Issue

Currently, Hydra stores claims from consent application as json in database. In our case, we will have a field in /userinfo endpoint stores JWT. Similar to Aggregated Claims.

This can be supported by adding claims to id token session in hydra consent application. But hydra will save claims in plain text. Attacker can use the JWT if they grant the database access.

Solution

1. add a config flag encryption_session_data to hydra
2. if flag is true, encrypt data before writing in database and decrypt after reading from database.
   encryption can use same encryption system today with the RSA key encryption in database.
3. Optional, we can also support GCP KMS for long term. See Proposal: Support External Cryptography Services #1328