1

I need some advice on MySQL AES Encryption. I'm developing an application which connects to various 3rd-Party APIs and retrieves the Access Tokens for the application users. These Access Tokens are long-lived and will be used in offline mode for performing a bunch of tasks. My Question is that since Access Tokens have much privileges on a user's account, is it a good idea to store them using AES or some similar Encryption ? Is there any other better approach to secure these tokens?

1 Answer 1

1

Yes, it's a wise idea, but I'd recommend doing encryption in the application code and not in MySQL, because AES functions in MySQL are using ECB block mode, which is discouraged from being used in cryptographic systems.

Read more at: https://en.wikipedia.org/wiki/Block_cipher_mode_of_operation#Electronic_codebook_.28ECB.29

To increase security, you could perform encryption/decryption in a HSM (hardware security module) or create a poor man's version of it with software. That way, the cryptographic material (e.g., master key) is more difficult to access.

4
  • Thanks Matrix for your response. One more thing, can you suggest where to store the encryption key? What is the best way to secure it?
    – khalid
    Oct 3, 2013 at 11:40
  • You can derive the encryption key for each token using HMAC(masterKey, somethingUnique), where somethingUnique is something that is unique (and unchangable) to each token row in your database, like tokenId. This way, every token will be encrypted with a unique key. Master key can be stored inside HSM or a software version of it (more flexible).
    – Matrix
    Oct 6, 2013 at 10:02
  • Maybe I'm missing something but why not use a mode of operation that accepts an IV; then you only need to manage the master key and not a unique key for every row.
    – Mark Fox
    Feb 28, 2014 at 3:50
  • You cannot choose a different mode of operation, ECB is the only option.
    – Matrix
    Feb 28, 2014 at 7:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.