I have a requirement for storing multiple symmetric encryption keys in a database. What I want to know is, are there any standard, accepted practices for storing these keys in a database ?

To add a bit of context, I know that encrypting the encryption key itself is a bad idea because, then where would I securely store that encryption key which was used to encrypt the other keys.

So just want to know if there is any known standard practice for getting this done.


When you are facing such a (pain in the ass) problem, please, consider first using an existing solution for key management, I am sure you will be able to combine this solution with the software you are developing, if you really want to go on, then continue reading.

  1. Don't overkill. Consider if the environment you are in is safe enough for the purpose of the key. Although it is not a good practice, storing the key as plain text may be reasonably ok for you.
  2. If this is a high security environment don't DIY, buy a solution.
  3. If you want to go on =), you have to consider not only the secure storage of the key, you have to ensure also its transmission and its format.
  4. If the key is used by an script of unattended software, eventually they will need the key as plain text, so consider again if it is worth.
  5. If the keys are used by users (using a software), you can always store them encrypted with an user password, but consider that it will be the user the one who decypher it, so you will need to send him the encrypted-key.
  6. There are a lot of implications with key management, be sure you fully understand whats behind in this topic.

You can have a look also to these NIST guides:


| improve this answer | |

What database software?

If it's MS SQL Server, then the CREATE SYMMETRIC KEY is probably something to consider. Note that "When a symmetric key is created, the symmetric key must be encrypted by using at least one of the following: certificate, password, symmetric key, asymmetric key, or PROVIDER. The key can have more than one encryption of each type. In other words, a single symmetric key can be encrypted by using multiple certificates, passwords, symmetric keys, and asymmetric keys at the same time."

For other databases, see if they have their own built-in mechanisms.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.