Storing encryption keys on a server using Node.js and MySQL

Question

I am writing a web backend/api for an iOS application using Node.js and MySQL. In my database I have a table for posts. I would like the posts content to be encrypted. Let's say I'm using this AES for encryption.

I would like to be able to safely encrypt and decrypt data on the server. Data sent back and forth to the client will be unencrypted, but sent over HTTPS (is this a good idea)?

My Questions:

1. How should I generate the keys? Should they be random strings?

2. Where should I store the keys since there is going to be a different key for each message.

Adversary Model
I would like to protect against someone who already has access to my server running the https API (written in Node.js) and has access to my MySQL DB. I would like to project against that person being able to decrypt the encrypted data in that table. So it is important that even if they have lots of encrypted data, and how the encryption works still cannot decrypt the data.

Answer 1

Hopefully I am understanding this properly. Client sends message to server over SSL encrypted connection. Server gets the message and stores it in a database. You are worried that if someone breaks into the server, they can read the database and see all the messages.

So, encryption seems like a natural fit. Encrypt the messages (each with a different key) before storing them in the database. The problem now is, what do to with the keys. You can't just store them on the server as the attacker is on the server. They can easily find the keys, pull the entire database and decrypt everything.

It would appear your best options are storing the keys on a different machine and let that machine do the encryption/decryption. That way the attacker would first have to break into your machine, then into the encryption/decryption machine. Not impossible, but hopefully much harder.

Another option would be some cryptographic hardware. This is beyond my expertise, but companies sell hardware that performs cryptographic operations including key storage, encryption and decryption.

Here is the tricky part. What stops the attacker from querying the other machine or the cryptographic hardware repeatedly until he has decrypted all the messages? You'll have to build some sort of detection on there or something like that.

In short, given your adversary model (attacker with root privileges on the box), the problem is pretty hard. Hopefully one of these two options will be useful to you, or at least generate some other answers.