Encryption

As explained in Apache Kafka in Action

Encryption transforms readable data into an encoded form that requires a corresponding decryption method to recover.

Kafka data can be exposed while crossing a network or while stored on disk. Encryption helps protect it in both states; highly sensitive data may need end-to-end encryption as well. section 13.2 section 13.4

Choose protections according to where data is vulnerable:

• Encrypt network traffic and sign it to protect data in transit and its integrity. section 13.2
• Encrypt disks through the underlying storage system; Kafka does not provide native at-rest encryption. section 13.4
• Use client-level end-to-end encryption for highly sensitive data. Network and disk encryption do not protect data from server or Kafka administrators. section 13.2

For ZooKeeper-based clusters, unencrypted connections can expose Kafka metadata and, in some cases, stored credentials. TLS is supported for ZooKeeper connections with Kafka 2.5 and later; mutual TLS is recommended between brokers and ZooKeeper. Watch latency, since excessive delay can affect cluster availability. section 13.2.6

Figure 13.3 Securing a Kafka cluster involves transport encryption for communication, user authentication and authorization, and encryption of data at rest.

The diagram connects transport encryption, authentication and authorization, and encryption at rest as complementary Kafka security measures. section 13.2

How Apache Kafka in Action covers it

How deep it goes

Distinguishes transport, disk, and end-to-end encryption, explains their limits, and notes ZooKeeper TLS without detailing its configuration.

Examples

Contrasts Kafka network traffic, stored disks, sensitive messages, and broker-to-ZooKeeper connections.

What you can do after

Apply TLS to Kafka transport, encrypt storage through underlying systems, and use client-level end-to-end encryption for sensitive data.

How it connects

Connects encryption with TLS, authentication, authorization, disk encryption, end-to-end encryption, and ZooKeeper security.

liveBookmanning.com

Read Apache Kafka in Action on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  Software Security for DevelopersEncryption is the transformation of readable data into an encoded form intended to prevent unauthorized access.
• 

  liveBookmanning.com
  Spring Security in Action, Second EditionEncryption is the transformation of readable data into ciphertext using a cryptographic key so that only authorized parties can recover the original data.
• 

  liveBookmanning.com
  Real-World CryptographyEncryption is the transformation of plaintext into ciphertext so that the information is concealed from unauthorized parties.
• 

  liveBookmanning.com
  Grokking Relational Database DesignEncryption is the transformation of readable data into encoded information that cannot be understood without the appropriate decryption capability.
• 

  liveBookmanning.com
  Grokking Web Application SecurityEncryption is the cryptographic transformation of readable data into a protected representation that can be reversed with the appropriate key.
• 

  liveBookmanning.com
  Kafka for ArchitectsEncryption is the transformation of readable data into a form accessible only through an appropriate cryptographic key.
• 

  liveBookmanning.com
  Acing the CCNA Exam: Volume 2 Advanced Networking and SecurityEncryption is the transformation of readable data into ciphertext that can be recovered only with the appropriate decryption capability.
• 

  liveBookmanning.com
  AI-Powered Developer: Build software with ChatGPT and CopilotEncryption is the cryptographic transformation of readable data into an encoded form that unauthorized parties cannot readily interpret.
• 

  liveBookmanning.com
  Build AI-Enhanced Web AppsEncryption is the transformation of readable data into an encoded form that requires a corresponding key or process to recover.
• 

  liveBookmanning.com
  Data Pipelines with Apache Airflow, Second EditionEncryption is the transformation of readable data into ciphertext that requires a cryptographic key for recovery.
• 

  liveBookmanning.com
  The Art of AI Product DevelopmentThe transformation of data into a protected representation that requires authorized decryption to read.
• 

  liveBookmanning.com
  Microsoft Azure in ActionEncryption is the transformation of data into an encoded form that requires a key or equivalent secret to recover the original content.
• 

  liveBookmanning.com
  Generative AI in ActionEncryption is the transformation of readable data into a protected form that requires a key or equivalent mechanism to recover.
• 

  liveBookmanning.com
  Server-Side WebAssemblyEncryption is the process of transforming readable plaintext into ciphertext using a key so that unauthorized parties cannot read it.
• 

  liveBookmanning.com
  Data for AllEncryption is the transformation of readable data into coded form so that it cannot be understood without the appropriate key or decryption process.

Compare how 16 books explain encryption →

Related concepts

• ciphertextproduces · Ciphertext is data produced by encryption whose original content is intended to be unreadable without the required decryption capability.
• Base64contrasts with · Base64 is a binary-to-text encoding scheme that represents arbitrary bytes using a fixed 64-character alphabet and provides no confidentiality.
• plaintextproduces · Plaintext is information in a directly readable, unencrypted form rather than a cryptographically encoded form.
• hash functioncontrasts with · A hash function deterministically maps input data to a value in a bounded output range, commonly for indexing, lookup, comparison, or integrity checking.
• homomorphic encryptionincludes · Homomorphic encryption is encryption that permits specified computations on ciphertexts whose decrypted results correspond to computations on the underlying plaintexts.
• symmetric key encryptionincludes · Symmetric-key encryption is cryptography that uses the same shared secret key, or equivalent derived key material, to encrypt and decrypt data.

This explainer was generated by Manning's knowledge graph from the text of Apache Kafka in Action. The section links point to the parts of the book it draws on.