Missing Encryption at Rest

@Component
public class EncryptionService {

    private final SecretKey secretKey;
    private static final String ALGORITHM = "AES/GCM/NoPadding";

    public EncryptionService() throws Exception {
        // Load encryption key from secure key management system (KMS)
        // In production: use AWS KMS, Azure Key Vault, HashiCorp Vault
        this.secretKey = loadKeyFromKMS();
    }

    public String encrypt(String plaintext) throws Exception {
        Cipher cipher = Cipher.getInstance(ALGORITHM);
        GCMParameterSpec parameterSpec = new GCMParameterSpec(128, generateIV());
        cipher.init(Cipher.ENCRYPT_MODE, secretKey, parameterSpec);

        byte[] encryptedData = cipher.doFinal(plaintext.getBytes(UTF_8));
        return Base64.getEncoder().encodeToString(encryptedData);
    }

    public String decrypt(String ciphertext) throws Exception {
        Cipher cipher = Cipher.getInstance(ALGORITHM);
        GCMParameterSpec parameterSpec = new GCMParameterSpec(128, extractIV());
        cipher.init(Cipher.DECRYPT_MODE, secretKey, parameterSpec);

        byte[] decryptedData = cipher.doFinal(Base64.getDecoder().decode(ciphertext));
        return new String(decryptedData, UTF_8);
    }
}

@Converter
public class EncryptedStringConverter implements AttributeConverter<String, String> {

    @Autowired
    private EncryptionService encryptionService;

    @Override
    public String convertToDatabaseColumn(String attribute) {
        try {
            // SECURE: Encrypt before storing in database
            return encryptionService.encrypt(attribute);
        } catch (Exception e) {
            throw new RuntimeException("Encryption failed", e);
        }
    }

    @Override
    public String convertToEntityAttribute(String dbData) {
        try {
            // SECURE: Decrypt when reading from database
            return encryptionService.decrypt(dbData);
        } catch (Exception e) {
            throw new RuntimeException("Decryption failed", e);
        }
    }
}

@Entity
@Table(name = "users")
public class User {
    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;

    private String username;

    // SECURE: SSN automatically encrypted/decrypted
    @Convert(converter = EncryptedStringConverter.class)
    @Column(name = "ssn")
    private String socialSecurityNumber;

    // SECURE: Credit card automatically encrypted/decrypted
    @Convert(converter = EncryptedStringConverter.class)
    @Column(name = "credit_card")
    private String creditCardNumber;

    // SECURE: Medical records encrypted at rest
    @Convert(converter = EncryptedStringConverter.class)
    @Column(name = "medical_record", columnDefinition = "TEXT")
    private String medicalRecord;

    // Getters and setters...
}

// Even if database is compromised, all sensitive fields
// are stored as encrypted ciphertext.
// Encryption keys are managed separately in secure KMS.