Data Encryption | Bootspring Docs

Patterns for encrypting sensitive data at rest and in transit.

Overview#

Data encryption protects sensitive information from unauthorized access. This pattern covers:

Field-level encryption
AES-256-GCM encryption
Password hashing
Key derivation
Database encryption

Prerequisites#

npm install bcryptjs
# Types for TypeScript
npm install -D @types/bcryptjs

Code Example#

AES-256-GCM Encryption#

// lib/encryption.ts
import {
  createCipheriv,
  createDecipheriv,
  randomBytes,
  scrypt
} from 'crypto'
import { promisify } from 'util'

const scryptAsync = promisify(scrypt)
const ALGORITHM = 'aes-256-gcm'
const ENCODING = 'base64'

export async function encrypt(
  plaintext: string,
  password: string
): Promise<string> {
  // Generate salt and derive key
  const salt = randomBytes(16)
  const key = (await scryptAsync(password, salt, 32)) as Buffer

  // Generate IV
  const iv = randomBytes(12)

  // Encrypt
  const cipher = createCipheriv(ALGORITHM, key, iv)
  const encrypted = Buffer.concat([
    cipher.update(plaintext, 'utf8'),
    cipher.final()
  ])
  const authTag = cipher.getAuthTag()

  // Combine: salt (16) + iv (12) + authTag (16) + encrypted
  const result = Buffer.concat([salt, iv, authTag, encrypted])
  return result.toString(ENCODING)
}

export async function decrypt(
  ciphertext: string,
  password: string
): Promise<string> {
  const data = Buffer.from(ciphertext, ENCODING)

  // Extract components
  const salt = data.subarray(0, 16)
  const iv = data.subarray(16, 28)
  const authTag = data.subarray(28, 44)
  const encrypted = data.subarray(44)

  // Derive key
  const key = (await scryptAsync(password, salt, 32)) as Buffer

  // Decrypt
  const decipher = createDecipheriv(ALGORITHM, key, iv)
  decipher.setAuthTag(authTag)

  const decrypted = Buffer.concat([
    decipher.update(encrypted),
    decipher.final()
  ])

  return decrypted.toString('utf8')
}

Password Hashing#

// lib/password.ts
import bcrypt from 'bcryptjs'

const SALT_ROUNDS = 12

export async function hashPassword(password: string): Promise<string> {
  return bcrypt.hash(password, SALT_ROUNDS)
}

export async function verifyPassword(
  password: string,
  hash: string
): Promise<boolean> {
  return bcrypt.compare(password, hash)
}

// Usage in authentication
export async function authenticateUser(email: string, password: string) {
  const user = await prisma.user.findUnique({
    where: { email }
  })

  if (!user || !user.passwordHash) {
    return null
  }

  const isValid = await verifyPassword(password, user.passwordHash)

  if (!isValid) {
    return null
  }

  return user
}

Field-Level Encryption#

// lib/encrypted-fields.ts
import { encrypt, decrypt } from './encryption'

const ENCRYPTION_KEY = process.env.ENCRYPTION_KEY!

// Encrypt sensitive fields before saving
export async function encryptUserData(data: {
  ssn?: string
  bankAccount?: string
}) {
  const encrypted: Record<string, string> = {}

  if (data.ssn) {
    encrypted.ssnEncrypted = await encrypt(data.ssn, ENCRYPTION_KEY)
  }

  if (data.bankAccount) {
    encrypted.bankAccountEncrypted = await encrypt(
      data.bankAccount,
      ENCRYPTION_KEY
    )
  }

  return encrypted
}

// Decrypt when reading
export async function decryptUserData(user: {
  ssnEncrypted?: string | null
  bankAccountEncrypted?: string | null
}) {
  const decrypted: Record<string, string | null> = {
    ssn: null,
    bankAccount: null
  }

  if (user.ssnEncrypted) {
    decrypted.ssn = await decrypt(user.ssnEncrypted, ENCRYPTION_KEY)
  }

  if (user.bankAccountEncrypted) {
    decrypted.bankAccount = await decrypt(
      user.bankAccountEncrypted,
      ENCRYPTION_KEY
    )
  }

  return decrypted
}

Prisma Middleware for Automatic Encryption#

// lib/prisma-encryption.ts
import { Prisma } from '@prisma/client'
import { encrypt, decrypt } from './encryption'

const ENCRYPTED_FIELDS = {
  User: ['ssn', 'bankAccount'],
  Payment: ['cardNumber', 'cvv']
}

const ENCRYPTION_KEY = process.env.ENCRYPTION_KEY!

