Database encryption

[schuerg]

Is encryption support planned for future versions of Dexie?

There are 3rd party addons that implement encryption on top of Dexie like dexie-encrypted but I'm concerned if it will be properly maintained and supported for future versions of Dexie.

Do others also have the need for confidential "encryption-at-rest" database store for dexie, so that an official implementation is worthwhile?

[dfahlander]

Encryption seem to be a vital feature for many. I would love to assure it's continuous maintenance but so far I still rely on contributors to maintain it. I plan to create a dexie-cloud sample app using dexie-encrypted. That might turn my focus a bit more into assuring its maintenance. Can't promise when but until then, please report issues and/or contribute with PRs. I can just promise that I view encryption as an important feature and believe it must be possible to use encryption with Dexie going forward.

[michaelhue]

I hope it's okay to use this discussion for a related question: will Dexie Cloud support end-to-end encryption at some point?

[dfahlander]

I hope it's okay to use this discussion for a related question: will Dexie Cloud support end-to-end encryption at some point?

It should already be supported, by combining dexie-cloud-addon with dexie-encrypted addon. My plan is to verify that this is practical by creating an example app that demonstrates it. I would be happy to hear about peoples experiences with dexie-encrypted and whether the approach of using this addon is good enough.

[michaelhue]

Perfect, thanks for the quick reply! I see a potential issue with the fact that indexed fields can't be encrypted but may contain sensitive data.

Maybe this could be solved using blind indexing via CipherSweet.js.

[dfahlander]

Thanks for sharing that concern and the possible solution. I believe a contribution like this would be welcomed by the author of dexie-encrypted @stutrek.

[michaelhue]

A quick note for anyone interested: CipherSweet.js is currently not working in browser environments and it seems that won't change in the future.

[stutrek]

I'm not sure if encrypting indexed fields is a solvable problem, since you can't match encrypted data, and it would be too easy to do a dictionary type attack.

[stutrek]

Although I love dexie-encrypted, I had a lot of fun making it and learned a lot, I can't promise that I can continue to maintain it.