Encrypt Trainer Class Export Files to Protect Student PII

[enpasos]

Problem

Currently, the Trainer export function produces a plain JSON file (skillpilot-class-*.json) that contains a direct mapping between Student Real Names and their SkillPilot-IDs.

If this file is leaked or shared insecurely (e.g., left on a shared school computer), anyone can use it to de-anonymize the student data associated with those IDs. This constitutes a PII leakage risk and weakens pseudonymization.

---

Proposal

Implement client-side encryption for the class export file.

1. Export flow

   • When a trainer exports a class, prompt them to set a password.
   • Before generating the download blob, encrypt the JSON content with the provided password.

2. Encryption

   • Use a secure, modern algorithm such as AES-GCM.
   • Derive an encryption key from the trainer’s password using a standard KDF (e.g., PBKDF2, scrypt, or Argon2).
   • Store any required metadata (e.g., salt, IV, version) alongside the ciphertext in the exported file.

3. Import flow

   • When importing a class file, detect if the file is encrypted (e.g., via a version/format marker).
   • If encrypted, prompt the user for the password.
   • Decrypt the content client-side and then process the resulting JSON as today.
   • If decryption fails (wrong password, corrupted file), show a clear, non-technical error message.

---

Goals

• Ensure that only the authorized teacher (who knows the password) can read the Real Name ↔︎ SkillPilot-ID mapping.
• Reduce the risk of accidental PII leaks if the export file is mishandled, shared, or left on insecure devices.
• Maintain a smooth UX while adding a meaningful privacy and security layer.

---

Impact

• Improves alignment with data privacy regulations (e.g., GDPR) by strengthening pseudonymization and protecting the re-identification key (Real Name ↔︎ ID mapping).
• Limits the damage of file leaks: exported class files are useless to unauthorized parties without the password.
• Helps schools and institutions demonstrate privacy-by-design in handling student data.

[enpasos]

Statusabgleich am 2026-04-04:

Der verschluesselte Klassenexport ist noch nicht umgesetzt.

Aktueller Repo-Stand:

• Der Trainer-Klassenexport schreibt weiterhin plain JSON direkt in eine Datei skillpilot-class-*.json.
  • app/src/views/TrainerView.tsx
  • handleExportClass() nutzt JSON.stringify(session, null, 2) und erzeugt daraus direkt einen Download-Blob.
• Der Import liest die Datei ebenfalls unverschluesselt per FileReader + JSON.parse(...).
  • ebenfalls app/src/views/TrainerView.tsx
• Ich finde aktuell keine Implementierung fuer
  • AES-GCM
  • PBKDF2 / scrypt / Argon2
  • passwortgeschuetzten Klassenexport
  • verschluesselte Klassenimport-Erkennung

Wichtige Abgrenzung:

• Der Learner-Export hat inzwischen Integritaetsschutz via signiertem Server-Payload und einen versionierten Wrapper.
  • docs/concept/runtime-workflows/import-export-workflow.md
• Das loest aber nicht das hier beschriebene PII-Problem des Trainer-Klassenexports mit Realname <-> SkillPilot-ID-Zuordnung.

Fazit:

• Issue bleibt offen.
• Der Bedarf ist weiterhin real und der aktuelle Codepfad ist klar identifiziert.