161 lines
4.0 KiB
Markdown
161 lines
4.0 KiB
Markdown
|
# TypeDialog Encryption
|
||
|
|
|
||
|
|
Complete guide to encryption and secure field handling in TypeDialog.
|
||
|
|
|
||
|
|
## Overview
|
||
|
|
|
||
|
|
TypeDialog provides comprehensive encryption support for sensitive data across all backends (CLI, TUI, Web). Encrypt fields at rest, in transit, and during processing with multiple encryption providers.
|
||
|
|
|
||
|
|
## Documentation
|
||
|
|
|
||
|
|
| Document | Purpose |
|
||
|
|
| ---------- | --------- |
|
||
|
|
| **[encryption-quick-start.md](encryption-quick-start.md)** | Get started with encryption in 5 minutes |
|
||
|
|
| **[encryption-services-setup.md](encryption-services-setup.md)** | Configure encryption services (AWS KMS, GCP KMS, Vault) |
|
||
|
|
| **[encryption-unified-architecture.md](encryption-unified-architecture.md)** | Architecture and design decisions |
|
||
|
|
|
||
|
|
## Quick Start
|
||
|
|
|
||
|
|
### 1. Mark Sensitive Fields
|
||
|
|
|
||
|
|
```toml
|
||
|
|
[[fields]]
|
||
|
|
name = "password"
|
||
|
|
field_type = "Password"
|
||
|
|
encrypted = true
|
||
|
|
```
|
||
|
|
|
||
|
|
### 2. Choose Encryption Provider
|
||
|
|
|
||
|
|
```toml
|
||
|
|
[encryption]
|
||
|
|
provider = "aws_kms" # or "gcp_kms", "vault", "local"
|
||
|
|
key_id = "arn:aws:kms:us-east-1:..."
|
||
|
|
```
|
||
|
|
|
||
|
|
### 3. Run with Encryption Enabled
|
||
|
|
|
||
|
|
```bash
|
||
|
|
typedialog form config.toml --encrypt
|
||
|
|
```
|
||
|
|
|
||
|
|
## Supported Backends
|
||
|
|
|
||
|
|
| Backend | Encryption Support | Notes |
|
||
|
|
| --------- | ------------------- | ------- |
|
||
|
|
| **CLI** | ✅ Full | Encrypts before output |
|
||
|
|
| **TUI** | ✅ Full | Masked input, encrypted storage |
|
||
|
|
| **Web** | ✅ Full | HTTPS required, encrypted at rest |
|
||
|
|
|
||
|
|
## Encryption Providers
|
||
|
|
|
||
|
|
### AWS KMS
|
||
|
|
|
||
|
|
Enterprise-grade encryption with AWS Key Management Service.
|
||
|
|
|
||
|
|
- Automatic key rotation
|
||
|
|
- CloudTrail audit logging
|
||
|
|
- FIPS 140-2 validated
|
||
|
|
|
||
|
|
### GCP Cloud KMS
|
||
|
|
|
||
|
|
Google Cloud's managed encryption service.
|
||
|
|
|
||
|
|
- Hardware Security Module (HSM) support
|
||
|
|
- Automatic key versioning
|
||
|
|
- IAM integration
|
||
|
|
|
||
|
|
### HashiCorp Vault
|
||
|
|
|
||
|
|
Self-hosted secret management and encryption.
|
||
|
|
|
||
|
|
- Dynamic secrets
|
||
|
|
- Fine-grained access control
|
||
|
|
- Audit logging
|
||
|
|
|
||
|
|
### Local (Development)
|
||
|
|
|
||
|
|
Local encryption for development and testing.
|
||
|
|
|
||
|
|
- No external dependencies
|
||
|
|
- Not recommended for production
|
||
|
|
|
||
|
|
## Features
|
||
|
|
|
||
|
|
- **Field-level encryption** - Encrypt specific fields, not entire forms
|
||
|
|
- **Multiple providers** - Choose the right provider for your environment
|
||
|
|
- **Automatic decryption** - Transparent decryption when authorized
|
||
|
|
- **Audit logging** - Track all encryption/decryption operations
|
||
|
|
- **Key rotation** - Automatic key rotation support (AWS KMS, GCP KMS)
|
||
|
|
|
||
|
|
## Use Cases
|
||
|
|
|
||
|
|
### 1. PII Protection
|
||
|
|
|
||
|
|
Encrypt personally identifiable information (names, emails, SSNs).
|
||
|
|
|
||
|
|
### 2. Credential Management
|
||
|
|
|
||
|
|
Secure API keys, passwords, and tokens.
|
||
|
|
|
||
|
|
### 3. Compliance
|
||
|
|
|
||
|
|
Meet GDPR, HIPAA, SOC 2 requirements.
|
||
|
|
|
||
|
|
### 4. Multi-tenant SaaS
|
||
|
|
|
||
|
|
Isolate customer data with separate encryption keys.
|
||
|
|
|
||
|
|
## Security Best Practices
|
||
|
|
|
||
|
|
1. **Use managed services** - Prefer AWS KMS or GCP KMS over local encryption
|
||
|
|
2. **Enable key rotation** - Rotate encryption keys regularly
|
||
|
|
3. **Audit access** - Monitor who accesses encrypted data
|
||
|
|
4. **Encrypt in transit** - Always use HTTPS for web backend
|
||
|
|
5. **Validate inputs** - Sanitize before encryption to prevent injection
|
||
|
|
|
||
|
|
## Examples
|
||
|
|
|
||
|
|
See [examples/08-encryption/](../../examples/08-encryption/) for working examples:
|
||
|
|
|
||
|
|
- Basic field encryption
|
||
|
|
- Multiple encryption providers
|
||
|
|
- Key rotation
|
||
|
|
- Compliance scenarios
|
||
|
|
|
||
|
|
## Related Documentation
|
||
|
|
|
||
|
|
- [Field Types](../field_types.md) - Field type reference including `encrypted` attribute
|
||
|
|
- [Configuration](../configuration.md) - Backend configuration with encryption
|
||
|
|
- [Web Backend](../web/) - HTTPS and transport security
|
||
|
|
|
||
|
|
## Troubleshooting
|
||
|
|
|
||
|
|
### "Encryption provider not configured"
|
||
|
|
|
||
|
|
Set provider in config:
|
||
|
|
|
||
|
|
```toml
|
||
|
|
[encryption]
|
||
|
|
provider = "aws_kms"
|
||
|
|
key_id = "..."
|
||
|
|
```
|
||
|
|
|
||
|
|
### "Failed to decrypt"
|
||
|
|
|
||
|
|
- Check key permissions
|
||
|
|
- Verify key ID is correct
|
||
|
|
- Ensure provider credentials are set
|
||
|
|
|
||
|
|
### "HTTPS required for encrypted fields"
|
||
|
|
|
||
|
|
Web backend requires HTTPS when encryption is enabled. Configure TLS certificates.
|
||
|
|
|
||
|
|
---
|
||
|
|
|
||
|
|
**Next Steps:**
|
||
|
|
|
||
|
|
1. Read [encryption-quick-start.md](encryption-quick-start.md)
|
||
|
|
2. Configure your provider: [encryption-services-setup.md](encryption-services-setup.md)
|
||
|
|
3. Review architecture: [encryption-unified-architecture.md](encryption-unified-architecture.md)
|