3

Think of this scenario:

  • you've got an application that manages some files
  • some of these files contain sensitive data that should be encrypted on disk
  • the application is configured to start by itself after a reboot
  • the server on which the application runs is patched and rebooted regularily

How would you manage the encryption key?

closed as too broad by Eric G, David, Steffen Ullrich, Matthew, M'vy Jan 12 '18 at 13:30

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

2

For this situation unless using a hardware encryption module the raw keys have to be available to the machine. For the encryption to offer any real benefit the keys must be stored in a format which is harder to read than the underlying files.

This means either

  • store the files on a separate machine to the application. If the application server security model is broken they still have access to everything but if the file server is accessed all they get is encrypted information.
  • Store the keys in a way that they aren't readable to the application. This is usually done by having a process running as a more privileged user read the keys then pass them through to the application on start. This means the only way any attacker gaining access as the same user as the application (assuming no opportunity for privilege escalation) can get hold of the keys is to read them out of memory or a core dump of the application.
  • I'm thinking about maybe combining both of your points: separate data and appplication AND providing encryption keys with a more priviledged process. – bangnab Jan 8 '18 at 15:13

Not the answer you're looking for? Browse other questions tagged or ask your own question.