Say, I have encrypted data in a database. How wise is it to break a secret encryption key into several parts and save each one in a different place?


key1 = get_key1_from_remote_server()
key2 = get_key2_from_env_variable()
key3 = get_key3_from_some_protected_storage()

full_key = key1 + key2 + key3
enc_data = encrypt(data, full_key)

Thus a hacker will have to gain access to all those locations to decrypt data.

Is this more secure than to have a whole key stored in one place?


That depends a lot on your ceremonies. It sounds like your encrypted data is on a computer connected to the internet, isolating the computer would be a better way to increase security. If you are decrypting the data often it is also not that helpful, an adversary could watch you put together the split key and then use this assembled key later.

Secret sharing does cover some of this theory and might show where this idea is used, also shows that instead of just concatenating the spit keys together you should do something a little bit more complicated.

  • it's definitely not safe at all, zero benefit that is, to store one of the parts of a whole key with encrypted data, correct? in my case if I were to store key1 in a local database along with data I was going to encrypt with full_key. Jul 14 '17 at 10:10
  • @アレックス it depends on the implementation, what type of cipher, for example OAEP pretty much sends an encryption with an encrypted key appended to the end, but this gives some benefits en.wikipedia.org/wiki/Optimal_asymmetric_encryption_padding
    – daniel
    Jul 14 '17 at 10:46
  • I meant, in a separate column, only a key. In general. Jul 14 '17 at 10:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.