bitzorcas
中 EN

Concept

Data protection

Planned data protection — encryption at rest for sensitive fields, key management, and ASP.NET Core Data Protection integration.

Last updated

Data protection (encryption at rest) is not yet implemented in BitzOrcas. Sensitive data currently relies on SQL Server’s built-in encryption capabilities and TLS for transport security.

Current protection measures

LayerMechanism
TransportTLS 1.2+ (HTTPS)
Database connectionEncrypted (TLS)
API keysSHA-256 hashed at startup
HMAC secretsOnly hash stored inNonceStore
Delegation tokensTime-limited + revocable
JWTSymmetric key (minimum 32 chars)

Planned enhancements

FeatureDescription
Field-level encryptionEncrypt sensitive PII fields at rest
ASP.NET Core Data ProtectionKey management for protecting payloads
Column encryptionSQL Server Always Encrypted for specific columns
Key rotationAutomated key rotation with grace period

Configuration (planned)

{
  "DataProtection": {
    "Keys": {
      "StoragePath": "/var/keys/dataprotection",
      "RotationPeriod": "90.00:00:00"
    },
    "FieldEncryption": {
      "Enabled": true,
      "Fields": ["Email", "PhoneNumber", "IdNumber"]
    }
  }
}

See also