My team is working on a solution to store sensitive information on a remote storage solution. I am proposing that we use symmetric encryption of the data where there is a unique key per document. The keys for this will be stored such that it is accessible to where the data will be used but separate from the encrypted data. Encrypted data will be written to and read from the storage. While this is possibly overkill, I think it will ease some of the concerns that are hampering the adoption of this technology. The idea is that even if something goes wrong and someone gains access to the document storage, the data will not be useful without access to the keys. In the event someone has access to these keys, these documents will be the least of our concerns.
In a nutshell, the concern here is that someone can access this data from basically anywhere and retrieve documents through interactions with that storage provider alone. The proposed solution is intended to make it such that even if an attacker were to gain full, authenticated access to the document store, they would not have enough information to get the content of the documents. The would need to access to information that is not available at that storage provider. This (in theory) makes the security of this data basically no worse than the current situation. This might be a questionable goal but the problem I have is largely political.
I should also add that this is not meant to be the only security for these documents. This would be auxiliary to out-of-the-box protections. A side question would be whether there is anything about this that could weaken those standard approaches.
After doing some reading, I think using 256 AES should be adequate. Is this the case and for how long should we expect this to be good enough?
I also understand that using a MAC is standard to ensure that the data has not been corrupted. After reading the wiki page here and then delving into more detail and some debate, I'm struggling to make sense of this in this use case. Data corruption is not a primary concern here but I don't think it hurts. But if all I want to do is verify the message has not been corrupted, is there any reason a hash (e.g. SHA-256) stored with my key wouldn't meet my requirement? I'm probably missing something here.
Does the overall approach and algorithm seem legit? Any help with the MAC/hash stuff is appreciated.