The scenario: Data is sent to an application server and you want to selectively encrypt some data before sending it to a DB server for storage. All servers run some linux distro. This is a relatively high security situation where significant financial losses could be incurred if the data leaked, but at the same time this is not an issue of national security. Also, the servers are in a third-party cloud infrastructure, so HSMs are not an option. Specific regulatory requirements are not necessary, but I suspect the answer to this would satisfy the bulk of requirements.

Assumptions: Data is securely sent to the application server and application users are properly authorized for retrieval of data.

I have been searching for a while to come up with what is the currently accepted "industry best practice" for key management and keep coming across bits and pieces of good advice scattered about. Can someone point me to a resource that already answers this or can we come up with the best "currently accepted answer" to the exact scenario described above?

  • What is your budget for this? Can you consider commercial solutions?
    – Daisetsu
    Feb 13, 2014 at 0:15
  • Would prefer a non-commercial solution, but would be interested to look at the commercial offerings if they offer significant benefits Feb 13, 2014 at 1:59
  • Where does the data need to be used? is it being sent to a back office service? is it required to be queried by the application server later? Feb 18, 2014 at 0:44
  • AWS has an HSM solution actually. It ain't cheap. Apr 9, 2015 at 19:47

3 Answers 3


it sounds like you're looking for a solution to protect your data while it is "at rest". You probably already know that it not sufficient just to protect data while it is "at rest", while ignoring the security while it is being processed.

if you have a budget to purchase commercial (paid) solutions, you might want to look into one of these.

  1. Oracle Key Manager
  2. RSA Data Protection Manager

There are lots of potential solutions which depend on what services you are using. Amazon for instance offers solutions in combination with their Amazon Relational Database Service which provides he ability to encrypt data using format-preserving encryption.

You may want to look into "Transparent Data Encryption". It would really help to know a little more about the architecture of your setup. Is it a true cloud setup, or a colocation?

Lastly, I would urge you to consider the security implications of running "sensitive" data in the cloud.


Implementing application level encryption on Linux servers is a bit tricky as the application needs to be able to get the encryption key from somewhere and you don't want this to be in clear text anywhere. From a regulatory perspective, you'll likely want there to be dual control and split knowledge for encryption keys.

You could have some level of logical separation between key parts between access groups and between the application and the database which can be XOR'd together to create an encryption key though this will likely provide some limited security through obscurity.

Another option would be to have manual intervention to load the keys into application memory. e.g. have user1 decrypt a gpg file containing a key component and load this into application memory, then have user2 decrypt a gpg file containing a key component and load this into application memory. The application can XOR these components together so it has an encryption key in memory. You do have to consider system reboots/crashes and I guess user1 and user2 could be service accounts... you get the idea.

Hope this helps...


Are you sure your not just looking for personal Public/Private key infrastructure? You can create your own CA Servers / Intermediate Certs/ Server Certs and manage them all centrally (OpenSSL/whatever SSL flavor of them of the month off shoot). You can use your RSA pairs to encrypt Data in Transit (DIT) and Data At Rest (DAR).

Its basically what Oracle Key Manager and RSA DPM are. If you have them budget and lack the knowledge it's probably work implementing a commercial solution, but if you know what your doing on linux, it's not really that challenging. You'd likely find it an on-going process and you write scripts of automate tasks and deploy CA Certs for Golden Images.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .