I am most interested in the 2nd question. I struggled sometime with understanding the reasons for storing the encryption key so close to the encrypted data, even though you store it encrypted with a key encryption key.

The only reason that I can think of is using the database encryption infrastructure/capabilities for performing transparent encryption/decryption. Though, this is highly database vendor specific (as stated in a document linked by a previous post too).

I would advice keeping the keys in a different storage, protected by passwords or with an HSM device.

Best regards, Dan.

I am most interested in the 2nd question. I struggled sometime with understanding the reasons for storing the encryption key so close to the encrypted data, even though you store it encrypted with a key encryption key.

The only reason that I can think of is using the database encryption infrastructure/capabilities for performing transparent encryption/decryption. Though, this is highly database vendor specific (as stated in a document linked by a previous post too).

I would advice keeping the keys in a different storage, protected by passwords or with an HSM device.