We’re rewarding the question askers & reputations are being recalculated! Read more.
3 added adversary model info from the comments.
source | link

I am writing a web backend/api for an iOS application using Node.js and MySQL. In my database I have a table for posts. I would like the posts content to be encrypted. Let's say I'm using this AES for encryption.

I would like to be able to safely encrypt and decrypt data on the server. Data sent back and forth to the client will be unencrypted, but sent over HTTPS (is this a good idea)?

My Questions:

  1. How should I generate the keys? Should they be random strings?

  2. Where should I store the keys since there is going to be a different key for each message.

Adversary Model
I would like to protect against someone who already has access to my server running the https API (written in Node.js) and has access to my MySQL DB. I would like to project against that person being able to decrypt the encrypted data in that table. So it is important that even if they have lots of encrypted data, and how the encryption works still cannot decrypt the data.

I am writing a web backend/api for an iOS application using Node.js and MySQL. In my database I have a table for posts. I would like the posts content to be encrypted. Let's say I'm using this AES for encryption.

I would like to be able to safely encrypt and decrypt data on the server. Data sent back and forth to the client will be unencrypted, but sent over HTTPS (is this a good idea)?

My Questions:

  1. How should I generate the keys? Should they be random strings?

  2. Where should I store the keys since there is going to be a different key for each message.

I am writing a web backend/api for an iOS application using Node.js and MySQL. In my database I have a table for posts. I would like the posts content to be encrypted. Let's say I'm using this AES for encryption.

I would like to be able to safely encrypt and decrypt data on the server. Data sent back and forth to the client will be unencrypted, but sent over HTTPS (is this a good idea)?

My Questions:

  1. How should I generate the keys? Should they be random strings?

  2. Where should I store the keys since there is going to be a different key for each message.

Adversary Model
I would like to protect against someone who already has access to my server running the https API (written in Node.js) and has access to my MySQL DB. I would like to project against that person being able to decrypt the encrypted data in that table. So it is important that even if they have lots of encrypted data, and how the encryption works still cannot decrypt the data.

2 removed unneeded fluff.
source | link

I am writing a web backend/api for an iOS application using Node.js and MySQL. In my database I have a table for posts. I would like the posts content to be encrypted. Let's say I'm using this AES for encryption.

I would like to be able to safely encrypt and decrypt data on the server. Data sent back and forth to the client will be unencrypted, but sent over HTTPS (is this a good idea)?

My Questions:

  1. How should I generate the keys? Should they be random strings?

  2. Where should I store the keys since there is going to be a different key for each message.

I have never really done any security/encryption stuff before so I'm a noobie at this.

Thanks for all the help!

- Jason

I am writing a web backend/api for an iOS application using Node.js and MySQL. In my database I have a table for posts. I would like the posts content to be encrypted. Let's say I'm using this AES for encryption.

I would like to be able to safely encrypt and decrypt data on the server. Data sent back and forth to the client will be unencrypted, but sent over HTTPS (is this a good idea)?

My Questions:

  1. How should I generate the keys? Should they be random strings?

  2. Where should I store the keys since there is going to be a different key for each message.

I have never really done any security/encryption stuff before so I'm a noobie at this.

Thanks for all the help!

- Jason

I am writing a web backend/api for an iOS application using Node.js and MySQL. In my database I have a table for posts. I would like the posts content to be encrypted. Let's say I'm using this AES for encryption.

I would like to be able to safely encrypt and decrypt data on the server. Data sent back and forth to the client will be unencrypted, but sent over HTTPS (is this a good idea)?

My Questions:

  1. How should I generate the keys? Should they be random strings?

  2. Where should I store the keys since there is going to be a different key for each message.

1
source | link

Storing encryption keys on a server using Node.js and MySQL

I am writing a web backend/api for an iOS application using Node.js and MySQL. In my database I have a table for posts. I would like the posts content to be encrypted. Let's say I'm using this AES for encryption.

I would like to be able to safely encrypt and decrypt data on the server. Data sent back and forth to the client will be unencrypted, but sent over HTTPS (is this a good idea)?

My Questions:

  1. How should I generate the keys? Should they be random strings?

  2. Where should I store the keys since there is going to be a different key for each message.

I have never really done any security/encryption stuff before so I'm a noobie at this.

Thanks for all the help!

- Jason