I need to implement a web application for user to update personal information. It consists of a page listing masked personal information and then a button which allows user to edit & update them.
I think the list function should be done by invoking API #1 to retrieve encrypted personal information and the corresponding plain but masked personal information. And the update function is done by invoking another API #2 (same API provider) with updated values and the other non-updated encrypted personal information for updating user profile. Because API #2 requires full set of data besides the updated pieces.
Am I correct? How to securely implement the encryption? Per-user symmetric key with login name & login timestamp? Or generate a session key randomly for every login session? Any hashing needed?