I am developing a web based application that will be employed by numerous third party organisations in numerous countries around the world.
The browser based client will feed sensitive data into a shared back end database.
All organisations in all countries will Read/Write data into the same database.
I wish to encrypt the data entered within the browser so that its safe while in transit to the back end database. e.g. client side encryption.
I also wish to encrypt the data while at rest in my database.
The backend database will be MongoDB.
I cannot find a good Key Management example/description e.g. how a key is properly generated, distributed, stored, replaced, deleted, and recovered during its life time.
I have the following choices/decisions to make:-
Flavour of encryption, e.g TripleDES, RSA, Blowfish, Twofish, AES etc.. Key(s) Symmetric/Asymmetric and its/thier length How should I securely distribute the keys to my clients. How to keep my keys safe on my back end servers.
If keys should have a lifecycle of generated, distributed, stored, replaced, deleted. How do I decrypt data that was encrypted with Key0 when I am now using Key1, or Key2?
How should I store my multiple keys for my multiple clients to enable me to encrypt/decrypt each clients data.