export const encryptionMiddleware: Prisma.Middleware = async (params, next) => {
  const { model, action, args } = params

  if (!model || !ENCRYPTED_FIELDS[model as keyof typeof ENCRYPTED_FIELDS]) {
    return next(params)
  }

  const fields = ENCRYPTED_FIELDS[model as keyof typeof ENCRYPTED_FIELDS]

  // Encrypt on create/update
  if (action === 'create' || action === 'update') {
    for (const field of fields) {
      if (args.data?.[field]) {
        args.data[`${field}Encrypted`] = await encrypt(
          args.data[field],
          ENCRYPTION_KEY
        )
        delete args.data[field]
      }
    }
  }

  const result = await next(params)

  // Decrypt on read
  if (result && (action === 'findUnique' || action === 'findFirst')) {
    for (const field of fields) {
      const encryptedField = `${field}Encrypted`
      if (result[encryptedField]) {
        result[field] = await decrypt(result[encryptedField], ENCRYPTION_KEY)
      }
    }
  }

  return result
}

// Register: prisma.$use(encryptionMiddleware)

Envelope Encryption#

// lib/envelope-encryption.ts
import { randomBytes, createCipheriv, createDecipheriv } from 'crypto'

// Generate a data encryption key (DEK)
export function generateDek(): Buffer {
  return randomBytes(32)
}

// Encrypt DEK with master key (KEK)
export function encryptDek(dek: Buffer, kek: Buffer): string {
  const iv = randomBytes(12)
  const cipher = createCipheriv('aes-256-gcm', kek, iv)

  const encrypted = Buffer.concat([
    cipher.update(dek),
    cipher.final()
  ])
  const authTag = cipher.getAuthTag()

  return Buffer.concat([iv, authTag, encrypted]).toString('base64')
}

// Decrypt DEK with master key
export function decryptDek(encryptedDek: string, kek: Buffer): Buffer {
  const data = Buffer.from(encryptedDek, 'base64')

  const iv = data.subarray(0, 12)
  const authTag = data.subarray(12, 28)
  const encrypted = data.subarray(28)

  const decipher = createDecipheriv('aes-256-gcm', kek, iv)
  decipher.setAuthTag(authTag)

  return Buffer.concat([
    decipher.update(encrypted),
    decipher.final()
  ])
}

// Usage: Each record gets its own DEK, encrypted by KEK
interface EncryptedRecord {
  encryptedDek: string
  encryptedData: string
}

export async function encryptWithEnvelope(
  data: string,
  kek: Buffer
): Promise<EncryptedRecord> {
  const dek = generateDek()
  const encryptedDek = encryptDek(dek, kek)
  const encryptedData = await encrypt(data, dek.toString('hex'))

  return { encryptedDek, encryptedData }
}

Client-Side Encryption#

// lib/client-encryption.ts (browser)
export async function encryptInBrowser(
  data: string,
  password: string
): Promise<string> {
  const encoder = new TextEncoder()
  const salt = crypto.getRandomValues(new Uint8Array(16))

  // Derive key from password
  const keyMaterial = await crypto.subtle.importKey(
    'raw',
    encoder.encode(password),
    'PBKDF2',
    false,
    ['deriveKey']
  )

  const key = await crypto.subtle.deriveKey(
    { name: 'PBKDF2', salt, iterations: 100000, hash: 'SHA-256' },
    keyMaterial,
    { name: 'AES-GCM', length: 256 },
    false,
    ['encrypt']
  )

  // Encrypt
  const iv = crypto.getRandomValues(new Uint8Array(12))
  const encrypted = await crypto.subtle.encrypt(
    { name: 'AES-GCM', iv },
    key,
    encoder.encode(data)
  )

  // Combine salt + iv + encrypted
  const result = new Uint8Array(salt.length + iv.length + encrypted.byteLength)
  result.set(salt, 0)
  result.set(iv, salt.length)
  result.set(new Uint8Array(encrypted), salt.length + iv.length)

  return btoa(String.fromCharCode(...result))
}

Usage Instructions#

Use AES-256-GCM for symmetric encryption
Always use unique IVs/nonces for each encryption
Store the auth tag with the ciphertext
Use bcrypt for password hashing (not encryption)
Consider envelope encryption for large datasets

Best Practices#

Never roll your own crypto - Use established libraries
Use authenticated encryption - GCM mode provides integrity
Rotate keys regularly - Implement key rotation procedures
Separate encryption keys - Different keys for different data types
Hash passwords - Use bcrypt, not encryption for passwords
Protect keys - Store encryption keys in secure vaults
Audit key access - Log when encryption keys are used

Secrets Management - Manage encryption keys
Audit Logging - Track data access
Input Validation - Validate before encrypting
Session Management - Secure sessions