I am currently developing an End-to-End Encryption mechanism for Apache Kafka that uses encryption keys from a third party. This means the communication between producer and consumer is encrypted using internal keys, so TLS/SSL is no longer needed.

Now, I am searching for a way, to secure the SASL authentication process without using SSL for data transfer.
This is necessary because the provided SASL mechanisms PLAIN and SCRAM-SHA are only secure when used with SSL.

Kafka provides two security options: SASL_SSL and SASL_PLAINTEXT. When I use the SASL_SSL listener, the entire communication is secured using SSL. When I configure SASL_PLAINTEXT as listener, the authentication process is not secured, and my credentials are sent as PLAINTEXT. Is this correct?

Are there any options to secure the SASL authentication process, without using SSL for data transfer?

Thank you for your answers 🙂