I am developing a web based application that will be employed by numerous third party organisations in numerous countries around the world.

The browser based client will feed sensitive data into a shared back end database.

All organisations in all countries will Read/Write data into the same database.

I wish to encrypt the data entered within the browser so that its safe while in transit to the back end database. e.g. client side encryption.

I also wish to encrypt the data while at rest in my database.

This application will be developed using Java, Javascript (REACT.js), and Scala.

The backend database will be MongoDB.

I cannot find a good Key Management example/description e.g. how a key is properly generated, distributed, stored, replaced, deleted, and recovered during its life time.

I have the following choices/decisions to make:-

Flavour of encryption, e.g TripleDES, RSA, Blowfish, Twofish, AES etc.. Key(s) Symmetric/Asymmetric and its/thier length How should I securely distribute the keys to my clients. How to keep my keys safe on my back end servers.

If keys should have a lifecycle of generated, distributed, stored, replaced, deleted. How do I decrypt data that was encrypted with Key0 when I am now using Key1, or Key2?

How should I store my multiple keys for my multiple clients to enable me to encrypt/decrypt each clients data.

closed as too broad by symcbean, techraf, Matthew, crovers, Xander Dec 6 '16 at 16:13

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 4
    You are asking the right type of questions, but a few people here could write an entire book about this. :) So I'm afraid it's way too broad for a SE answer. – Gabor Lengyel Dec 6 '16 at 11:20
  • ok, but what about this question?: if keys should have a lifecycle of generated, distributed, stored, replaced, deleted. How do I decrypt data that was encrypted with Key0 when I am now using Key1, or Key2? – Hector Dec 6 '16 at 11:21
  • 2
    That's a question that could at least be answered (although it would help if you provided a bit more context - like whether there is a lag in the distribution of keys and whether the new key distribution should rely on the previous keys for secure transit) but it should be posted as a seperate question - not as a comment here. – symcbean Dec 6 '16 at 11:35
  • 5
    BTW for in-transit encryption, just use TLS - anything else will be expensive and insecure. – symcbean Dec 6 '16 at 11:37
  • 2
    It looks like this has now been turned into the separate question How to implement a workable Encryption Key Lifecycle. – a CVn Dec 6 '16 at 12:50

That is a very, very broad question. You should split it up into several questions. As it is, it would fill an article.

General Encryption

For data at rest, use symmetric encryption. Asymmetric is way too slow anyways (most so-called asymmetric encryption is actually hybrid).

Use AES. Because it's the standard, it has the most eyes that looked at it, you will never have to explain why you picked AES and not something else, and the performance etc. advances of some others are unlikely to come up in your application in a meaningful way.

Also, MongoDB supports AES out-of-the-box.

Keys

Your DB keys are the crucial ones. Keep them securely locked away and keep a few backup copies stored securely (i.e. encrypted). Key generation is its own topic, but probably MongoDB handles that for you already, check it.

TLS

For communication, use TLS, aka HTTPS. It's the standard, all browsers support it and all webservers support it.

Certificates

If you want to use client-side certificates, as your question about key distribution indicates, read up on PKI. That's too much of a topic to put into a textarea field on SE. :-)

That should get you started in the right direction. For more details, I advise you ask more questions with a more narrow focus.

Not the answer you're looking for? Browse other questions tagged or ask your own question.