3

For data that must be encrypted (read again, not hashed like a password) does storing ciphertext in a database gain you much over using the database's built-in encryption?

In this case it would be ciphertext generated by attr_encrypted vs PostgreSQL's pgcrypto module. I would think it protect data that was obtained from SQL injection or database access as long as the key remained safe?

The ciphertext downside being you lose the ability to query the data, so if it's only security theater it seems better to use the built-in database encryption.

Improve this question

1 Answer 1

Reset to default
2

...does storing ciphertext in a database gain you much over using the database's built-in encryption?

I would think it protect data that was obtained from SQL injection or database access as long as the key remained safe?

No. SQLi can be used to quickly escalate access to the rest of the machine.

Form the pgcrypto docs you list:

F.25.6.3. Security Limitations

All pgcrypto functions run inside the database server. That means that all the data and passwords move between pgcrypto and client applications in clear text. Thus you must [either]:

-Connect locally or use SSL connections.

-Trust both system and database administrator.

If you cannot, then better do crypto inside client application.

This means that if an attacker can get into the machine, your data is exposed.

As they suggest, if this can not be ruled out you can do one of two things:

  • Move the application to a separate machine so the key is not on the same machine as the database
  • Encrypt the data in the client application.

The ciphertext downside being you lose the ability to query the data.

Not entirely. Here is a guide on indexing encrypted data in SQL

Improve this answer
1
  • 1
    One note on the last link: the proposed MAC SHA-1(plaintext || key) is susceptible to length extension attacks. See this answer for a demonstration and why an HMAC is a better solution.
    – Andy
    Commented Jan 28, 2017 at 7:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .