I am using user client TLS certificates (from smartcards) to authenticate on a web program. The users store data on the server and I would like to encrypt the stored data to protect the information if the database is compromised. I would like to not store the data in plaintext.
What are recommended methods to encrypting or protecting the data at rest? I don't believe that I can use the smartcard private key to decrypt the data as it is stuck on the client side and inaccessible to the server. The users' sole method of authentication is by smart card so I cannot use a normal 'user password' as a encryption key. I am using Go as the web server, but a solution in any language is good.
UPDATE: The type of compromise I am thinking of is an attacker getting a full database dump. I would like to encrypt the data in a Redis database at the level of the “value” of the key/value storage. An example would be encrypting certain sensitive datas using the user’s password (if I was using passwords) so that only the user supplied password will successfully decrypt the data.
I am not looking for an OS or database wide encryption as the database is hosted by a third party. The user accesses the web app over HTTPS and the web app program communicates with the database. I know that IE has the S/MIME plugin that allows use of client smart card to decrypt email in Outlook online but that is basically a client side program.
User platforms targeted are Windows, OS X, Linux
User browsers targeted are IE, Chrome