I am completely new to cryptography but have been trying to make myself familiar with the concepts and applications. I have a project where I believe cryptography to be beneficial.
DB = MySQL 5.6
Engine = InnoDB
My application will reside on an intranet web server behind a network firewall with a very small white-list. Few users of this application will have the ability to add/remove values from the database. A larger number of users would be able to read these values. Values I would hope to encrypt could include:
- account numbers
- unique ids
Largest table(s) would have up to 150k entries and total sessions likely to remain under 100.
Being an intranet site I assume (with limited security knowledge) that my primary threats will be malicious users, hardware theft, and persistent XSS from an internal or external source. I am doing my best to mitigate all of these.
Doing some research on how to encrypt my data while allowing it to be searchable leaves me with a few options (please correct wrong information);
- CipherSweet Blind Indexing: requires library, may be overkill, false positives possible
DECRYPT: if logs are compromised plaintext values will also be compromised
- Application Side: runtime "nightmare", heavy load, could cause issues with multiple threads running
- While ugly and poor practice should application side encryption/decryption be acceptable for my environment?
- Would the likelihood of false positives with CipherSweet be negligible for my datasets?
- Given my environment, would letting
MySQLhandle the encryption/decryption be acceptable (neglecting hardware theft or server compromise)
- Bonus - should I be worrying about external XSS given my environment
I understand this question may fall into the category of discussion and if that is the case please direct me to where I may find further information to narrow my questions.
I am now also exploring the possibilities of using CryptDB or TDE.
I am working with MySQL Community Edition so it seems TDE will not be available to me unless there is a way to specifically acquire only this feature. Continuing to research other options. Any information is appreciated.
EDIT 3 For my OS I dont think I will be able to use CryptDB as in its docs it says:
- Requirements: > Ubuntu 12.04, 13.04; Not tested on a different OS.