1

I need to encrypt byte arrays blobs fields of approx 50k to 100k each in .net with a public key then store in SQL/Server thendestroy original data. When the data is retrieved by the ultimate owner, it would be with a key that only they have (I don't).

The problem is that I need all records to be encrypted with the same key so the owner can decrypt fields with set logic (group of records, not one record at a time).

I'm reading RSA is too slow to be practical for such large data and that RSA is typically used only for encrypting an symmetric key. This would work for me if I was decrypting one record at a time, but that is not the case and where I am stuck.

So, if asymmetric won't work, what is another/best way to solve this problem?

Improve this question

2 Answers 2

Reset to default
2

The best way is: don't do it yourself. Use a format/protocol with existing libraries which do the job. Indeed, as with all things crypto, making a working implementation is easy, making a secure implementation is nigh impossible -- especially since you cannot test for security.

In this case, this points to the OpenPGP format and its well-known open-source implementation GnuPG (which is both a command-line tool and a library).

Internally, OpenPGP uses hybrid encryption: a symmetric key is generated and encrypted with the asymmetric (say, RSA) public key; and the symmetric key is used to process the bulk of the data with a symmetric encryption algorithm. But though the concept is interesting to know, the details are best left to a format that has been vetted for by cryptographers, and an implementation which has sustained deployment in production for a decade, and for which most bugs are assumed to have been found and removed.

Improve this answer
0

This can be achieved similar to the way we do large file encryption using public key.

Each time such a blob needs to be encrypted:

  1. Generate a new symmetric key (AES for example).
  2. Use the symmetric key to encrypt your blob.
  3. Encrypt the symmetric key using your RSA public key.
  4. Store the encrypted symmetric key and encrypted blob.

The owner then decrypts the symmetric key using his private key and then uses the symmetric key to decrypt the blobs.

Here is an article which does files it in java. Concept is similar. http://www.macs.hw.ac.uk/~ml355/lore/pkencryption.htm

Improve this answer
3
  • Thanks but I don't understand how this will help me with my requirement to be able to decrypt sets of records (e.g., SELECT decrypt(fieldname) from table). Using your method, I can only decrypt one record at a time because the symmetric key is different for each record and stored with the record. Or did I misunderstand?
    – pghcpa
    Feb 28, 2014 at 5:07
  • The idea is slightly different in that you use the same symmetric key for encrypting all the blobs and use the public key to encrypt that symmetric key
    – coolest_head
    Mar 6, 2014 at 14:59
  • Apparently, I'm at a total loss of how to explain what I need. If I had access to the private symmetric key I wouldn't need a public key in the first place. I will start a new post and try harder to articulate my requirement.
    – pghcpa
    Apr 3, 2014 at 22:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .