1 Million Events per Second: Applying End-to-End Encryption to the LINE App with Apache Kafka

LY Corporation has applied end-to-end encryption to LINE’s large-scale Kafka topics, keeping payloads encrypted even while stored on brokers.

To work with standard Kafka interceptors, the team chose record-level encryption instead of batch-level encryption.

The design combines a symmetric DEK with an asymmetric KEK, balancing performance and scalability for high-volume messaging.

KMS handles key management, and only authorized consumers can decrypt messages, helping control message size and encryption overhead in multi-consumer environments.