Ecosyste.ms: Awesome
An open API service indexing awesome lists of open source software.
https://github.com/m-esm/e2db
Step by step demo to showcase how you can have e2e encryption for your database and files.
https://github.com/m-esm/e2db
aes database e2e-encryption guide nodejs rsa
Last synced: 3 months ago
JSON representation
Step by step demo to showcase how you can have e2e encryption for your database and files.
- Host: GitHub
- URL: https://github.com/m-esm/e2db
- Owner: m-esm
- License: mit
- Created: 2020-08-10T20:17:04.000Z (over 4 years ago)
- Default Branch: master
- Last Pushed: 2023-11-17T13:55:49.000Z (about 1 year ago)
- Last Synced: 2024-10-28T12:52:28.745Z (3 months ago)
- Topics: aes, database, e2e-encryption, guide, nodejs, rsa
- Language: TypeScript
- Homepage: https://runkit.io/m-esm/e2db/branches/master
- Size: 394 KB
- Stars: 7
- Watchers: 1
- Forks: 1
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# E2DB - e2e encryption for your database and files
[](https://www.npmjs.com/package/e2db)
[](https://GitHub.com/m-esm/e2db/graphs/commit-activity)
[](https://GitHub.com/m-esm/e2db/stargazers/)
## Install
```sh
npm install e2db
```
## Run tests
```sh
npm run test
```
## Demo
https://runkit.io/m-esm/e2db/branches/master
## 🚀 Usage
```js
const Cipher = require("e2db").Cipher;
async function doExample() {
const userCloudPassword = "user cloud password";
const globalRsaPass = "global rsa passphrase";
// key.privateKey is encrypted with AES secret ( user cloud password )
// key.privateKey is also protected by rsa pass phrase ( global rsa pass for your app )
// key._id is auto generated bson object id
const key = await Cipher.keyMaker.createKey(userCloudPassword, globalRsaPass);
const model = {
message: "hello world",
secretMessage: "privacy matters",
};
// models could be encrypted by multiple keys
const encryptedModel = Cipher.encryptModel(model, [key], {
fields: ["secretMessage"],
});
console.log(JSON.stringify(encryptedModel, null, 2));
// note that 5f38843239e984113d8eb8fa is our key._id
// outputs:
// {
// "message": "hello world",
// "secretMessage": "P9acGm+rBD4TaUpNRZVx2/5UW8BY0d0frHHiF2l6flU=",
// "_cipherKeys": {
// "5f38843239e984113d8eb8fa": "RANDOM_AES_SECRET_ENCRYPTED_BY_RSA_KEY"
// },
// "_cipherFields": [
// "secretMessage"
// ]
// }
const decryptedModel = Cipher.decryptModel(
encryptedModel,
key,
userCloudPassword,
globalRsaPass
);
console.log(JSON.stringify(decryptedModel, null, 2));
// outputs:
// {
// "message": "hello world",
// "secretMessage": "privacy matters"
// }
}
```
## Why?
For the sake of security and privacy for users and their data. services need only have access to part of user's data which they granted access to, remaining data should be only decrypted on user read demand. E2DB is providing a set of tools that
will help you with this.
## What?
- Sensitive and private information in database records
- Private stored files on buckets and storages
## When?
When inserting the document, it should encrypt specific fields of a document that only could be decrypted when reading with a key.
## How?
To ensure data is end to end encrypted on your backend:
- Encrypt sensitive part of the document with AES
- Keep AES secret encrypted by the RSA key alongside the document.
- RSA public key is available in raw format to encrypt random AES secret which is used to encrypt database records/documents.
- RSA private keys need to be encrypted using AES and persisted. the
secret key for this AES cipher is our "cloud password"
- When the cloud password changes, only RSA keys need to be encrypted again.
- Cloud passwords should always be received from the client-side and not persisted on the server-side.
- To prevent leaking cloud passwords in clear text format in logs or etc, we need to encrypt them by an hourly rotated secret ( cloud password salt ) which is only available on-memory with specific expire time.
- Documents AES secret could be encrypted by multiple keys.
## Road map
- [x] Create RSA key pairs encrypted by AES secret
- [x] Changes AES secret of a RSA key
- [x] PassTrough stream with AES cipher
- [x] Cipher usage example
- [ ] Create cloud password salt
- [ ] Mongoose example
- [ ] NestJs example
- [ ] ExpressJs example
## Resources
- https://nodejs.org/en/knowledge/cryptography/how-to-use-crypto-module/
- https://gist.github.com/joepie91/7105003c3b26e65efcea63f3db82dfba
## 🤝 Contributing
Contributions, issues and feature requests are welcome!
Feel free to check [issues page](https://github.com/m-esm/e2db/issues). You can also take a look at the [contributing guide](https://github.com/m-esm/e2db/blob/master/CONTRIBUTING.md).
## Show your support
Give a ⭐️ if this project helped you!
## 📝 License
Copyright © 2020 [Mohsen Esmaeili ](https://github.com/m-esm).
This project is [MIT](https://github.com/m-esm/e2db/blob/master/LICENSE) licensed.
### Author
👤 **Mohsen Esmaeili **
- Twitter: [@mohsen_esm](https://twitter.com/mohsen_esm)
- LinkedIn: [@m-esm](https://linkedin.com/in/m-esm)