I need to store a user's sensitive input on a website (like SSN) into a database. This data cannot be a one-way hash. The data, once input into db, will never be sent again to a website or anyone untrusted, but may be sent via the server to another trusted API so I need to be able to read it.
Let's assume that we have proper access controls, keys are properly stored/managed, and all information is securely transmitted through HTTPS.
From what I have read online, the method that seems to make the most sense is using a public/private asymmetric key encryption. So:
- Generate a public/private key
- Give public key to client
- Encrypt data with public key on client and send to server
- Store encrypted data into DB
- Decode with private key when needed
- Am I missing any steps here or misunderstanding anything?
- Do I need to generate a new public key for each user on my website? Or is it okay to use the same public key every time any user is sending me an SSN?
- Is it okay to store the publicly encrypted data directly on the db? Or is there something else I should do before storing it?