0

I'm a student and have one challenge about cryptography. I need clear definition or simple definition to better understand cryptography and related security. I’ve been reading lots of material, seeing videos, but I think the encryption domain is too confusing and complex for me to grasp. So, I’m hoping there are simple answers to my questions.

Suppose I create SQL Server database (Angular and NodeJS as my front and back) and store all data with encryption so that the server holds all this data and no other person can use this stored information.

  1. How I can use an encryption model so that this encrypted data (user/pass/token) can be seen by an admin, but not seen (encrypted) by others?

  2. If this data (user/pass/token) is “stolen”, will others be able to also see my encrypted data like an admin would? If, how can I prevent that from an information security point of view?

3
  • Not a direct answer to the question but for me watching videos of the Enigma (German Cypher machine) gave me some insight into cryptography! – toom May 11 '18 at 13:15
  • 1
    I'm not sure I understand. Where is the encryption key being stored, and how is access gained to it? What is the encrypted data and its relation to user/pass/token? – multithr3at3d May 11 '18 at 13:49
  • It's not really clear what you're asking. It sounds like you have very broad questions on crytography, but you've come up with a relatively difficult question to answer because it all depends on implementation. Can you try to boil down your confusion and complexity to a more succinct question? – Steve Sether May 14 '18 at 17:35
2

This is a very broad question. How the cryptography operates depends completely depends on the type of encryption used (a specially secure DB, a DB file encrypted, encryption using special SQL constructs or application based encryption. etc.). Then it also depends on the key system used, public key or secret key encryption and how the key management and access conditions are setup.

If you take a birds eye view then encryption doesn't make sense: to decrypt (and, for symmetric ciphers, also to encrypt) you need access to a secret key. So instead of securing your data you now have to secure a key. This key may however be generated in advance and is much smaller than the data. But more importantly it may have a different protection and may be restricted in access.

The more protected and least accessible the key is the more secure it is. This comes at a price of course. Say you'd use a passphrase or a private key on a special device. In that case you need to supply the key during booting of the DB, and you may need to provide continuous access to it without breaking the security measures.


So onto your questions:

How I can use an encryption model so that this encrypted data (user/pass/token) can be seen by an admin, but not seen (encrypted) by others?

By encrypting the data in such a way that it only can be decrypted by a private or secret key held by the admin. Sometimes a data key is e.g. encrypted with the key of the admin, and that data key is in turn used to encrypt the data in the database (so you get a hierarchical structure where the security of one key depends on another, higher level key).

I'm not sure I understand. Where is the encryption key being stored, and how is access gained to it? What is the encrypted data and its relation to user/pass/token?

Where the key is stored depends on the system. Hopefully it is stored in some kind of secure store, e.g. protected by the operating system. But it may also be a static key in the application code or stored in a configuration file.

Banks and such tend to store the most sensitive keys in HSM's (if the keys need to be directly accessible) or off-line (on an offline storage device that can be used by a hardened laptop). On smart cards and HSM's the keys can only be used, not retrieved (exported) except for back up purposes. Using the keys generally requires the user or system to authenticate to the storage device.

But books have been written about key management, and in the end you may need to read a few to fully understand how to handle keys.

1
  • I read more time your answer, one question is here: no one can enter to my gmail because user/pass is encrypted and store in DB even the admin of gmail service. anyone can find the DB of gmail can read my emails or not they should be enter by my user / pass to read ? – Maryam Koj May 12 '18 at 14:05
1

Here’s a simple pseudocode in MVC framework

Let say you have encrypt(key, string) and decrypt(key, string) function.

In your Model

Store(value) {
    cipherText=encrypt($your_key, value)
    query= (“update table set ‘field’= ?”, cipherText)
}

Retrieve(id) {
    cipherText = (“select field from table where id = ?”, id)
    value = decrypt($your_key, cipherText)
    return value
}

In short, even admin should not be able to see plain data stored in DB, because it’s encrypted before stored.

Your key must be remain secret so manage it somehow properly.

2
  • So you means just admin or anyone with key can see the decrypt data, is this key can be found or data can be decrypt with brute force attack or something like this? – Maryam Koj May 11 '18 at 17:47
  • True. Also, a good cryptographic algorithm relies on the secrecy of the key, even people understand the algorithm, i.e. publicly known algorithm eg. AES, Blowfish, etc. So make sure your key is difficult enough to guess or brute force. Using, 256 bit symmetric key algorithm should be hard enough to brute force the key. – Arief Karfianto May 12 '18 at 1:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.