This question already has an answer here:

I am using few secret keys to encrypt sensible date. What is the best way/place to protect the keys ? In a file located on my server ? Within the SGBG databse itself ? Or ... ?

marked as duplicate by Adi, Xander, schroeder, Gilles, Iszi Jul 9 '14 at 15:31

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

up vote 3 down vote accepted

You must store keys in such a way to minimize risks of the key being exposed to unauthorized third parties, while still allowing efficient operation by systems which must use the key. If such a system (your "server") comes under hostile control, then you have lost anyway. So the question about where the key should be stored really makes sense only with regards to partial breaches, in which an attacker gains some access to a part of the server, not to the whole thing.

That's about the most that can be said generally. Context matters.

If your context is about some sort of Web server, powered by some programmatic framework (say, PHP) with a SQL database for data storage, then we may argue that a very common kind of partial breach is SQL injection, which primarily allows the attacker to get read-only (or read-write) access to (parts of) the database, without directly impacting the security of the server itself. In that sense, the database may be said to be "more exposed" than the rest of the server; correspondingly, the keys should not be stored in the database itself. However, remember that this is only a very generic assertion which does necessarily apply to your specific case. Context matters.

Still generically, we may state that if your operating system offers some facilities dedicated to the storage of secret values, then using them is probably a good idea. In a Windows system, this points to DPAPI. Whether it will actually help is unclear (it, again, depends on the context -- the context matters) but it should not make harm.

  • For us we required to protect the hash keys not to cater the scenario of partial breaches but to protect user info from the employees. And also the case if the system comes under hostile control, for that even if the hash key is exposed, the algo for applying the hash resides in the obfuscated binary. The way we applied protection of the key was to store the key in db, encoded x number of times, and when we retrieved it we applied the key with salting technique that also a combination of y times. Only known to the obfuscated application – shabby Jun 18 '15 at 5:55