Plug-n-play client-side encryption

[jkeys-ecg-nmsu]

Is your feature request related to a problem? Please describe.
Electronic Caregiver is a healthcare and security company, so we deal with multiple compliance regimes: HIPAA, PCI, etc. If we intend to keep any e.g. PHI on the client for fast lookup, we need a way to keep it encrypted without storing permanent keys on the client.

Describe the solution you'd like
I'd like Amplify to (optionally) seamlessly encrypt and decrypt any and/or all data in localStorage by way of external calls to KMS. I'd also like Amplify to handle the same for arbitrary local files, so we can easily store sensitive data locally and attach that data to the client.

I'm not a security expert, so I'm not sure how this could be achieved without defeating the point (which seems to be easier to do than actually designing a secure client-side encryption scheme). I'm hoping someone smarter than me can fill in the gaping holes in my FR.

[undefobj]

Hi @jkeys-ecg-nmsu we are looking at encryption of the storage category in the future, however KMS is not in scope for this as key management is a very large problem space and doing this reliably with rotation might not be scalable, reliable, or even cost effective for apps. KMS is also primarily targeted at backend key management where the behavior compared to mobile and web devices is much different. The common way of doing this in the industry for apps is with developer provided keys locally on the device. From a compliance standpoint, many of them require full device encryption anyway or for the whole of the app rather than just part of it. If you have any specific compliance documentation and case for storing such data permanently on the device where you cannot use developer provided keys, can you please point us at such material?

[jkeys-ecg-nmsu]

@undefobj do you have any recommended reading for how to build a DevOps pipeline that can provision and deploy developer provided keys to client machines, rotate said keys, etc? I simply have no idea how this would be achieved in a scalable manner.

[undefobj]

I do not.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[jkeys-ecg-nmsu]

Will DataStore have this feature?

[jkeys-ecg-nmsu]

@undefobj is DataStore going to allow client-side encryption and decryption at some point?

[undefobj]

We're looking at it. The DynamoDB tables that it sync with have encryption at rest already but we're investigating if additional controls can be done here in 2020 for clients.

[sbaxter]

I was thinking of putting together a PR that allows for a user of amplify to wrap IndexedDB put and get calls with a function that one could use to encrypt the data in IndexedDB, but avoid having the encrypted blobs synced to DynamoDB. I found Datastore.storage.adapter.indexeddb as a likely shim point for something like this.

1. Does anyone know if this feature is on the roadmap yet?
2. Is there a better way to accomplish this? The only alternative I can think of is to implement a key management solution, so that the server can decrypt the data on the back-end . . . or to ditch amplify and duplicate the logic provided by Datastore and AppSync.

I'd rather not maintain a fork of amplify, so I'd only want to go that route if it is on the roadmap or a PR is likely to get accepted.
Encryption at-rest in IndexedDB may become native at somepoint, but we're at least 1-2 years early on that it looks like.

[FrankySnow]

We're looking at it. The DynamoDB tables that it sync with have encryption at rest already but we're investigating if additional controls can be done here in 2020 for clients.

Is there some progress on it ? 2020 is nearing its end... Thanks !

[de1mat]

Also interested in the client-side data being encrypted. Thanks for all your efforts with DataStore and Amplify in 2020.

[rpostulart]

I am also interested in this option and looking for the timelines

[TorrentofShame]

I am also interested in this option.

[rpostulart]

I believe this solution is already providing encryption at rest at client.

https://realm.io/

Maybe we can learn something from that