For PII, we have to encrypt some columns in our DB (All of our infra resides on our own DC, not using any cloud provider).
Now roughly what we are doing is
- Created a CMK at AWS.
- Generate Data Key using CMK
- Store the encrypted key in DB
- For every request, we decrypt the encrypted data key via AWS and got the plaintext data key. (We basically do not do it for every request, we cache it for some time in memory due to costing/performance issues)
- We have created our own encryption library(Using AES-256 with CBC with random IV / random salt for every request)
- Then using the plaintext data key, we call the AES library to encrypt/decrypt.
Now I have a few questions
How many different data keys do we need to create? I mean whether it should be different for every column / different for every calling service/team?
Is AES-256 with CBC (Random SALT/Random IV for every request) fine for our use case or do I need to use AES with GCM?
Do I need to rotate the Data keys?