> For the complete documentation index, see [llms.txt](https://docs.digit.org/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.digit.org/local-governance/v2.7/platform/configure-digit/configuring-digit-services/encryption-service.md).
# Encryption Service
## Overview
The Encryption Service is used to secure sensitive data that is being stored in the database.
## Pre-requisites
Before you proceed with the documentation, make sure the following pre-requisites are met -
* *Java 8.*
* Kafka server is up and running.
### Key Functionalities
Encryption Service offers the following features :
1. Encrypt - The service encrypts the data based on given input parameters and data to be encrypted. The encrypted data is mandatory for a string data type.
2. Decrypt - The decryption will happen solely based on the input data (any extra parameters are not required). The encrypted data has the identity of the key used at the time of encryption, the same key will be used for decryption.
3. Sign - Encryption Service can hash and sign the data which can be used as the unique identifier of the data. This can also be used for searching the given value from a datastore.
4. Verify - Based on the input sign and the claim, it can verify if the given sign is correct for the provided claim.
5. Rotate Key - Encryption Service supports changing the key used for encryption. The old key will still remain with the service which will be used to decrypt old data. All the new data will be encrypted by the new key.
## Configuration Details
Following are the properties in the application.properties file in egov-enc-service which are configurable.
| Property | Default Value | Remarks |
| ---------------------- | --------------- | --------------------------------------------------------------------------------------------------------------------------- |
| `master-password` | asd@#$@$!132123 | Master password for encryption/ decryption. |
| `master.salt` | qweasdzx | A salt is random data that is used as an additional input to a one-way function that hashes data, a password or passphrase. |
| `master.initialvector` | qweasdzxqwea | An initialization vector is a fixed-size input to a cryptographic primitive. |
| `size.key.symmetric` | 256 | Default size of Symmetric key. |
| `size.key.asymmetric` | 1024 | Default size of Asymmetric key. |
| `size.initialvector` | 12 | Default size of Initial vector. |
## Deployment Details
1. Deploy the latest version of the Encryption Service.
2. Add Role-Action mapping for APIs.
## Integration Details
### Integration Scope
The Encryption service is used to encrypt sensitive data that needs to be stored in the database.
### Integration Benefits
* Can perform encryption without having to re-write encryption logic every time in every service.
### Steps to Integration
1. To integrate, a host of encryption services, modules should be overwritten in the helm chart.
2. `/crypto/v1/_encrypt` should be added as an end point for encrypting input data in the system
3. `/crypto/v1/_decrypt` should be added as the decryption endpoint.
4. `/crypto/v1/_sign` should be added as the endpoint for providing a signature for a given value.
5. `/crypto/v1/_verify` should be added as the endpoint for verifying whether the signature for the provided value is correct.
6. `/crypto/v1/_rotatekey` should be added as an end point to deactivate the keys and generate new keys for a given tenant.
## Reference Docs
### Doc Links
| **Title** | **Link** |
| ------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| API Swagger Documentation | [Swagger Documentation](https://editor.swagger.io/?url=https://raw.githubusercontent.com/egovernments/DIGIT-OSS/master/core-services/docs/enc-service-contract.yml#!/) |
### API List
a) `POST /crypto/v1/_encrypt`
Encrypts the given input value/s OR values of the object.
b) `POST /crypto/v1/_decrypt`
Decrypts the given input value/s OR values of the object.
c) `/crypto/v1/_sign`
Provide signature for a given value.
d) `POST /crypto/v1/_verify`
Check if the signature is correct for the provided value.
e) `POST /crypto/v1/_rotatekey`
Deactivate the keys for the given tenant and generate new keys. It will deactivate both symmetric and asymmetric keys for the provided tenant.
> [**](http://creativecommons.org/licenses/by/4.0/)*All content on this page by* [*eGov Foundation*](https://egov.org.in/) *is licensed under a* [*Creative Commons Attribution 4.0 International License*](http://creativecommons.org/licenses/by/4.0/)*.*
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.digit.org/local-governance/v2.7/platform/configure-digit/configuring-digit-services/encryption-service.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.