Timeline for Encrypting unique fields in a Database
Current License: CC BY-SA 3.0
7 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Nov 23, 2015 at 16:02 | vote | accept | Daniel van Flymen | ||
| Nov 20, 2015 at 22:40 | comment | added | Andrew Philips | Even an HSM may not solve the problem if a cracker finds a SQL Injection attack, since the HSM can decrypt by authority of the application (or database) server. Most times, stored data encryption is a Marketing Strategy (what?! you didn't encrypt the addresses?!) and not a real solution. People expect it, so we developers and security people have to provide it. I should have put this comment in my answer. Here's a link to my argument We cannot protect a computer from itself. | |
| Nov 20, 2015 at 22:34 | comment | added | Mike Ounsworth | In that case, billc.cn is right, no matter how you encrypt it, how you store the encryption keys and how you control which admins have access to those keys (some admins will need access, that's their job) is a FAR trickier problem than the encryption itself. The "proper" solution us to use a Hardware Security Module (HSM) for all your crypto and key storage. Those will run you around $10,000. | |
| Nov 20, 2015 at 22:20 | vote | accept | Daniel van Flymen | ||
| Nov 20, 2015 at 22:20 | |||||
| Nov 20, 2015 at 22:19 | comment | added | Daniel van Flymen | Thanks for your answer. In terms of the threat model I would be preparing against: 1) An attacker gaining access to the DB, 2) The prying eyes of staff/admins using the application. | |
| Nov 20, 2015 at 14:45 | comment | added | billc.cn | Note that IV is not a parameter to the cipher itself but to some modes of operation. Given a security-sound random key, I don't think any good block cipher will be weakened by a fixed IV (it's just as good as any other plain-text). The attacks against fixed IV require active tempering or viewing of the chiper text, which is not possible here. However, the OP should consider whether the key can be properly secured for this solution. | |
| Nov 19, 2015 at 21:45 | history | answered | Mike Ounsworth | CC BY-SA 3.0 |