I need some advice on MySQL AES Encryption. I'm developing an application which connects to various 3rd-Party APIs and retrieves the Access Tokens for the application users. These Access Tokens are long-lived and will be used in offline mode for performing a bunch of tasks. My Question is that since Access Tokens have much privileges on a user's account, is it a good idea to store them using AES or some similar Encryption ? Is there any other better approach to secure these tokens?


Yes, it's a wise idea, but I'd recommend doing encryption in the application code and not in MySQL, because AES functions in MySQL are using ECB block mode, which is discouraged from being used in cryptographic systems.

Read more at: https://en.wikipedia.org/wiki/Block_cipher_mode_of_operation#Electronic_codebook_.28ECB.29

To increase security, you could perform encryption/decryption in a HSM (hardware security module) or create a poor man's version of it with software. That way, the cryptographic material (e.g., master key) is more difficult to access.

  • Thanks Matrix for your response. One more thing, can you suggest where to store the encryption key? What is the best way to secure it? – khalid Oct 3 '13 at 11:40
  • You can derive the encryption key for each token using HMAC(masterKey, somethingUnique), where somethingUnique is something that is unique (and unchangable) to each token row in your database, like tokenId. This way, every token will be encrypted with a unique key. Master key can be stored inside HSM or a software version of it (more flexible). – Matrix Oct 6 '13 at 10:02
  • Maybe I'm missing something but why not use a mode of operation that accepts an IV; then you only need to manage the master key and not a unique key for every row. – Mark Fox Feb 28 '14 at 3:50
  • You cannot choose a different mode of operation, ECB is the only option. – Matrix Feb 28 '14 at 7:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.