I have several fields in a database table I would like to encrypt, but I would like to do it in a way that would allow me to easily change the encryption key every n months for security reasons.
My initial thought was to store the IV with the row so I could use that to decrypt each entry where the key for the encryption would be stored elsewhere, in code or a configuration file. This seems like it will be a nightmare every n months when I needed to change the key, as I would have to have some job run that would need to change the IV for every row along with decrypting/encrypting again all of the necessary columns to the new key.
It just seems like this approach could also bog the system down while trying to decrypt and encrypt again. I have not seen a lot of articles describing practical approaches to this problem, just mentioning that the key should be changed periodically. Any help would be greatly appreciated, I am new to the encryption game.
Also, I am using AES-256 encryption. I am using SQL Server but might migrate to MySQL in the future. The application is coded in C# .Net. We are storing personal information (irst, middle name, last name, ssn, etc.) and must be HIPAA compliant and we want to make sure as well that if a key is ever compromised we could quickly change the key on the fly.