The Derby Database supports encryption with a key or password. Traditionally this key is stored in the file systems, now I am looking to store and protect this key in the HSM instead, but I couldn't figure out how I should be doing it.
The most simplest approach seems to be just putting the key itself into the HSM? Then on server startup, the application will query the HSM for the key, use it to boot the Derby database, and then discard the key. However, I have read that it seems ineffective because the key can then be simply extracted, but I do not really understand what's the security issue with this appraoch, is this the approach that I should be taking?
The second way that I read about is hybrid encryption, but I am not really sure whether it is applicable to my case. I will generate a symmetric key, then generate a keypair in the HSM. Then I will use the Public Key from the HSM to encrypt the symmetric key and store it locally in the file system. On server start up, I will pass this encrypted symmetric key to the HSM to decrypt it using the unextractable Private Key. Is there any merits using this approach or its overkill for this purpose?
From the way I understand, most of the usage of HSM revolves around having different senders (encrypt) and receivers (decrypt), hence the use of KeyPairs instead of symmetric keys?