This question already has an answer here:
I have a database with encrypted information, and want to encrypt each entry with a different key. Then I want to store the encrypted keys in another database. I know I have to encrypt the keys before storing them, but how? My understanding of the process is like this:
- Encrypt the original data with a secure key, then store the encrypted data
- Encrypt the key with a new secure key, then store the encrypted key
- Goto 2
How do I avoid this infinite loop and maintain security?
Edit: The answers there do not address my problem because: (1-2) I don't have access to external hardware, and more importantly I want to store the encrypted keys in another database. (3-4) I don't want to be logged in in order for others to access their data. (5-7) These don't mention encryption at all.
Edit: To further elaborate, I want to implement PCI DSS requirement 3.5.3's first method of storage:
Store secret and private keys in one (or more) of the following forms at all times:
- Encrypted with a key-encrypting key that is at least as strong as the data-encrypting key, and that is stored separately from the data-encrypting key
- Within a secure cryptographic device (such as a hardware (host) security module (HSM) or PTS-approved point-of-interaction device)
- As at least two full-length key components or key shares, in accordance with an industry accepted method
Edit: Answer in the comments. Replace step 3 above with:
- Get a password from the user. Transform it into an encryption key with the most current PBKDF series. Encrypt the key from step 2 with the PBKDF key, then discard the PBKDF key.
If you have access to an HSM or TPM, you can also store the key there.