed open-source cryptography library implemented and maintained by cryptographers and security engineers at Google. If you want to learn more read What is Tink?