What is Application Layer Encryption in Web application?

Question

I have found a lot of definition of application layer encryption through Google but none of them is giving a concrete example of how to do it in web application.

The following post says encrypt the data is only view able in your applications memory space. Transport Layer Encryption vs. Application Layer Encryption

What does it actually means when let say I am building a banking web application. How does it perform application layer encryption?

• Is there any difference on client side or server side?
• Does encryption in database considered as application layer encryption?
• How is data encrypted on client side? Is it using javascript on browser or this is done on the server side?
• If I implemented application layer encryption, does it add another layer of protection from MiTM attack if https / CA is compromised?
• Where does encryption and decryption take place?

It will be really helpful if someone can clarify it. I have experience with building web application in RoR, Django and nodejs. Any examples will help.

Thanks

Answer 1

You normally use Application Layer Encryption for app to app communication: firsts app encrypts its data and sends it whatever the underlying transport is to the second one. And the data will only be decrypted there.

In a browser to server application, the only way would be to use client code (Javascript) to encrypt the request payload and decrypt the response payload. I willingly use payload here, because at application level only the request and response payload is considered. And on the server side, the server application will decrypt received data and encrypt what it sends back.

But it is more used for web services. Here the client application can more easily encrypt/decrypt the data before sending it and after receiving it.

In fact the way I described the browser to server Application Layer Encryption is just a special case of a web service where the client is a Javascript application.